Overview
You can use Cloud Access Management (CAM) policies to allow users to view and use specific resources in the CVM console. This document provides examples of permissions for checking and using specific resources, and policies that guide users on how to use specific parts of the console.
Operation Example
Full Read-Write Policy of CVM
If you want to allow a user to have the permission to create and manage CVM instances, you can use the policy named CVMFullAccess for the user. This policy is achieved by allowing users to have operation permissions on all resources in CVM, VPC, CLB and MONITOR.
Read-Only Policy of CVM
If you want to allow a user to have the permission to query CVM instances only but not the permission to create, delete, or power on/off instances, you can use the policy named CVMInnerReadOnlyAccess for the user. This policy is achieved by allowing users to have the following permissions for all operations that start with the word Describe and all operations that start with the word Inquiry in CVM.
Read-Only Policy for CVM-Related Resources
If you want to allow a user to have the permission to query CVM instances and related resources (VPC, CLB) only, but not the permission to create, delete, power on/off instances, you can use the policy named CVMReadOnlyAccess for the user. This policy is achieved by allowing users to have operation permissions for the following operations:
- All operations in CVM that start with the word Describe and all operations that start with the word Inquiry.
- All operations in VPC that start with the word Describe, all operations that start with the word Inquiry, and all operations that start with the word Get.
- All operations in the CLB that startthat start with the word Describe.
- All operations in Monitor that start with the word Describe and all operations that start with the word Get.
- APIs ListUsersForGroup, ListGroups, and all operations that start with the word GetGroup in CAM.
Policies Related to Elastic Cloud Storage
If you want the user to be able to view the Cloud Block Storage information in the CVM console and have permissions to create and use Cloud Block Storage, you can first add the following operations to your policy and then associate the policy with the user.
- CreateCbsStorages: Create Cloud Block Storage.
- AttachCbsStorages: Mount the specified elastic cloud storage to the specified Cloud Virtual Machine.
- DetachCbsStorages: Unmount the specified elastic cloud storage.
- ModifyCbsStorageAttributes: Modify the name or project ID of the specified Cloud Block Storage.
- DescribeCbsStorages: Query the detailed information of the Cloud Block Storage.
- DescribeInstancesCbsNum: Query the number of elastic cloud storage mounted on the Cloud Virtual Machine and the total number of elastic cloud storage that can be mounted.
- RenewCbsStorage: Renew the specified elastic cloud storage.
- ResizeCbsStorage: Scale out the specified elastic cloud storage.
The directions are as follows:
- According to Policy, create a custom policy that can view Cloud Block Storage information in the CVM console and has other permissions such as creating Cloud Block Storage and using Cloud Block Storage.
The policy content can be set by referring to the following policy syntax:
{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"name/cvm:CreateCbsStorages",
"name/cvm:AttachCbsStorages",
"name/cvm:DetachCbsStorages",
"name/cvm:ModifyCbsStorageAttributes",
"name/cvm:DescribeCbsStorages"
],
"resource": [
"qcs::cvm::uin/1410643447:*"
]
}
]
}
- Find the created policy, and in the Operation column of the policy row, click Associate User/Group/Role.
- In the pop-up Associate User/User Group/Role window, select the user/user group you want to authorize and click OK.
Policies Related to Security Group
If you want the user to be able to view and use the security groups in the CVM console, you can add the following operations to your policy and then associate the policy with the user.
- DeleteSecurityGroup: Delete the security group.
- ModifySecurityGroupPolicys: Replace all policies of the security group.
- ModifySingleSecurityGroupPolicy: Modify a single policy of the security group.
- CreateSecurityGroupPolicy: Create the security group policy.
- DeleteSecurityGroupPolicy: Delete the security group policy.
- ModifySecurityGroupAttributes: Modify the security group attributes.
The directions are as follows:
- According to Policy, create a custom policy that allows users to have other permissions such as creating, deleting, and modifying security groups in the CVM console.
The policy content can be set by referring to the following policy syntax:
{
"version": "2.0",
"statement": [
{
"action": [
"name/cvm:ModifySecurityGroupPolicys",
"name/cvm:ModifySingleSecurityGroupPolicy",
"name/cvm:CreateSecurityGroupPolicy",
"name/cvm:DeleteSecurityGroupPolicy"
],
"resource": "*",
"effect": "allow"
}
]
}
- Find the created policy, and in the Operation column of the policy row, click Associate User/Group/Role.
- In the pop-up Associate User/User Group/Role window, select the user/user group you want to authorize and click OK.
Policies Related to Elastic IP Address
If you want the user to be able to view and use elastic IP addresses in the CVM console, you can add the following operations to your policy and then associate the policy with the user.
- AllocateAddresses: Allocate the address to VPC or CVM.
- AssociateAddress: Associate the elastic IP address with an instance or a network API.
- DescribeAddresses: View the elastic IP address in the CVM console.
- DisassociateAddress: Disassociate the elastic IP address with an instance or a network API.
- ModifyAddressAttribute: Modify the attributes of the elastic IP address.
- ReleaseAddresses: Release the elastic IP address.
The directions are as follows:
According to Policy, create a custom policy.
This policy allows users to view elastic IP addresses in the CVM console and assign and associate them with instances, but does not allow users to modify the attributes of elastic IP addresses, disassociate elastic IP addresses, or release elastic IP addresses. The policy content can be set by referring to the following policy syntax:{ "version": "2.0", "statement": [ { "action": [ "name/cvm:DescribeAddresses", "name/cvm:AllocateAddresses", "name/cvm:AssociateAddress" ], "resource": "*", "effect": "allow" } ] }Find the created policy, and in the Operation column of the policy row, click Associate User/Group/Role.
In the pop-up Associate User/User Group/Role window, select the user/user group you want to authorize and click OK.
Authorizing Users to Have Specific CVM Operation Permissions
To authorize a user specific CVM operation permissions, you can associate the following policy with the user. The directions are as follows:
According to Policy, create a custom policy.
This policy allows users to have operation permissions on the CVM instance with ID ins-1 and available region. The policy content can be set according to the following policy syntax:{ "version": "2.0", "statement": [ { "action": "cvm:*", "resource": "qcs::cvm:ap-cityA::instance/ins-1", "effect": "allow" } ] }Find the created policy, and in the Operation column of the policy row, click Associate User/Group/Role.
In the pop-up Associate User/User Group/Role window, select the user/user group you want to authorize and click OK.
Authorizing Users to Have CVM Operation Permissions for Specific Regions
To authorize a user's CVM operation permissions for a specific region, you can associate the following policy with the user. The directions are as follows:
According to Policy, create a custom policy.
This policy allows users to have operation permissions on CVM machines in the available region. The policy content can be set according to the following policy syntax:{ "version": "2.0", "statement": [ { "action": "cvm:*", "resource": "qcs::cvm:ap-cityA::*", "effect": "allow" } ] }Find the created policy, and in the Operation column of the policy row, click Associate User/Group/Role.
In the pop-up Associate User/User Group/Role window, select the user/user group you want to authorize and click OK.
Authorizing the Sub-Account to Have All the Permissions of CVM but Not Including Payment Permissions
Assume that there is a sub-account (Developer) under the enterprise account (CompanyExample, ownerUin is 12345678). The sub-account needs to have all management permissions (such as creation, management, and all other operations) for the CVM service of the enterprise account, but does not include payment permissions (one can place orders but cannot pay).
We can achieve this through the following two solutions:
- Solution A
The enterprise account CompanyExample directly authorizes the preset policy QcloudCVMFullAccess to the sub-account Developer. - Solution B
Create a custom policy using the following policy syntax.
{ "version": "2.0", "statement":[ { "effect": "allow", "action": "cvm:*", "resource": "*" } ] }Authorize the policy to the sub-account.
Authorizing the Sub-account to Have the Operation Permission of Project Management
Assume that there is a sub-account (Developer) under the enterprise account (CompanyExample, ownerUin is 12345678). The sub-account needs to be authorized to manage resources in the console based on the project.
The directions are as follows:
- Create a custom policy for project management based on business permissions.
For details, see Policy. - Authorize the created custom policy to the sub-account.
If a sub-account is prompted for no permission when managing a project, such as viewing snapshots, images, VPCs, Elastic IPs, you can authorize the preset policies QcloudCVMAccessForNullProject, QcloudCVMOrderAccess, and QcloudCVMLaunchToVPC to the sub-account.
Custom Policies
If you feel that the preset policies do not meet your requirements, you can also create custom policies.
For the directions, see Policy.
For more CVM-related policy syntax, see Authorization Policy Syntax.