Authorization
Scenario
Some HSS functions depend on other cloud service resources. To use these functions, you need to delegate HSS to perform operations on related cloud service resources, such as task scheduling and resource O&M.
When you log in to the HSS console and use certain function for the first time, HSS automatically requests the permissions of other cloud service resources in the current region. After you grant the permissions, HSS automatically creates an agency named hss_policy_trust in IAM and grants the agency to the internal account op_svc_hss. For details about the agency, see Agency.
To use HSS in multiple regions, grant cloud resource permissions in each region. To view the delegation records of each region, go to the IAM console, choose Agencies, and click hss_policy_trust.
Table 1 describes the cloud service resource permissions that HSS needs you to assign.
Function |
Required Permission |
Cloud Service Permission |
Usage |
|
---|---|---|---|---|
Permission |
Action |
|||
Container audit (image repository audit) |
CTSOperatePolicy |
Query audit events |
cts:trace:list |
Obtain image operation logs (CTS logs of SWR). |
Installation and configuration on servers |
VPCOperatePolicy |
Create a port |
vpc:ports:create |
Create network interface cards (NICs) and modify security groups to ensure that the port used for installing the agent is accessible. |
Delete a port |
vpc:ports:delete |
|||
Create a security group rule |
vpc:securityGroupRules:create |
|||
Delete a security group rule |
vpc:securityGroupRules:delete |
|||
Query the port list or the details about a port |
vpc:ports:get |
|||
Query the network list or the details about a network |
vpc:networks:get |
|||
Query the subnet list or the details about a subnet |
vpc:subnets:get |
|||
VPCEPOperatePolicy |
Create an endpoint |
vpcep:endpoints:create |
Maintain the network channel between the agent and the HSS cloud protection center (master). |
|
Query the endpoint list |
vpcep:endpoints:list |
|||
Delete an endpoint |
vpcep:endpoints:delete |
|||
|
CCEOperatePolicy |
Query cluster information |
cce:cluster:get |
Manage the lifecycle of HSS-Daemonset and Configmap in a CCE cluster. |
Query clusters in a project |
cce:cluster:list |
|||
Query agencies based on specified conditions |
iam:agencies:listAgencies |
|||
Scheduled repository image synchronization |
SWROperatePolicy |
Query the organization list |
swr:namespace:listNamespaces |
Obtain information about a specified SWR image repository, including its organization, repository, and artifacts. |
Query the image list |
swr:repo:listRepos |
|||
Query the image tag list |
swr:repo:listRepoTags |
|||
Query the shared image list |
swr:repo:listSharedRepos |
|||
Obtain the instance list |
swr:instance:list |
|||
Obtain details about a synchronized repository |
swr:instance:getRegistry |
|||
Obtain details about a repository |
swr:repository:getRepository |
|||
Obtaining instance details |
swr:instance:get |
|||
Obtain the repository list |
swr:repository:listRepositories |
|||
Obtain the artifact list |
swr:repository:listArtifacts |
Prerequisites
If you are an IAM user, contact the account administrator to assign the following permissions to you:
- On the new IAM console: IAMReadOnlyPolicy or IAMFullAccessPolicy system policy.
- On the old IAM console: HSS AgencyOperatePolicy system policy or Security Administrator system role.
IAM users must have the preceding permissions to view or process authorization management information. For details, see Creating a User Group and Assigning Permissions.
Assigning Cloud Service Resource Permissions
- Log in to the HSS console.
- Click
in the upper left corner and select a region or project.
- In the navigation pane, choose Installation & Configuration > Permissions Management.
- Click Assign. The Assign dialog box is displayed.
Figure 1 Assigning permissions
- Select permissions and click OK.
The Container Audit, Server Install & Config, and Container Install & Config pages cannot work properly if required permissions are not assigned. You can click Assign in the reminder on the top of the pages to assign permissions.
Deleting Cloud Service Resource Permissions
- Log in to the HSS console.
- Click
in the upper left corner and select a region or project.
- In the navigation pane, choose Installation & Configuration > Permissions Management.
- Locate a permission and click Remove in the Operation column. The Remove Permissions dialog box is displayed.
Alternatively, select multiple permissions and click Remove above the list.
Figure 2 Removing permissions - Confirm the permission information, enter DELETE in the dialog box, and click OK.
If the permission is no longer displayed in the permission list, it indicates the permission has been removed.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot