lhajba/cloud-connect
1
0
Fork 0
forked from docs/cloud-connect
Code Pull Requests Activity

Changes to ccn_umn from docs/doc-exports#1450 (CCN UMN 20250121 version)

Browse Source 
Reviewed-by: Hajba, László Antal <laszlo-antal.hajba@t-systems.com>
Co-authored-by: OpenTelekomCloud Proposal Bot <proposalbot@otc-service.com>
Co-committed-by: OpenTelekomCloud Proposal Bot <proposalbot@otc-service.com>
This commit is contained in:
OpenTelekomCloud Proposal Bot
2025-12-16 13:04:05 +00:00
committed by zuul
parent f3fcc319b0
commit b6e0030d26
74 changed files with 1940 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

84
umn/source/central_network_operation_guide/permissions_management/central_network_custom_policies.rst Normal file
View File

@ -0,0 +1,84 @@
:original_name: cc_03_0992.html
.. _cc_03_0992:
Central Network Custom Policies
===============================
Custom policies can be created to supplement the system-defined policies.
You can create custom policies in either of the following ways:
- Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
- JSON: Create a JSON policy or edit an existing one.
For details, see `Creating a Custom Policy <https://docs.otc.t-systems.com/identity-access-management/umn/user_guide/permissions/creating_a_custom_policy.html>`__. The following section contains examples of common custom policies.
Example Custom Policies
-----------------------
- Example 1: Allowing users to delete central networks
.. code-block::
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cc:centralNetwork:delete"
]
}
]
}
- Example 2: Denying the deletion of central network policies
A policy with only "Deny" permissions must be used together with other policies. If the permissions granted to an IAM user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.
The following method can be used if you need to assign permissions of the **CC FullAccess** policy to a user but also forbid the user from deleting central network policies. Create a custom policy and assign both policies to the group that the user belongs to. Then the user can perform all operations on Cloud Connect resources except deleting central network policies. The following is an example of a deny policy:
.. code-block::
{
"Version": "1.1",
"Statement": [
{
"Effect": "Deny",
"Action": [
"cc:centralNetwork:deletePolicy"
]
}
]
}
- Example 3: Create a custom policy containing multiple actions.
A custom policy can contain the actions of multiple services that are of the global or project-level type. The following is an example policy containing actions of multiple services:
.. code-block::
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cc:centralNetwork:create",
"cc:centralNetwork:update",
"cc:centralNetwork:delete",
"cc:centralNetwork:get"
]
},
{
"Effect": "Allow",
"Action": [
"er:instances:create",
"er:instances:update",
"er:instances:delete",
"er:instances:get"
]
}
]
}

46
umn/source/central_network_operation_guide/permissions_management/creating_a_user_and_granting_central_network_permissions.rst Normal file
View File

@ -0,0 +1,46 @@
:original_name: cc_03_0991.html
.. _cc_03_0991:
Creating a User and Granting Central Network Permissions
========================================================
Use IAM to implement fine-grained permissions control for your Cloud Connect resources. With IAM, you can:
- Create IAM users for personnel based on your enterprise's organizational structure. Each IAM user has their own identity credentials for accessing Cloud Connect resources.
- Grant users only the permissions required to perform a given task based on their job responsibilities.
- Entrust an account or cloud service to perform efficient O&M on your Cloud Connect resources.
Skip this part if you do not require individual IAM users for refined permissions management.
:ref:`Figure 1 <cc_03_0991__en-us_topic_0285331217_en-us_topic_0173533526_en-us_topic_0173481716_en-us_topic_0172268189_fig12481104618719>` shows the process of granting permissions.
Prerequisites
-------------
Before you assign permissions to a user group, you need to know the permissions that you can assign to the user group and select permissions based on service requirements. For details about the system permissions, see :ref:`Permissions <cc_01_0008>`. For the system policies of other services, see `System Permissions <https://docs.otc.t-systems.com/permissions/index.html>`__.
Process Flow
------------
.. _cc_03_0991__en-us_topic_0285331217_en-us_topic_0173533526_en-us_topic_0173481716_en-us_topic_0172268189_fig12481104618719:
.. figure:: /_static/images/en-us_image_0000002090740630.png
:alt: **Figure 1** Process of granting permissions
**Figure 1** Process of granting permissions
#. .. _cc_03_0991__en-us_topic_0285331217_en-us_topic_0173533526_en-us_topic_0173481716_en-us_topic_0172268189_li10269636890:
`Create a user group and assign permissions <https://docs.otc.t-systems.com/usermanual/iam/iam_01_0030.html>`__ (the **Cross Connect Administrator** policy used as an example).
#. `Create an IAM user and add it to a group <https://docs.otc.t-systems.com/usermanual/iam/iam_01_0031.html>`__.
On the IAM console, create a user and add it to the user group created in :ref:`1 <cc_03_0991__en-us_topic_0285331217_en-us_topic_0173533526_en-us_topic_0173481716_en-us_topic_0172268189_li10269636890>`.
#. `Log in <https://docs.otc.t-systems.com/usermanual/iam/iam_01_0032.html>`__ and verify permissions.
After logging in to the Cloud Connect console using the user's credentials, verify that the user has all permissions for Cloud Connect resources.
- In the service list, choose **Network** > **Cloud Connect**. In the navigation pane on the left, choose **Cloud Connect** > **Central Networks**. Click **Create Central Network** in the upper right corner. If the creation is successful, the **Cross Connect Administrator** policy has taken effect.
- Choose any other service in the service list. A message will appear indicating that you have sufficient permissions to access the service.

16
umn/source/central_network_operation_guide/permissions_management/index.rst Normal file
View File

@ -0,0 +1,16 @@
:original_name: cc_03_0990.html
.. _cc_03_0990:
Permissions Management
======================
- :ref:`Creating a User and Granting Central Network Permissions <cc_03_0991>`
- :ref:`Central Network Custom Policies <cc_03_0992>`
.. toctree::
:maxdepth: 1
:hidden:
creating_a_user_and_granting_central_network_permissions
central_network_custom_policies