Cloud Access Management(CAM)

Scenarios

Cloud File Storage (CFS) already supports resource-level access permission management, that is, the root account can grant specified operation permissions to specified resources for specified users and user groups. After authorization, the CFS console and API will allow or prohibit user operations according to the user's authorization.

This guide describes how to authorize read-only, read-write, and custom policies for CFS for users. For more information on the principles and guidelines of cloud access management, see CAM.

Creating Access Control Policy

Log in to the policy management page of the cloud access management console.

• If you need to grant user permissions quickly, you can search for CFS in the search box on the right side of the policy management interface, select preset CFS read-only or read/write permissions and associate user groups to complete authorization.
• If you need to grant permissions to users for specific actions, you can create a custom policy and associate user groups to complete authorization.

CFS Full Access Policy

If you want the user to have permissions for all operations such as query, creation, modification, and deletion, you can grant the user QcloudCFSFullAccess permission. The policy syntax of using preset QcloudCFSFullAccess to grant collaborators or sub-users read/write all CFS resources and query permissions for VPC and subnet is as follows:

    {
    "version": "2.0",
    "statement": [
        {
            "action": [
                "cfs:*"
            ],
            "resource": "*",
            "effect": "allow"
        },
        {
            "action": [
                "vpc:DescribeVpcEx",
                "vpc:DescribeSubnetEx"
            ],
            "resource": "*",
            "effect": "allow"
        }
    ]
}

CFS Read-Only Policy

If you want the user to have query permission but do not have creation, modification, and deletion permissions, you can grant the user QcloudCFSReadOnlyAccess permission. The policy syntax of using preset QcloudCFSReadOnlyAccess to grant collaborators or sub-users read/write all CFS resources and query permissions for VPC and subnet is as follows:

{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "cfs:Describe*"
            ],
            "resource": "*",
            "effect": "allow"
        },
        {
            "action": [
                "vpc:DescribeVpcEx",
                "vpc:DescribeSubnetEx"
            ],
            "resource": "*",
            "effect": "allow"
        }
    ]
}

Custom Policy

Custom policy is a more flexible way to authorize users, and the cloud access management console provides multiple ways to generate policies. This case describes how to create a custom policy by using Create by Policy Builder (for other methods, see Policy document).

The policy builder page provides visual policy configuration. You can automatically generate the policy code by selecting parameters, which is suitable for users with CAM authorization for the first time.

On the policy management console policy page, choose Create Custom Policy >Created by Policy Generator. On the create policy page, use the policy builder to add multiple statements to a custom policy. The configuration instructions are as follows:

Among them, APIs of CFS, API features and authorization precautions are listed below. Resource options can be configured according to the following instructions.

Note:

In addition, since the CFS file system uses the vpc IP, you need to obtain permissions for the "vpc: DescribeVpcEx" and "vpc: DescribeSubnetEx" APIs on pages such as creating file systems, listing CFS file systems, and querying file system details (you cannot query and create without granting them). It is strongly recommended that you add the authorization of all VPC resources by these two APIs to all authorized CFS policies. For detailed policy writing, see the QcloudCFSReadOnlyAccess policy statement.

After the above parameters are set, click Add Claim to add a statement for this custom policy. You can repeat the above steps to add multiple statements. If there are duplicate or conflicting policies, see Syntax Structure for their relationship and effectiveness.

The writing format of the policy is as follows. Each policy can have multiple statements.

{
    "version": "2.0",
    "statement": [{
        "effect": "Effect",
        "action": [
            "Action"
        ],
        "resource": "Resource"

    }]
}

For example, the permission policy syntax for prohibiting users from deleting and updating quotas on several file systems is as follows.

{
    "version": "2.0",
    "statement": [{
        "effect": "deny",
        "action": [
            "name/cfs:DeleteCfsFileSystem",
            "name/cfs:UpdateCfsFileSystemSizeLimit"
        ],
        "resource": [
            "qcs::cfs::uin/2779643970:filesystem/cfs-11111111",
            "qcs::cfs::uin/2779643970:filesystem/cfs-22222222",
            "qcs::cfs::uin/2779643970:filesystem/cfs-33333333"
        ]
    }]
}

Authorizing Users/User Groups/Roles

If the permission provided by the system is selected, you can directly search for QcloudCFSFullAccess or QcloudCFSReadOnlyAccess or other custom policies in the policy details list. Click Associate User/Group/Role in the operation column on the right side of the list, and find and check the user or user group to be authorized in the pop-up window. Finally, click OK to complete the authorization.

Canceling User/User Groups/Role Authorization

To cancel the permission of an authorized user, check the user/user group to be canceled in the Associate User/Group/Role list on the corresponding policy details page, and then click Release User/User Group/Role. After confirming the cancellation, the user/user group will lose permission to operate CFS resources for CFS.