Using IAM Roles or Policies to Grant Access to DSC

To manage DSC permissions based on roles and policies, you can use Identity and Access Management (IAM) to implement fine-grained permissions control over your IAM resources. With IAM, you can:

Create IAM users for personnel based on your enterprise's organizational structure. Each IAM user has their own identity credentials for accessing WAF resources
Grant only the permissions required for users to perform a task.
Entrust a Huawei Cloud account or a cloud service to perform professional and efficient O&M on your DSC resources.

If your Huawei Cloud account does not require individual IAM users, skip this chapter.

This section describes the role-based authorization method. Process Flow shows the authorization process.

Prerequisites

Before granting permissions, learn about DSC permissions and choose them as required. To grant permissions for other services, learn about all system-defined permissions supported by IAM.

Process Flow

Figure 1 Process for granting permissions

Create a user group and assign permissions.
Create a user group on the IAM console, and assign the DSC ReadOnlyAccess permission to the group.
Create an IAM user and add it to the user group.

Create a user on the IAM console and add the user to the group created in 1.
Log in as an IAM user and verify permissions.
Log in to the DSC console using the created user and verify that the user has administrator permissions for DSC.
- Choose Service List > Data Security Center. On the DSC console, click Buy DSC. If the purchase fails (assuming that the current permission contains only DSC ReadOnlyAccess), the DSC ReadOnlyAccess policy has already taken effect.
- Choose any other service in the Service List. (Assume that the current policy contains only DSC ReadOnlyAccess.) If a message appears indicating insufficient permissions to access the service, the DSC ReadOnlyAccess policy has already taken effect.

Example Custom Policies

Custom policies can be created to supplement the system-defined policies of DSC.

You can create custom policies in either of the following ways:

Visual editor: Select cloud services, actions, resources, and request conditions without the need to know policy syntax.
JSON: Edit JSON policies from scratch or based on an existing policy.

For details, see Creating a Custom Policy. The following provides examples of custom DSC policies.

Example 1: Allowing a user to query the big data assets

      
           {
        "Version": "1.1",
        "Statement": [
                {
                        "Effect": "Allow",
                        "Action": [
                                "dsc:bigdataAsset:list"
                                                       ]
                }
        ]
}

Example 2: Disallowing a user to query the OBS assets

A deny policy must be used together with other policies. If the permissions assigned to a user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.

The following method can be used if you need to assign permissions of the DSC FullAccess policy to a user but also forbid the user from querying the OBS asset list (dsc:obsAsset:list). Create a custom policy with the same action for denying querying the OBS asset list, and assign both policies to the group the user belongs to. Then, the user can perform all operations on DSC except querying the OBS asset list. The following is an example policy for denying querying OBS asset list.

      
           {
        "Version": "1.1",
        "Statement": [
                {
                        "Effect": "Deny",
                        "Action": [
                                "dsc:obsAsset:list"                                
                        ]
                },
        ]
}

Multi-action policy

A custom policy can contain the actions of multiple services that are of the project-level type. The following is an example policy containing actions of multiple services:

      
       
         
         
           {
        "Version": "1.1",
        "Statement": [
                {
                        "Effect": "Allow",
                        "Action": [
                                "dsc:obsAsset:list",
                                "dsc:scanRule:list"
                        ]
                },
               {
                        "Effect": "Allow",
                        "Action": [
                                "hss:hosts:switchVersion",
                                "hss:hosts:manualDetect",
                                "hss:manualDetectStatus:get"
                        ]
                }
        ]
}

          

        

      
     