Using IAM Identity Policies to Grant Access to EVS

Prerequisites

You have learned about the system-defined identity policies for EVS in Identity Policy-based Permissions Management. To grant access to services other than EVS, see System-defined Policies/Roles.

Process Flow

Figure 1 Process of granting EVS permissions

1. On the IAM console, create an IAM user or create a user group.

2. Attach a system-defined identity policy (EVSReadOnlyPolicy as an example) to the user or user group.

3. Log in as the IAM user and verify permissions.

   In the authorized region, perform the following operations:

   • Choose Service List > Elastic Volume Service. Then click Buy Disk on the EVS console. If a message appears indicating that you have insufficient permissions to perform the operation, the EVSReadOnlyPolicy policy is in effect.
   • Choose another service from Service List. If a message appears indicating that you have insufficient permissions to access the service, the EVSReadOnlyPolicy policy is in effect.

Example Custom Policies

• Example 1: Grant permissions to create disks.

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                                  "evs:volumes:create",
                                  "evs:volumes:list",
                                  "evs:volumes:get",
                                  "evs:types:get",
                                  "evs:quotas:get",
                                  "ecs:cloudServerFlavors:get",
                                  "ecs:cloudServers:listServersDetails"
              ]
          }
      ]
  }

• Example 2: Create a custom policy containing multiple actions.

  A custom policy can contain the actions of one or multiple services. Example policy containing multiple actions:

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "evs:volumes:create",
                  "evs:volumes:list"
  
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "evs:volumes:create",
                  "evs:volumes:list",
                  "evs:volumes:get",
                  "evs:types:get",
                  "evs:quotas:get",
                  "evs:volumes:use"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "ecs:cloudServerFlavors:get",
                  "ecs:cloudServers:listServersDetails",
                  "ecs:cloudServers:showServer",
                  "ecs:cloudServers:attach",
                  "ecs:cloudServers:detachVolume"
              ]
          }
      ]
  }

• Example 3: Grant permissions to forcibly create encrypted disks.

  You can create a custom policy to force users to create only encrypted disks.

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Deny",
              "Action": [
                  "evs:volumes:create"
              ],
              "Condition": {
                  "Bool": {
                      "evs:Encrypted": [
                          "false"
                      ]
                  }
              }
          }
      ]
  }

• Example 4: Grant permissions to forcibly create backups for disks.

  You can create a custom policy to force users to use cloud backup when creating disks.

  

  When forcible backup is configured and you are creating a yearly/monthly disk, you must choose an existing backup vault.

  Example policy:

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Deny",
              "Action": [
                  "evs:volumes:create"
              ],
              "Condition": {
                  "Null": {
                      "cbr:VaultId": [
                          "true"
                      ]
                  }
              }
          }
      ]
  }