If you need to assign different permissions to employees in your enterprise to control their access to your CBR resources on the cloud, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your cloud resources.
+With IAM, you can use your cloud account to create IAM users for your employees, and assign permissions to them to control their access to specific resource types. For example, you can create IAM users for software developers and grant them only the permissions required for using CBR resources to allow them to use CBR resources but prevent them from performing any other operations.
+If your cloud account does not require individual IAM users for permissions management, skip this section.
+IAM is free of charge. For more information about IAM, see IAM Service Overview.
+By default, new IAM users do not have permissions assigned. You need to add an IAM user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.
+CBR is a project-level service deployed and accessed in specific physical regions. To assign CBR permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing CBR, the users need to switch to a region where they have been authorized to use this service.
+You can grant users permissions by using roles and policies.
+Policy Name + |
+Description + |
+Type + |
+
|---|---|---|
CBR FullAccess + |
+Administrator permissions for CBR. Users granted these permissions can operate and use all vaults, backups, and policies. + |
+System-defined policy + |
+
CBR BackupsAndVaultsFullAccess + |
+Common user permissions for CBR. Users granted these permissions can create, view, and delete vaults and backups, but cannot create, update, or delete policies. + |
+System-defined policy + |
+
CBR ReadOnlyAccess + |
+Read-only permissions for CBR. Users granted these permissions can only view CBR data. + |
+System-defined policy + |
+
Table 2 lists the common operations supported by each system-defined policy or role of CBR. Select the policies or roles as required.
+ +Operation + |
+CBR FullAccess + |
+CBR BackupsAndVaultsFullAccess + |
+CBR ReadOnlyAccess + |
+
|---|---|---|---|
Querying vaults + |
+√ + |
+√ + |
+√ + |
+
Creating vaults + |
+√ + |
+√ + |
++ |
Listing vaults + |
+√ + |
+√ + |
+√ + |
+
Updating vaults + |
+√ + |
+√ + |
++ |
Deleting vaults + |
+√ + |
+√ + |
++ |
Associating resources + |
+√ + |
+√ + |
++ |
Dissociating resources + |
+√ + |
+√ + |
++ |
Creating policies + |
+√ + |
++ | + |
Updating policies + |
+√ + |
++ | + |
Applying policies to a vault + |
+√ + |
+√ + |
++ |
Removing policies from a vault + |
+√ + |
+√ + |
++ |
Deleting policies + |
+√ + |
++ | + |
Performing backups + |
+√ + |
+√ + |
++ |
Updating subscriptions + |
+√ + |
+√ + |
++ |
Querying the Agent status + |
+√ + |
+√ + |
++ |
Deleting backups + |
+√ + |
+√ + |
++ |
Restoring data using backups + |
+√ + |
+√ + |
++ |
Associating vaults + |
+√ + |
+√ + |
++ |
Batch adding or deleting vault tags + |
+√ + |
+√ + |
++ |
Adding vault tags + |
+√ + |
+√ + |
++ |
Editing tags + |
+√ + |
+√ + |
++ |
Servers are shut down during restoration. It is therefore recommended that you perform restoration operations during off-peak hours.
If the number of disks to be restored is greater than the number of disks that are backed up, restoration may cause data inconsistency.
For example, if the data of Oracle is scattered across multiple disks and only some of them are restored, data inconsistency occurs after the restoration and the application may unable to start.
diff --git a/docs/cbr/umn/cbr_03_0046.html b/docs/cbr/umn/cbr_03_0046.html index 2479e848d..ea79b7b69 100644 --- a/docs/cbr/umn/cbr_03_0046.html +++ b/docs/cbr/umn/cbr_03_0046.html @@ -8,9 +8,15 @@ -2022-11-16
+2022-12-02
This issue incorporates the following change:
+This issue incorporates the following changes:
+2022-11-16
+This issue incorporates the following changes:
Added the description of disk-level backup in section "Creating a Server Backup Vault."
This section describes how to use IAM to implement fine-grained permissions control for your CBR resources. With IAM, you can:
+If your cloud account does not require individual IAM users, skip this section. If your account cannot meet your requirements, create IAM users by referring to Identity and Access Management User Guide.
+This section describes the procedure for granting permissions (see Figure 1).
+You have learnt about the permissions (see Permissions Management) supported by CBR and chosen the policies or roles according to your requirements. For the system policies of other services, see "System Permissions".
+Create a user group on the IAM console, and assign the CBR ReadOnlyAccess policy to the group.
+Create a user on the IAM console and add the user to the group created in 1.
+Log in to CBR Console using the created user, and verify that the user has read-only permissions for CBR.
+Custom policies can be created to supplement the system-defined policies of CBR. For the actions supported for custom policies, see section "Permissions Policies and Supported Actions" in Cloud Backup and Recovery API Reference.
+You can create custom policies in either of the following ways:
+This section provides examples of common user-defined CBR policies.
+
{
+ "Version": "1.1",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "cbr:*:get*",
+ "cbr:*:list*",
+ "cbr:vaults:update",
+ "cbr:vaults:delete",
+ "cbr:vaults:create"
+ ]
+ }
+ ]
+}
+A policy with only "Deny" permissions must be used in conjunction with other policies to take effect. If the permissions assigned to a user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.
+The following method can be used if you need to assign permissions of the CBR FullAccess policy to a user but you want to prevent the user from deleting vaults and backups. Create a custom policy for denying vault and backup deletion, and attach both policies to the group to which the user belongs. Then, the user can perform all operations on CBR except deleting vaults or backups. The following is an example of a deny policy:
+{
+ "Version": "1.1",
+ "Statement": [
+ {
+ "Effect": "Deny",
+ "Action": [
+ "cbr:backups:delete",
+ "cbr:vaults:delete"
+ ]
+ }
+ ]
+}
+A custom policy can contain the actions of multiple services that are of the global or project-level type. The following is an example policy containing actions of multiple services:
+{
+ "Version": "1.1",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "cbr:vaults:create",
+ "cbr:vaults:update",
+ "cbr:vaults:delete"
+ ]
+ },
+ {
+ "Effect": "Allow",
+ "Action": [
+ "sfs:shares:createShare"
+ ]
+ }
+ ]
+}
+