diff --git a/docs/deh/umn/deh_01_0005.html b/docs/deh/umn/deh_01_0005.html index 98454cccf..9483db251 100644 --- a/docs/deh/umn/deh_01_0005.html +++ b/docs/deh/umn/deh_01_0005.html @@ -8,7 +8,7 @@
Permissions
+Background
If you need to assign different permissions to employees in your enterprise to access your DeH resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you securely manage access to your cloud resources.
+With IAM, you can create IAM users under your account for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use DeH but should not be allowed to delete other DeH resources or perform any other high-risk operations. In this scenario, you can create IAM users for the software developers and grant them only the permissions required for using DeH resources.
+If your account does not need individual IAM users for permissions management, you may skip over this chapter.
+IAM is free. You pay only for resources purchased using your account. For more information about IAM, see Identity and Access Management User Guide.
+DeH Permissions
By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from their groups and can perform specified operations on cloud services.
+DeH is a project-level service deployed in specific physical regions. When you grant DeH permissions to a user group, set Scope to Region-specific projects and then select projects for the permissions to take effect. If you select All projects, the permissions will take effect for the user group in all region-specific projects. When accessing DeH, the users need to switch to a region where they have been authorized to use this service.
+You can grant users permissions by using roles and policies.
+- Roles: A type of coarse-grained authorization mechanism that defines permissions related to users responsibilities. Only a limited number of service-level roles for authorization are available. If one role has a dependency role required for accessing DeH, assign both roles to the users. Roles are not ideal for fine-grained authorization and secure access control.
- Policies: A fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, the account administrator can allow IAM users to perform specified management operations on a type of DeH resources.
Table 1 describes all system permissions of DeH.
+ +Role/Policy Name + |
+Description + |
+Category + |
+
|---|---|---|
DeH FullAccess + |
+DeH administrator, who has all permissions of DeH + |
+System-defined policy + |
+
DeH ReadOnlyAccess + |
+Read-only permission on DeHs. Users with this permission can only query DeHs. + |
+System-defined policy + |
+
Table 2 lists the common operations supported by each system-defined permission of DeH. Select the permissions as needed.
+ +Operation + |
+DeH FullAccess + |
+DeH CommonOperations + |
+DeH ReadOnlyAccess + |
+
|---|---|---|---|
DeHs + |
+√ + |
+x + |
+x + |
+
Releasing DeHs + |
+√ + |
+x + |
+x + |
+
Querying DeHs + |
+√ + |
+√ + |
+√ + |
+
Querying Details of a DeH + |
+√ + |
+√ + |
+√ + |
+
Modifying DeH Attributes + |
+√ + |
+√ + |
+x + |
+
Querying Available DeH Types + |
+√ + |
+√ + |
+√ + |
+
Querying DeH Resource Types + |
+√ + |
+√ + |
+√ + |
+
Querying DeH Resource Type Details + |
+√ + |
+√ + |
+√ + |
+
Querying Available DeH Types + |
+√ + |
+√ + |
+√ + |
+
Querying DeH Resource Types + |
+√ + |
+√ + |
+√ + |
+
Querying the AZ to Which a DeH Resource Type Is Bound + |
+√ + |
+√ + |
+√ + |
+
Querying the Flavor to Which a DeH Resource Type Is Bound + |
+√ + |
+√ + |
+√ + |
+
Querying the Tenant Quota + |
+√ + |
+√ + |
+√ + |
+
Creating a DeH Tag + |
+√ + |
+√ + |
+x + |
+
Deleting a DeH Tag + |
+√ + |
+√ + |
+x + |
+
Querying Tags of a DeH + |
+√ + |
+√ + |
+√ + |
+
Querying DeH Tags Created by a Tenant + |
+√ + |
+√ + |
+√ + |
+
Querying DeHs by Tag + |
+√ + |
+√ + |
+√ + |
+
Querying ECSs on a DeH + |
+√ + |
+√ + |
+√ + |
+
ECS flavors
+ECS flavors
Multiple ECS types are supported. For details, see the Elastic Cloud Server User Guide.
- Domain name, project name, and project ID, which can be obtained by performing the following operations:
Log in to the management console using the cloud account, click the username in the upper right corner, select My Credentials from the drop-down list, and obtain the domain name, project name, and project ID on the My Credentials page.
- Quota information, which includes:
- Service name
- Quota type
- Required quota
Learn how to obtain the service hotline and email address.
+Learn how to obtain the service hotline and email address.
Dedicated General-Purpose DeHs
+Overview
Dedicated general-purpose DeHs are classified as c3 DeHs. DeHs of c3 type can be used to deploy C3 ECSs. The C3 ECSs use the latest generation Intel Xeon Skylake CPUs and high-performance networks to improve comprehensive performance and stability, meeting the requirements of enterprise-level applications that have high requirements on service stability and computing performance.
+DeH Specifications
+Flavor Type + |
+Number of Sockets + |
+Number of Cores per Socket + |
+Hardware Specifications + |
+Number of vCPUs + |
+
|---|---|---|---|---|
c3 + |
+2 + |
+18 + |
+
|
+60 + |
+
c3 DeHs: Number of vCPUs = (Number of sockets x Number of cores x Number of single-core threads - CPU overheads) x CPU overcommitment ratio
+vCPUs = (2 x 18 x 2 - 12) x 1 = 60
+ECSs Allowed on c3 DeHs
+ECS Flavor + |
+vCPUs + |
+Memory (RAM in GB) + |
+
|---|---|---|
c3.large.2 + |
+2 + |
+4 + |
+
c3.xlarge.2 + |
+4 + |
+8 + |
+
c3.2xlarge.2 + |
+8 + |
+16 + |
+
c3.4xlarge.2 + |
+16 + |
+32 + |
+
c3.8xlarge.2 + |
+32 + |
+64 + |
+
c3.15xlarge.2 + |
+60 + |
+128 + |
+
c3.large.4 + |
+2 + |
+8 + |
+
c3.xlarge.4 + |
+4 + |
+16 + |
+
c3.2xlarge.4 + |
+8 + |
+32 + |
+
c3.4xlarge.4 + |
+16 + |
+64 + |
+
c3.8xlarge.4 + |
+32 + |
+128 + |
+
c3.15xlarge.4 + |
+60 + |
+256 + |
+
Permission Management
+ + + diff --git a/docs/deh/umn/deh_01_0051.html b/docs/deh/umn/deh_01_0051.html new file mode 100644 index 000000000..beed9a5ef --- /dev/null +++ b/docs/deh/umn/deh_01_0051.html @@ -0,0 +1,23 @@ + + +Creating a User and Granting Permissions
+This section describes how to use Identity and Access Management (IAM) to implement fine-grained permissions control for your DeH resources. With IAM, you can:
+- Create IAM users for employees based on your enterprise's organizational structure. Each IAM user will have their own security credentials for accessing DeH resources.
- Grant only the permissions required for users to perform a specific task.
- Use IAM to entrust a cloud account or cloud service to perform efficient O&M on your DeH resources.
If your cloud account does not require individual IAM users, skip over this section.
+This section describes the procedure for granting permissions (see Figure 1).
+Prerequisites
Learn about the permissions (see Permissions) supported by DeH and choose policies or roles according to your requirements. For the permissions of other services, see Permissions.
+Authorization Process
+
- Creating a User Group and Assigning Permissions
Create a user group on the IAM console, and assign the DeH ReadOnlyAccess permission to the group.
+ - Creating a User and Adding the User to a User Group
Create a user on the IAM console and add the user to the group created in 1.
+ - Log in and verify permissions.
Log in to the management console using the created user, and verify that the user only has read permissions for DeH.
+- Click Service List and choose Computing > Dedicated Host. On the displayed page, click Buy DeH in the upper right corner. If you cannot buy a DeH (after the DeH ReadOnlyAccess permission is assigned), the DeH ReadOnlyAccess permission has already taken effect.
- Choose any other service in the Service List. If a message appears indicating that you have insufficient permissions to access the service, the DeH ReadOnlyAccess policy has already taken effect.
Creating a Custom Policy
+Custom policies can be created to supplement the system-defined policies of DeH.
+You can create custom policies in either of the following ways:
+- Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
- JSON: Edit JSON policies from scratch or based on an existing policy.
For details, see section "Creating a Custom Policy" in Identity and Access Management User Guide. The following section contains examples of common DeH custom policies.
+Example Custom DeH Policies
- Example 1: Authorize users to purchase and release DeHs.
{ + "Version": "1.1", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "deh:dedicatedHosts:create", + "deh:dedicatedHosts:create" + ] + } + ] +}+ - Example 2: Deny the DeH release request.
A deny policy must be used together with other policies. If the permissions assigned to a user contain both "Allow" and "Deny", the "Deny" permission takes precedence over the "Allow" permission.
+If you assign the DeH FullAccess system policy to a user but do not want the user to have the permission to release DeHs, you can create a policy to deny the release of DeHs and grant both the DeH FullAccess policy and the created policy to the user. In this case, the "Deny" policy takes precedence and the user can perform all operations except DeH release. The following is an example of a deny policy:
+{ + "Version": "1.1", + "Statement": [ + { + "Action": [ + "deh:dedicatedHosts:delete" + ], + "Effect": "Deny" + } + ] +}+
High-Performance DeHs
+Overview
High-performance DeHs are classified as h1 DeHs. h1 DeHs provide high-performance hardware and stable system running environment for ECSs that occupy a large number of compute and memory resources and have high-throughput storage systems.
+High-performance ECSs can be deployed on h1 DeHs.
+DeH Specifications
+Flavor Type + |
+Number of Sockets + |
+Number of Cores per Socket + |
+Hardware Specifications + |
+Number of vCPUs + |
+
|---|---|---|---|---|
h1 + |
+2 + |
+12 + |
+
|
+36 + |
+
ECSs Allowed on h1 DeHs
+ECS Flavor + |
+vCPUs + |
+Memory (RAM in GB) + |
+
|---|---|---|
h1.large + |
+2 + |
+4 + |
+
h1.xlarge + |
+4 + |
+8 + |
+
h1.2xlarge + |
+8 + |
+16 + |
+
h1.4xlarge + |
+16 + |
+32 + |
+
h1.8xlarge + |
+32 + |
+64 + |
+
h1.large.4 + |
+2 + |
+8 + |
+
h1.xlarge.4 + |
+4 + |
+16 + |
+
h1.2xlarge.4 + |
+8 + |
+32 + |
+
h1.4xlarge.4 + |
+16 + |
+64 + |
+
h1.8xlarge.4 + |
+32 + |
+128 + |
+
h1.large.8 + |
+2 + |
+16 + |
+
h1.xlarge.8 + |
+4 + |
+32 + |
+
h1.2xlarge.8 + |
+8 + |
+64 + |
+
h1.4xlarge.8 + |
+16 + |
+128 + |
+
h1.8xlarge.8 + |
+32 + |
+256 + |
+
Disk-Intensive DeHs
+Overview
Disk-intensive DeHs are classified as d1 DeHs. d1 DeHs provide high-performance hardware and large-capacity hard disk drives (HDDs), so that ECSs created on such type of DeHs can efficiently and sequentially read and write ultra-large data sets stored on local storage.
+Disk-intensive ECSs can be deployed on d1 DeHs.
+ If a DeH is faulty, the data stored in local disks cannot be completely restored. Therefore, do not store important data in local disks.
+DeH Specifications
+Flavor Type + |
+Number of Sockets + |
+Number of Cores per Socket + |
+Hardware Specifications + |
+Number of vCPUs + |
+Total Capacity of Local Disks + |
+
|---|---|---|---|---|---|
d1 + |
+2 + |
+12 + |
+
|
+40 + |
+SAS disks: 24 x 1800 GB + |
+
ECSs Allowed on d1 DeHs
+ECS Flavor + |
+vCPUs + |
+Memory (RAM in GB) + |
+Number of Local Disks + |
+
|---|---|---|---|
d1.xlarge + |
+4 + |
+32 + |
+3 + |
+
d1.2xlarge + |
+8 + |
+64 + |
+6 + |
+
d1.4xlarge + |
+16 + |
+128 + |
+12 + |
+
d1.8xlarge + |
+36 + |
+256 + |
+24 + |
+
Categories and Types
@@ -10,13 +10,13 @@+
+
+
Managing Enterprise Projects
+An enterprise project is a way of managing cloud resources where cloud resources and members are centrally managed by project.
+DeH supports enterprise project management. You can grant different personnel different permissions to manage different DeHs.
+Creating an Enterprise Project and Assigning Permissions
Before using enterprise project to manage DeHs, you need to create an enterprise project and complete authorization by referring to Figure 1.
+ +
Using Enterprise Project to Manage DeHs
- Select an enterprise project when purchasing a DeH. For details, see Allocating DeHs.
- On the Enterprise Project Management page, you can add existing DeHs to an enterprise project.
What Should I Do If I Fail to Create an ECS on a DeH?
-The following may cause the failure in creating an ECS on a DeH:
-- The ECS flavor you selected is not supported by your DeH.
For the ECS flavors supported by each DeH type, see Overview.
- - Your DeH resources are insufficient, resulting in failure in creating an ECS with the specifications you selected.
You can check whether the remaining vCPU resources and memory size of your DeH are sufficient for creating an ECS with the specifications you selected. If the resources are insufficient, you need to apply for more DeH resources or delete some ECSs from your DeH.
-
- What Are the Differences Between ECSs on DeHs and ECSs on Shared Hosts?
- - What Should I Do If I Fail to Create an ECS on a DeH?
- - Can I Migrate ECSs in Resource Pools to DeHs?
Can I Attach an EVS Disk to a DeH?
-No. But you can attack EVS disks to the ECSs on a DeH.
+No. But you can attach EVS disks to the ECSs on a DeH.
High-Performance DeHs
-Overview
High-performance DeHs are classified as h1 DeHs. h1 DeHs provide high-performance hardware and stable system running environment for ECSs that occupy a large number of compute and memory resources and have high-throughput storage systems.
-High-performance ECSs can be deployed on h1 DeHs.
-DeH Specifications
-Flavor Type - |
-Number of Sockets - |
-Number of Cores per Socket - |
-Hardware Specifications - |
-Number of vCPUs - |
-
|---|---|---|---|---|
h1 - |
-2 - |
-12 - |
-
|
-36 - |
-
ECSs Allowed on h1 DeHs
-ECS Flavor - |
-vCPUs - |
-Memory (RAM in GB) - |
-
|---|---|---|
h1.large - |
-2 - |
-4 - |
-
h1.xlarge - |
-4 - |
-8 - |
-
h1.2xlarge - |
-8 - |
-16 - |
-
h1.4xlarge - |
-16 - |
-32 - |
-
h1.8xlarge - |
-32 - |
-64 - |
-
h1.large.4 - |
-2 - |
-8 - |
-
h1.xlarge.4 - |
-4 - |
-16 - |
-
h1.2xlarge.4 - |
-8 - |
-32 - |
-
h1.4xlarge.4 - |
-16 - |
-64 - |
-
h1.8xlarge.4 - |
-32 - |
-128 - |
-
h1.large.8 - |
-2 - |
-16 - |
-
h1.xlarge.8 - |
-4 - |
-32 - |
-
h1.2xlarge.8 - |
-8 - |
-64 - |
-
h1.4xlarge.8 - |
-16 - |
-128 - |
-
h1.8xlarge.8 - |
-32 - |
-256 - |
-
Disk-Intensive DeHs
-Overview
Disk-intensive DeHs are classified as d1 DeHs. d1 DeHs provide high-performance hardware and large-capacity hard disk drives (HDDs), so that ECSs created on such type of DeHs can efficiently and sequentially read and write ultra-large data sets stored on local storage.
-Disk-intensive ECSs can be deployed on d1 DeHs.
- If a DeH is faulty, the data stored in local disks cannot be completely restored. Therefore, do not store important data in local disks.
-DeH Specifications
-Flavor Type - |
-Number of Sockets - |
-Number of Cores per Socket - |
-Hardware Specifications - |
-Number of vCPUs - |
-Total Capacity of Local Disks - |
-
|---|---|---|---|---|---|
d1 - |
-2 - |
-12 - |
-
|
-40 - |
-SAS disks: 24 x 1800 GB - |
-
ECSs Allowed on d1 DeHs
-ECS Flavor - |
-vCPUs - |
-Memory (RAM in GB) - |
-Number of Local Disks - |
-
|---|---|---|---|
d1.xlarge - |
-4 - |
-32 - |
-3 - |
-
d1.2xlarge - |
-8 - |
-64 - |
-6 - |
-
d1.4xlarge - |
-16 - |
-128 - |
-12 - |
-
d1.8xlarge - |
-36 - |
-256 - |
-24 - |
-
2022-10-26
+2023-03-23
+This issue is the twenty-first official release.
+Added:
+ +2022-10-26
This issue is the twentieth official release.
Added the following content:
@@ -75,9 +82,9 @@This issue is the twelfth official release.
Added the following content:
-Dedicated General-Purpose DeHs
+Dedicated General-Purpose DeHs
Modified the following content:
-Modified the memory sizes of DeHs in General-Purpose DeHs, Dedicated General-Purpose DeHs, and Memory-Optimized DeHs.
+Modified the memory sizes of DeHs in General-Purpose DeHs, Dedicated General-Purpose DeHs, and Memory-Optimized DeHs.
2018-05-30
@@ -129,7 +136,7 @@This issue is the fifth official release.
Modified the following content:
-- Added six ECS flavors supported by high-performance DeHs in High-Performance DeHs.
- Added a restriction, that is, Automatic recovery of ECSs created on DeHs is not supported in Constraints.
- Added six ECS flavors supported by high-performance DeHs in High-Performance DeHs.
- Added a restriction, that is, Automatic recovery of ECSs created on DeHs is not supported in Constraints.
2017-07-30
diff --git a/docs/deh/umn/en-us_topic_0105897861.html b/docs/deh/umn/en-us_topic_0105897861.html index 3e4987464..62c85e154 100644 --- a/docs/deh/umn/en-us_topic_0105897861.html +++ b/docs/deh/umn/en-us_topic_0105897861.html @@ -192,7 +192,7 @@Dedicated General-Purpose DeHs
-Overview
Dedicated general-purpose DeHs are classified as c3 DeHs. DeHs of c3 type can be used to deploy C3 ECSs. The C3 ECSs use the latest generation Intel Xeon Skylake CPUs and high-performance networks to improve comprehensive performance and stability, meeting the requirements of enterprise-level applications that have high requirements on service stability and computing performance.
-DeH Specifications
-Flavor Type - |
-Number of Sockets - |
-Number of Cores per Socket - |
-Hardware Specifications - |
-Number of vCPUs - |
-
|---|---|---|---|---|
c3 - |
-2 - |
-18 - |
-
|
-60 - |
-
c3 DeHs: Number of vCPUs = (Number of sockets x Number of cores x Number of single-core threads - CPU overheads) x CPU overcommitment ratio
-vCPUs = (2 x 18 x 2 - 12) x 1 = 60
-ECSs Allowed on c3 DeHs
-ECS Flavor - |
-vCPUs - |
-Memory (RAM in GB) - |
-
|---|---|---|
c3.large.2 - |
-2 - |
-4 - |
-
c3.xlarge.2 - |
-4 - |
-8 - |
-
c3.2xlarge.2 - |
-8 - |
-16 - |
-
c3.4xlarge.2 - |
-16 - |
-32 - |
-
c3.8xlarge.2 - |
-32 - |
-64 - |
-
c3.15xlarge.2 - |
-60 - |
-128 - |
-
c3.large.4 - |
-2 - |
-8 - |
-
c3.xlarge.4 - |
-4 - |
-16 - |
-
c3.2xlarge.4 - |
-8 - |
-32 - |
-
c3.4xlarge.4 - |
-16 - |
-64 - |
-
c3.8xlarge.4 - |
-32 - |
-128 - |
-
c3.15xlarge.4 - |
-60 - |
-256 - |
-