Updated on 2025-09-08 GMT+08:00

Authorization

Scenario

Some HSS functions depend on other cloud service resources. To use these functions, you need to delegate HSS to perform operations on related cloud service resources, such as task scheduling and resource O&M.

When you log in to the HSS console and use certain function for the first time, HSS automatically requests the permissions of other cloud service resources in the current region. After you grant the permissions, HSS automatically creates an agency named hss_policy_trust in IAM and grants the agency to the internal account op_svc_hss. For details about the agency, see Agency.

To use HSS in multiple regions, grant cloud resource permissions in each region. To view the delegation records of each region, go to the IAM console, choose Agencies, and click hss_policy_trust.

Table 1 describes the cloud service resource permissions that HSS needs you to assign.

Table 1 Required permissions on other cloud service resources

Function

Required Permission

Cloud Service Permission

Usage

Permission

Action

Container audit (image repository audit)

CTSOperatePolicy

Query audit events

cts:trace:list

Obtain image operation logs (CTS logs of SWR).

Installation and configuration on servers

VPCOperatePolicy

Create a port

vpc:ports:create

Create network interface cards (NICs) and modify security groups to ensure that the port used for installing the agent is accessible.

Delete a port

vpc:ports:delete

Create a security group rule

vpc:securityGroupRules:create

Delete a security group rule

vpc:securityGroupRules:delete

Query the port list or the details about a port

vpc:ports:get

Query the network list or the details about a network

vpc:networks:get

Query the subnet list or the details about a subnet

vpc:subnets:get

VPCEPOperatePolicy

Create an endpoint

vpcep:endpoints:create

Maintain the network channel between the agent and the HSS cloud protection center (master).

Query the endpoint list

vpcep:endpoints:list

Delete an endpoint

vpcep:endpoints:delete

  • Installation and configuration on containers
  • Scheduled repository image synchronization

CCEOperatePolicy

Query cluster information

cce:cluster:get

Manage the lifecycle of HSS-Daemonset and Configmap in a CCE cluster.

Query clusters in a project

cce:cluster:list

Query agencies based on specified conditions

iam:agencies:listAgencies

Scheduled repository image synchronization

SWROperatePolicy

Query the organization list

swr:namespace:listNamespaces

Obtain information about a specified SWR image repository, including its organization, repository, and artifacts.

Query the image list

swr:repo:listRepos

Query the image tag list

swr:repo:listRepoTags

Query the shared image list

swr:repo:listSharedRepos

Obtain the instance list

swr:instance:list

Obtain details about a synchronized repository

swr:instance:getRegistry

Obtain details about a repository

swr:repository:getRepository

Obtaining instance details

swr:instance:get

Obtain the repository list

swr:repository:listRepositories

Obtain the artifact list

swr:repository:listArtifacts

Prerequisites

If you are an IAM user, contact the account administrator to assign the following permissions to you:

  • On the new IAM console: IAMReadOnlyPolicy or IAMFullAccessPolicy system policy.
  • On the old IAM console: HSS AgencyOperatePolicy system policy or Security Administrator system role.

IAM users must have the preceding permissions to view or process authorization management information. For details, see Creating a User Group and Assigning Permissions.

Assigning Cloud Service Resource Permissions

  1. Log in to the HSS console.
  2. Click in the upper left corner and select a region or project.
  1. In the navigation pane, choose Installation & Configuration > Permissions Management.
  2. Click Assign. The Assign dialog box is displayed.

    Figure 1 Assigning permissions

  3. Select permissions and click OK.

    The Container Audit, Server Install & Config, and Container Install & Config pages cannot work properly if required permissions are not assigned. You can click Assign in the reminder on the top of the pages to assign permissions.

Deleting Cloud Service Resource Permissions

  1. Log in to the HSS console.
  2. Click in the upper left corner and select a region or project.
  3. In the navigation pane, choose Installation & Configuration > Permissions Management.
  4. Locate a permission and click Remove in the Operation column. The Remove Permissions dialog box is displayed.

    Alternatively, select multiple permissions and click Remove above the list.

    Figure 2 Removing permissions

  5. Confirm the permission information, enter DELETE in the dialog box, and click OK.

    If the permission is no longer displayed in the permission list, it indicates the permission has been removed.