Creating a User and Granting Permissions
System-defined permissions in role/policy-based authorization provided by Identity and Access Management (IAM) let you control access to your SWR resources. With IAM, you can:
- Create IAM users or user groups for personnel based on your enterprise's organizational structure. Each IAM user has their own identity credentials for accessing SWR resources.
- Grant users only the permissions required to perform a given task based on their job responsibilities.
- Entrust other Huawei Cloud account or cloud service to perform efficient O&M on your SWR resources.
If your Huawei Cloud account does not require individual IAM users for permissions management, you can skip this section.
This section describes the procedure for granting user permissions.
Prerequisites
Before granting permissions to user groups, learn about system-defined permissions for SWR. For details, see Permissions. To grant permissions for other services, learn about all system-defined permissions.
Process Flow
- Create a user group and assign permissions to it.
Create a user group on the IAM console, and grant the SWR Admin permissions to the group.
- Create an IAM user and add it to the user group.
Create a user on the IAM console and add the user to the group created in 1.
- Log in and verify permissions.
Log in to the management console using the IAM user. Switch to the authorized region. If the following operations can be performed, the permissions are assigned successfully:
- Choose Service List > SoftWare Repository for Container. The SWR console is displayed.
- In the navigation pane, choose Organizations. Click Create Organization in the upper right corner. Enter an organization name to create an organization.
- In the navigation pane, choose My Images. Click Upload Through SWR in the upper right corner. Select the new organization. Upload a local image file to SWR.
System-defined Roles
Roles are a type of coarse-grained authorization mechanism that defines service-level permissions based on user responsibilities. Only a limited number of service-level roles are available for authorization. Roles are not ideal for fine-grained authorization and least privilege access.
The system-defined role preset for SWR in IAM is SWR Admin, which has all permissions for SWR.
System-defined Policies
System-defined policies preset for SWR in IAM include SWR FullAccess, SWR OperateAccess, and SWR ReadOnlyAccess.
- SWR FullAccess: all permissions for SWR
- SWR OperateAccess: operation permissions for SWR
- SWR ReadOnlyAccess: read-only permissions for SWR
|
Action |
Specific Action |
Description |
|---|---|---|
|
"swr:*:*" |
"vpc:*:get*" |
Permission to view details about all VPC resources |
|
"vpc:*:list*" |
Permission to list all VPC resources |
|
|
"scm:*:list*" |
Permission to list all SSL Certificate Manager (SCM) resources |
|
|
"scm:cert:download" |
Permission to download SSL certificates from SCM |
|
|
"kms:*:get*" |
Permission to view details about all KMS resources |
|
|
"kms:*:list*" |
Permission to list all KMS resources |
|
|
"hss:image:*" |
All permissions for container images in Host Security Service (HSS) |
|
|
"cce:cluster:list*" |
Permission to list all CCE resources |
|
|
"cci:namespace:list*" |
Permission to list all CCI namespace resources |
|
|
"cci:deployment:list*" |
Permission to list all CCI Deployment resources |
|
|
"cci:namespaceSubResource:list*" |
Permission to list all CCI Kubernetes resources |
|
|
"cci:deployment:get" |
Permission to view details about all CCI Deployment resources |
|
|
"cci:namespaceSubResource:get" |
Permission to view details about all CCI Kubernetes resources |
|
Action |
Specific Action |
Description |
|---|---|---|
|
"swr:*:*" |
"swr:*:get*" |
Permission to view details about all SWR resources |
|
"swr:*:list*" |
Permission to list all SWR resources |
|
|
"swr:*:download*" |
Permission to download images from SWR |
|
|
"swr:instance:createTempCredential" |
Permission to generate temporary login credentials for a repository of SWR Enterprise Edition |
|
|
"swr:system:createLoginSecret" |
Permission to generate temporary login credentials for shared repositories in SWR |
|
|
"vpc:*:get*" |
Permission to view details about all VPC resources |
|
|
"vpc:*:list*" |
Permission to list all VPC resources |
|
|
"scm:*:list*" |
Permission to list all SCM resources |
|
|
"kms:*:get*" |
Permission to view details about all KMS resources |
|
|
"kms:*:list*" |
Permission to list all KMS resources |
|
|
"hss:image:list*" |
Permission to list container images in HSS |
|
|
"hss:image:vulnerabilities" |
Permission to list container image vulnerabilities in HSS |
|
|
"cce:cluster:list*" |
Permission to list all CCE resources |
|
|
"cci:namespace:list*" |
Permission to list all CCI namespace resources |
|
|
"cci:deployment:list*" |
Permission to list all CCI Deployment resources. |
|
|
"cci:namespaceSubResource:list*" |
Permission to list all CCI Kubernetes resources |
|
|
"cci:deployment:get" |
Permission to view details about all CCI Deployment resources |
|
|
"cci:namespaceSubResource:get" |
Permission to view details about all CCI Kubernetes resources |
|
Action |
Specific Action |
Description |
|---|---|---|
|
"swr:*:*" |
"swr:repository:*" |
All permissions for managing repositories of SWR Enterprise Edition |
|
"swr:instance:get*" |
Permission to view details about repositories of SWR Enterprise Edition |
|
|
"swr:instance:list*" |
Permission to list repositories of SWR Enterprise Edition |
|
|
"swr:instance:execute*" |
Permission to execute asynchronous tasks of repositories of SWR Enterprise Edition |
|
|
"swr:instance:createTempCredential" |
Permission to generate temporary login credentials for a repository of SWR Enterprise Edition |
|
|
"swr:system:createLoginSecret" |
Permission to generate temporary login credentials for shared repositories in SWR |
|
|
"swr:repo:*" |
All permissions for repositories of SWR Basic Edition |
|
|
"swr:namespace:get*" |
Permission to view all namespace resources of SWR Basic Edition |
|
|
"swr:namespace:list*" |
Permission to list namespace resources of SWR Basic Edition |
|
|
"swr:system:listQuotas" |
Permission to view the quota information of SWR Basic Edition |
|
|
"swr:system:getDomainOverview" |
Permission to view the brief resource information of SWR Basic Edition |
|
|
"swr:system:getDomainResourceReports" |
Permission to obtain tenant resource statistics of repositories of SWR Basic Edition |
|
|
"vpc:*:get*" |
Permission to view details about all VPC resources |
|
|
"vpc:*:list*" |
Permission to list all VPC resources |
|
|
"scm:*:list*" |
Permission to list all SCM resources |
|
|
"kms:*:get*" |
Permission to view details about all KMS resources |
|
|
"kms:*:list*" |
Permission to list all KMS resources |
|
|
"hss:image:*" |
All permissions for container images in HSS |
|
|
"cce:cluster:list*" |
Permission to list all CCE resources |
Custom Policies
Custom policies can be created as a supplement to the system-defined policies of SWR. For the actions that can be added to custom policies, see Permissions Policies and Supported Actions.
You can create custom policies in either of the following ways:
- Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
- JSON: Create a JSON policy or edit an existing one.
For details, see Creating a Custom Policy.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
