forked from docs/doc-exports
zhengxiu
93d856d5c5
Reviewed-by: Pruthi, Vineet <vineet.pruthi@t-systems.com> Co-authored-by: zhengxiu <zhengxiu@huawei.com> Co-committed-by: zhengxiu <zhengxiu@huawei.com>
96 lines
11 KiB
HTML
96 lines
11 KiB
HTML
<a name="EN-US_TOPIC_0000001938218460"></a><a name="EN-US_TOPIC_0000001938218460"></a>
|
|
|
|
<h1 class="topictitle1">Creating IAM Users and Granting Them Permissions to Use CSS</h1>
|
|
<div id="body1558407759825"><p id="EN-US_TOPIC_0000001938218460__p198079372297">You can use <a href="https://docs.otc.t-systems.com/usermanual/iam/iam_01_0026.html" target="_blank" rel="noopener noreferrer">Identity and Access Management (IAM)</a> for fine-grained permissions control for CSS. With IAM, you can:</p>
|
|
<ul id="EN-US_TOPIC_0000001938218460__ul1848820457453"><li id="EN-US_TOPIC_0000001938218460__li348974516454">Create IAM users for employees based on your enterprise's organizational structure. Each IAM user has their own identity credentials for accessing CSS resources.</li><li id="EN-US_TOPIC_0000001938218460__li11681126173515">Grant users only the permissions required to perform a given task based on their job responsibilities.</li><li id="EN-US_TOPIC_0000001938218460__li12185165313915">Entrust an account or a cloud service to perform efficient O&M on your CSS resources.</li></ul>
|
|
<p id="EN-US_TOPIC_0000001938218460__p14662743155318">If your account does not require individual IAM users, you may skip this section.</p>
|
|
<p id="EN-US_TOPIC_0000001938218460__p158501603165">This section describes the procedure for granting permissions.</p>
|
|
<div class="section" id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223594424_section17110143884619"><h4 class="sectiontitle">Prerequisites</h4><p id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223594424_p148607912478">You know what permissions to assign to which users. CSS supports administrator permissions and read-only permissions. For details, see Permissions Management.</p>
|
|
</div>
|
|
<div class="section" id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223594424_section85262192392"><h4 class="sectiontitle">Process Flow</h4><div class="fignone" id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223594424_fig342064620244"><span class="figcap"><b>Figure 1 </b>Process of granting CSS permissions</span><br><span><img id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223594424_image237123492418" src="figure/en-us_image_0000001938218776.png"></span></div>
|
|
<ol id="EN-US_TOPIC_0000001938218460__ol20958137181713"><li id="EN-US_TOPIC_0000001938218460__li109582711173"><a name="EN-US_TOPIC_0000001938218460__li109582711173"></a><a name="li109582711173"></a><a href="https://docs.otc.t-systems.com/usermanual/iam/iam_01_0030.html" target="_blank" rel="noopener noreferrer">Create a user group and assign permissions</a>.<p id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223594424_p10577919163914">Create a user group on the IAM console, and assign the <strong id="EN-US_TOPIC_0000001938218460__b1383745710419">CSS ReadOnlyAccess</strong> permission to the group.</p>
|
|
</li><li id="EN-US_TOPIC_0000001938218460__li29581574177"><a href="https://docs.otc.t-systems.com/usermanual/iam/iam_01_0031.html" target="_blank" rel="noopener noreferrer">Create an IAM user and add it to a user group</a>.<p id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223594424_p357781916392">Create a user on the IAM console and add it to the user group created in <a href="#EN-US_TOPIC_0000001938218460__li109582711173">1</a>.</p>
|
|
<p id="EN-US_TOPIC_0000001938218460__p16681531173416">By adding a user to a user group, you assign all the permissions that this user group has to that user. All users in a group have the same permissions.</p>
|
|
</li><li id="EN-US_TOPIC_0000001938218460__li695812781716"><a href="https://docs.otc.t-systems.com/usermanual/iam/iam_01_0032.html" target="_blank" rel="noopener noreferrer">Log in</a> and verify permissions.<p id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223594424_p20577191943913">Log in to the console as the created user, switch to the authorized region, and verify the permissions.</p>
|
|
<ul id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001489537442_ul1692751312242"><li id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001489537442_li205729227246">Choose <strong id="EN-US_TOPIC_0000001938218460__b387918591516">Service List</strong> > <strong id="EN-US_TOPIC_0000001938218460__b68791551513">Cloud Search Service</strong>. Then click <strong id="EN-US_TOPIC_0000001938218460__b1687914511151">Create Cluster</strong> on the CSS console. If the cluster cannot be purchased (assuming that the current permissions include only <strong id="EN-US_TOPIC_0000001938218460__b98791558151">CSS ReadOnlyAccess</strong>), the <strong id="EN-US_TOPIC_0000001938218460__b10879185131517">CSS ReadOnlyAccess</strong> policy has already taken effect.</li><li id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001489537442_li1857212212418">Choose any other service from <strong id="EN-US_TOPIC_0000001938218460__b1943182197">Service List</strong>. (Assume that the current policy contains only <strong id="EN-US_TOPIC_0000001938218460__b159443212920">CSS ReadOnlyAccess</strong>.) If a message appears indicating insufficient permissions to access the service, the <strong id="EN-US_TOPIC_0000001938218460__b6944162995">CSS ReadOnlyAccess</strong> policy has already taken effect.</li></ul>
|
|
</li></ol>
|
|
</div>
|
|
<div class="section" id="EN-US_TOPIC_0000001938218460__section841205645419"><h4 class="sectiontitle">Examples of CSS Custom Policies</h4><p id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_p8060118">Custom policies can be created to supplement the system-defined policies of CSS. For the actions supported for custom policies, see section "Permissions Policies and Supported Actions" in the <em id="EN-US_TOPIC_0000001938218460__i16213849133418">Cloud Search Service API Reference</em>.</p>
|
|
<p id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_p18119246101411">You can create custom policies in either of the following ways:</p>
|
|
<ul id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_ul611914619143"><li id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_li51194467143">Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.</li><li id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_li1012004631418">JSON: Create a JSON policy or edit an existing one.</li></ul>
|
|
<p id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_p1761612181719">For details about how to create custom policies, see <a href="https://docs.otc.t-systems.com/identity-access-management/umn/user_guide/permissions/creating_a_custom_policy.html" target="_blank" rel="noopener noreferrer">Creating a Custom Policy</a>. The following provides examples of custom CSS policies.</p>
|
|
<div class="note" id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_note185014141059"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_p05121415516">the IAM permissions and data plane cluster permissions of CSS are managed separately. To enhance data-plane security, you need to use the security mode.</p>
|
|
<p id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_p1133419718221">To let an IAM user access an OBS bucket, you need to grant the <strong id="EN-US_TOPIC_0000001938218460__b529410230351">GetBucketStoragePolicy</strong>, <strong id="EN-US_TOPIC_0000001938218460__b18294142343518">GetBucketLocation</strong>, <strong id="EN-US_TOPIC_0000001938218460__b72941723123510">ListBucket</strong>, and <strong id="EN-US_TOPIC_0000001938218460__b129542303514">ListAllMyBuckets</strong> permissions to the user.</p>
|
|
</div></div>
|
|
<ul id="EN-US_TOPIC_0000001938218460__ul441171719011"><li id="EN-US_TOPIC_0000001938218460__li10411017405">Example 1: Allowing users to create CSS clusters<pre class="screen" id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_screen152401381336">{
|
|
"Version": "1.1",
|
|
"Statement": [
|
|
{
|
|
"Action": [
|
|
"css:cluster:create",
|
|
"vpc:securityGroups:get",
|
|
"vpc:securityGroups:create",
|
|
"vpc:securityGroups:delete",
|
|
"vpc:securityGroupRules:get",
|
|
"vpc:securityGroupRules:create",
|
|
"vpc:securityGroupRules:delete",
|
|
"vpc:vpcs:list",
|
|
"vpc:privateIps:list",
|
|
"vpc:ports:get",
|
|
"vpc:ports:create",
|
|
"vpc:ports:update",
|
|
"vpc:ports:delete",
|
|
"vpc:quotas:list",
|
|
"vpc:subnets:get",
|
|
"ecs:cloudServerFlavors:get",
|
|
"ecs:serverInterfaces:use",
|
|
"ecs:cloudServers:addNics",
|
|
"ecs:quotas:get",
|
|
"evs:types:get",
|
|
"evs:quotas:get"
|
|
],
|
|
"Effect": "Allow"
|
|
}
|
|
]
|
|
}</pre>
|
|
</li><li id="EN-US_TOPIC_0000001938218460__li1565118196013">Example 2: Denying cluster deletion<p id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_p330217517918"><a name="EN-US_TOPIC_0000001938218460__li1565118196013"></a><a name="li1565118196013"></a>A policy with only <strong id="EN-US_TOPIC_0000001938218460__b126831140653219">Deny</strong> permissions must be used in conjunction with other policies for it to take effect. If the permissions assigned to a user contain both <strong id="EN-US_TOPIC_0000001938218460__b60815964053219">Allow</strong> and <strong id="EN-US_TOPIC_0000001938218460__b60718635253219">Deny</strong>, the <strong id="EN-US_TOPIC_0000001938218460__b198200705253219">Deny</strong> permissions take precedence over the <strong id="EN-US_TOPIC_0000001938218460__b133336928253219">Allow</strong> permissions.</p>
|
|
<p id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_p153024511596">The following method can be used if you need to assign permissions of the <strong id="EN-US_TOPIC_0000001938218460__b247647353219">CSS Admin</strong> policy to a user but you want to prevent the user from deleting clusters. Create a custom policy for denying cluster deletion, and attach both policies to the group to which the user belongs. Then, the user can perform all operations on CSS except deleting clusters. The following is an example of a deny policy:</p>
|
|
<pre class="screen" id="EN-US_TOPIC_0000001938218460__en-us_topic_0000001223754348_screen16334701457">{
|
|
"Version": "1.1",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Deny",
|
|
"Action": [
|
|
"css:cluster:delete"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
</pre>
|
|
</li><li id="EN-US_TOPIC_0000001938218460__li15457145317114">Example 3: Defining permissions for multiple services in a policy<p id="EN-US_TOPIC_0000001938218460__p64652053519"><a name="EN-US_TOPIC_0000001938218460__li15457145317114"></a><a name="li15457145317114"></a>A custom policy can contain the actions of multiple services that are of the global or project-level type. Example of a policy containing multiple actions:</p>
|
|
<pre class="screen" id="EN-US_TOPIC_0000001938218460__screen846510539118">{
|
|
"Version": "1.1",
|
|
"Statement": [
|
|
{
|
|
"Action": [
|
|
"ecs:cloudServers:resize",
|
|
"ecs:cloudServers:delete",
|
|
"ecs:cloudServers:delete",
|
|
"css:cluster:restart",
|
|
"css:*:get*",
|
|
"css:*:list*"
|
|
],
|
|
"Effect": "Allow"
|
|
}
|
|
]
|
|
}</pre>
|
|
</li></ul>
|
|
</div>
|
|
</div>
|
|
<div>
|
|
<div class="familylinks">
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="css_01_0072.html">CSS Permissions Management</a></div>
|
|
</div>
|
|
</div>
|
|
|