# 委托授权
由于SWR企业版在运行中对网络、存储、安全等各类云服务资源都存在依赖关系，因此当您首次登录SWR企业版控制台时，SWR将自动请求获取云资源权限，从而更好地为您提供服务。
#### 前提条件
如果您的账号是IAM子账号，那么您的子账号需要有以下权限才可正常委托授权：关于如何自定义添加云服务的操作权限，请参见[自定义策略样例](https://support.huaweicloud.com/usermanual-cce/cce_10_0732.html#cce_10_0732__section1437818291149)。
#### 约束与限制
在使用SWR企业版委托时，请务必遵守以下限制，以避免业务中断：
- 严禁删除委托：SWR企业版依赖该服务委托来访问您的网络、存储以及安全等各类云服务资源，请勿在IAM控制台删除由SWR自动创建的委托。
- 风险说明：如果删除该委托，SWR的核心功能（如创建注册表、镜像上传下载）不可用，并可能导致资源计费异常。
- 恢复方法：如意外删除，需重新登录SWR企业版控制台界面触发重新授权。
 
表1关联云服务权限 
| 关联云服务                                        | 操作名称         | 权限**（旧版IAM）**                               | 权限**（新版IAM）**                   |
|:---|:---|:---|:---|
| 统一身份认证服务（Identity and Access Management，IAM） | 查询权限列表       | iam:roles:listRoles                         | iam:roles:list                  |
| 统一身份认证服务（Identity and Access Management，IAM） | 查询委托列表信息     | iam:agencies:listAgencies                   | iam:agencies:list               |
| 统一身份认证服务（Identity and Access Management，IAM） | 查询委托以及信任委托列表 | iam:agencies:listAgencies                   | iam:agencies:listV5             |
| 统一身份认证服务（Identity and Access Management，IAM） | 创建委托         | iam:agencies:createAgency                   | iam:agencies:create             |
| 统一身份认证服务（Identity and Access Management，IAM） | 为委托授予指定权限    | iam:permissions:grantRoleToAgency           | iam:agencies:grantRole          |
| 统一身份认证服务（Identity and Access Management，IAM） | 查询委托的所有权限    | iam:permissions:listRolesForAgency          | iam:agencies:listRoles          |
| 统一身份认证服务（Identity and Access Management，IAM） | 查询项目服务中的委托权限 | iam:permissions:listRolesForAgencyOnProject | iam:agencies:listRolesOnProject |
   
#### 系统策略SWREnterpriseAgencyPolicy
SWR企业版通过创建委托并授予SWREnterpriseAgencyPolicy策略权限，该策略包含了SWR企业版访问用户资源所需的所有操作权限。
![](https://support.huaweicloud.com/usermanual2-swr/public_sys-resources/caution_3.0-zh-cn.png)
SWREnterpriseAgencyPolicy策略的权限将随SWR企业版功能扩展而动态更新，持续适配业务发展需求。
```
{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "iam:users:getUser"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "vpc:securityGroups:create",
                "vpc:securityGroups:delete",
                "vpc:securityGroups:get",
                "vpc:securityGroupRules:create",
                "vpc:securityGroupRules:delete",
                "vpc:ports:create",
                "vpc:ports:delete",
                "vpc:ports:update",
                "vpc:ports:get",
                "vpc:subnets:get",
                "vpc:vpcs:get",
                "vpcep:endpoints:create",
                "vpcep:endpoints:delete",
                "vpcep:endpoints:get"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:cmk:create",
                "kms:cmk:update",
                "kms:cmk:getMaterial",
                "kms:cmk:get",
                "kms:cmk:list",
                "kms:cmk:sign",
                "kms:cmk:getPublicKey",
                "kms:dek:create",
                "kms:dek:decrypt",
                "kms:dek:encrypt"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "ces:metricData:list"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "hss:images:set",
                "hss:images:list",
                "hss:vuls:list",
                "hss:containers:list",
                "hss:containers:set"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "swr:instance:createTempCredential",
                "swr:instance:list",
                "swr:repository:listRepositories",
                "swr:repository:listArtifacts",
                "swr:instance:listAllArtifacts",
                "swr:repository:downloadArtifact",
                "swr:repository:getTag"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "obs:bucket:CreateBucket",
                "obs:bucket:DeleteBucket",
                "obs:bucket:DeleteBucketPolicy",
                "obs:bucket:GetBucketPolicy",
                "obs:bucket:GetBucketStorage",
                "obs:bucket:GetEncryptionConfiguration",
                "obs:bucket:GetLifecycleConfiguration",
                "obs:bucket:HeadBucket",
                "obs:bucket:ListBucket",
                "obs:bucket:ListBucketMultipartUploads",
                "obs:bucket:PutBucketPolicy",
                "obs:bucket:PutEncryptionConfiguration",
                "obs:bucket:PutLifecycleConfiguration",
                "obs:object:AbortMultipartUpload",
                "obs:object:DeleteObject",
                "obs:object:GetObject",
                "obs:object:ListMultipartUploadParts",
                "obs:object:PutObject"
            ],
            "Effect": "Allow"
        }
    ]
}
```
#### 自定义委托授权
为满足不同客户的权限管理需求，SWR企业版支持用户自定义委托授权。如需自行配置权限，可通过手动创建同名委托并完成相关授权来实现。 具体操作请参见[自定义委托授权](https://support.huaweicloud.com/bestpractice2-swr/swr_bestpractice_1015.html)。