Copied.
Agency Permissions
Overview
To use certain functions of MgC, you must assign MgC the required permissions so that it can provide you with complete services. This section describes the scenarios where agency-based authorization is required and what custom permission policies will be created.
The system may create a new custom policy or update an existing policy during the agency-based authorization.
- If there is no available custom policy, the system automatically creates a new one. For details about how to create a custom policy, see Creating a Custom Policy.
- If there is an available custom policy but it does not contain required permissions, the system automatically updates the policy.
You can view the agency permissions assigned to MgC in the following ways:
- Sign in to the IAM console.
- In the navigation pane on the left, choose Agencies.
- In the agency list, find the agency named mgc_migration_trust and click its name.
- On the Permissions tab, you can view the policies that have been assigned to MgC.
Cross-AZ Migration
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Cross-AZ migration |
MgC |
MgC AzMigrationAgencyPolicy |
ecs:cloudServers:showServer (Querying details about an ECS) ecs:flavors:get (Querying ECS flavors) ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information) ecs:cloudServerQuotas:get (Querying quotas of a tenant) ecs:servers:list (Querying ECSs) ecs:cloudServers:list (Querying details about ECSs) ecs:servers:stop (Stopping an ECS) ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS) ecs:cloudServers:createServers (Creating an ECS) ecs:cloudServers:listServerBlockDevices (Querying information about the disks attached to an ECS) ecs:cloudServerNics:update (Configuring a private IP address for a NIC of an ECS) ecs:availabilityZones:list (Listing AZs) ecs:servers:start (Starting an ECS) ecs:cloudServers:changeNetworkInterface (Updating attributes of a specified NIC on an ECS) ecs:serverInterfaces:get (Querying ECS NICs) ecs:cloudServers:get (Querying details about an ECS) vpc:publicIps:create (Creating an EIP) vpc:publicIps:update (Updating an EIP) vpc:subnets:get (Querying subnets or querying details about a subnet) vpc:networks:get (Querying networks) vpc:publicIps:list (Listing EIPs) vpc:publicIps:get (Querying details about an EIP) vpc:ports:get (Querying ports or querying details about a port) vpc:ports:delete (Deleting a port) vpc:ports:update (Updating a port) vpc:ports:create (Creating a port) evs:types:get (Querying EVS disk types) evs:volumes:list (Listing EVS disks) cbr:vaults:get (Querying a specified vault) cbr:vaults:list (Querying vaults) cbr:vaults:create (Creating a vault) cbr:vaults:addResources (Associating resources) cbr:vaults:backup (Creating backups) cbr:backups:list (Querying backups) cbr:tasks:list (Querying tasks) cbr:tasks:get (Querying details about a task) cbr:backups:delete (Deleting a backup) cbr:backups:get (Querying a backup) cbr:vaults:delete (Deleting a vault) ims:wholeImages:create (Creating a full-ECS image) ims:images:list (Listing images) ims:images:delete (Deleting an image) ims:images:get (Querying details about an image) ims:serverImages:create (Creating an image) |
|
Enabling SMN notifications for a cross-AZ migration workflow |
MgC |
MgC MigrationSmnAgencyPolicy |
smn:topic:list (Listing topics) smn:topic:publish (Publishing messages) |
TCO Analysis
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Creating a TCO analysis task |
MgC |
MgC TcoAgencyPolicy |
ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information) evs:types:get (Querying EVS disk types) |
Cloud Discovery
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Huawei Cloud discovery |
MgC |
MgC CloudPlatformCollectionAgencyPolicy |
vpc:vpcs:list (Listing VPCs) vpc:subnets:get (Querying subnets or querying details about a subnet) vpc:securityGroups:get (Querying security groups or querying details about a security group) vpc:securityGroupRules:get (Querying security group rules or querying details about a security group rule) vpc:publicIps:list (Listing EIPs) ecs:cloudServers:list (Querying details about ECSs) evs:volumes:list (Listing EVS disks) ces:metricData:list (Querying metric data) |
Target Recommendations
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Target recommendations |
MgC |
MgC ServerAssessAgencyPolicy |
ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information) ims:images:list (Listing images) evs:types:get (Querying EVS disk types) deh:dedicatedHosts:get (Obtaining details about a DeH) deh:dedicatedHosts:list (Listing DeHs) |
Target Server Association
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Target server association |
MgC |
MgC ServerBindTargetAgencyPolicy |
ecs:cloudServers:showServer (Querying details about an ECS) evs:volumes:list (Listing EVS disks) ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information) ims:images:list (Listing images) |
Migration Plans (New)
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Batch server migration plans – server quota verification |
MgC |
MgC ServerMigrationQuotasAgencyPolicy |
ecs:cloudServers:list (Querying details about ECSs) evs:quotas:get (Querying EVS disk quotas) ecs:cloudServerQuotas:get (Querying quotas of a tenant) vpc:quotas:list (Listing resource quotas) |
Server Migration Workflows
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Server migration workflows |
MgC |
MgC ServerMigrationAgencyPolicy |
ecs:cloudServers:showServer (Querying details about an ECS) ecs:cloudServers:createServers (Creating an ECS) sms:server:migrationServer (Migrating a source server) sms:server:queryServer (Querying source servers) ecs:cloudServers:list (Querying ECSs) ecs:cloudServers:listServerBlockDevices (Querying information about the disks attached to an ECS) ecs:cloudServerQuotas:get (Querying quotas of a tenant) vpc:publicIps:create (Creating an EIP) vpc:privateIps:list (Querying private IP addresses) ecs:cloudServers:get (Querying details about an ECS) ecs:cloudServers:changeVpc (Changing a VPC for an ECS) ecs:cloudServers:attach (Attaching a disk to an ECS) ecs:cloudServers:start (Starting ECSs in batches) ecs:cloudServers:detachVolume (Detaching a disk from a specified ECS) ecs:cloudServers:stop (Stopping ECSs in batches) ecs:servers:unlock (Unlocking an ECS) evs:volumes:delete (Deleting an EVS disk) evs:volumes:use (Attaching and detaching EVS disks) evs:volumes:get (Querying details about an EVS disk) ims:images:get (Querying details about an image) |
|
Enabling the option to retain IP addresses for a server migration workflow |
MgC |
MgC ServerMigrationIpKeepAgencyPolicy |
vpc:subnets:get (Querying subnets or querying details about a subnet) ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS) |
|
Enabling SMN notifications for a server migration workflow |
MgC |
MgC MigrationSmnAgencyPolicy |
smn:topic:list (Listing topics) smn:topic:publish (Publishing messages) |
Server Migration Tasks
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Server migration tasks |
MgC |
MgC ServerMigrationAgencyPolicy |
ecs:cloudServers:showServer (Querying details about an ECS) ecs:cloudServers:createServers (Creating an ECS) sms:server:migrationServer (Migrating a source server) sms:server:queryServer (Querying source servers) ecs:cloudServers:list (Querying ECSs) ecs:cloudServers:listServerBlockDevices (Querying information about the disks attached to an ECS) ecs:cloudServerQuotas:get (Querying quotas of a tenant) vpc:publicIps:create (Creating an EIP) vpc:privateIps:list (Querying private IP addresses) ecs:cloudServers:get (Querying details about an ECS) ecs:cloudServers:changeVpc (Changing a VPC for an ECS) ecs:cloudServers:attach (Attaching a disk to an ECS) ecs:cloudServers:start (Starting ECSs in batches) ecs:cloudServers:detachVolume (Detaching a disk from a specified ECS) ecs:cloudServers:stop (Stopping ECSs in batches) ecs:servers:unlock (Unlocking an ECS) evs:volumes:delete (Deleting an EVS disk) evs:volumes:use (Attaching and detaching EVS disks) evs:volumes:get (Querying details about an EVS disk) ims:images:get (Querying details about an image) |
|
Enabling the option to retain IP addresses for a server migration task |
MgC |
MgC ServerMigrationIpKeepAgencyPolicy |
vpc:subnets:get (Querying subnets or querying details about a subnet) ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS) |
|
Enabling SMN notifications for a server migration task |
MgC |
MgC MigrationSmnAgencyPolicy |
smn:topic:list (Listing topics) smn:topic:publish (Publishing messages) |
Resource Purchases
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Resource purchases |
MgC |
MgC PurchaseAgencyPolicy |
eps:resources:add (Adding resources to an enterprise project) ecs:cloudServers:createServers (Creating an ECS) ecs:cloudServers:showServer (Querying details about an ECS) ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information) ecs:cloudServers:list (Querying details about ECSs) evs:volumes:list (Listing EVS disks) vpc:publicIps:update (Updating an EIP) vpc:publicIps:create (Creating an EIP) ims:images:list (Listing images) |
Configuring Server Purchase Templates
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Configuring a server purchase template |
MgC |
MgC PurchaseTemplateAgencyPolicy |
iam:projects:listProjects (Querying projects) eps:enterpriseProjects:list (Listing enterprise projects) vpc:subnets:get (Querying subnets or querying details about a subnet) vpc:securityGroups:get (Querying security groups or querying details about a security group) vpc:vpcs:get (Querying VPC details) |
Migration Plans (Old)
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Batch server migration plans – importing target server configurations from an OBS bucket |
MgC |
MgC ImportTargetConfigurationAgencyPolicy |
obs:object:GetObject (Obtaining object content and metadata) obs:bucket:ListBucket (Listing objects in a bucket) obs:bucket:ListAllMyBuckets (Listing buckets) |
|
Batch server migration plans – exporting target server configurations |
MgC ExportTargetConfigurationAgencyPolicy |
ims:images:list (Listing images) ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information) |
|
|
Batch server migration plans – server quota verification |
MgC ServerMigrationQuotasAgencyPolicy |
ecs:cloudServers:list (Querying details about ECSs) evs:quotas:get (Querying EVS disk quotas) ecs:cloudServerQuotas:get (Querying quotas of a tenant) vpc:quotas:list (Listing resource quotas) |
|
|
Batch object storage migration plans – configuring target buckets |
MgC ListObsBucketsAgencyPolicy |
obs:bucket:ListAllMyBuckets (Listing buckets) |
Migration Cluster Creation
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Migration cluster creation |
OMS |
OMS ObsMigrationAgencyPolicy |
ecs:cloudServers:createServers (Creating an ECS) ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS) ecs:cloudServers:showServer (Querying details about an ECS) ecs:cloudServers:deleteServers (Deleting ECSs) nat:natGateways:create (Creating a NAT Gateway) nat:natGateways:get (Querying details about a NAT gateway) nat:natGateways:delete (Deleting a NAT gateway) nat:snatRules:create (Creating an SNAT rule) nat:snatRules:get (Querying details about an SNAT rule) nat:dnatRules:list (Querying DNAT rules) nat:snatRules:list (Querying SNAT rules) nat:snatRules:delete (Deleting an SNAT rule) vpc:securityGroups:create (Creating a security group) vpc:securityGroups:delete (Deleting a security group) vpc:securityGroups:get (Querying security groups or querying details about a security group) vpc:securityGroupRules:create (Creating a security group rule) vpc:securityGroupRules:get (Querying security group rules or querying details about a security group rule) vpc:securityGroupRules:delete (Deleting a security group rule) vpcep:epservices:create (Creating a VPC endpoint service) vpcep:epservices:get (Querying details about a VPC endpoint service) vpcep:epservices:delete (Deleting a VPC endpoint service) vpcep:connections:update (Accepting or rejecting a VPC endpoint) vpcep:permissions:update (Batch adding or deleting whitelist records of a VPC endpoint service) lts:topics:create (Creating a log topic) lts:topics:delete (Deleting a log topic) lts:groups:create (Creating a log group) lts:groups:get (Querying details about a log group) lts:groups:delete (Deleting a log group) ims:images:list (Listing images) apm:icmgr:list (Listing ICAgents) apm:icmgr:get (Obtaining the collection component version) |
|
ECS |
ECS ObsMigrationAgencyPolicy |
apm:icmgr:* (Full permissions for the APM collection component) |
Storage Migration Workflows
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Storage migration workflows |
MgC |
- |
OMS AgencyOperator (a system-defined role) |
Storage Migration Tasks
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Storage migration tasks |
MgC |
- |
OMS AgencyOperator (a system-defined role) |
RVTools Data Imports
|
Scenario |
Delegated Object |
Custom Policy |
Minimal Permissions |
|---|---|---|---|
|
Importing RVTools data |
MgC |
MgC OfflineCollectionAgencyPolicy |
obs:object:GetObject (Obtaining object content and metadata) obs:bucket:ListBucket (Listing objects in a bucket) obs:bucket:ListAllMyBuckets (Listing buckets) |
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
