检测到您已登录华为云国际站账号，为了您更好的体验，建议您访问国际站服务网站 https://www.huaweicloud.com/intl/zh-cn
不再显示此消息
检测到您已登录华为云国际站账号，为了您更好的体验，建议您访问国际站服务网站 https://www.huaweicloud.com/intl/zh-cn
不再显示此消息
Instead, create IAM users and grant them permissions for routine management. User A user is created in IAM to use cloud services. Each user has its own identity credentials (password and access keys).
If the IAM user is not found due to insufficient permissions, manually import the IAM user by referring to Checking GES User Details. Figure 2 Creating a user group Click Save in the lower right corner. The user group is created.
Making a Management Plane API Request This section describes the structure of a REST API request on the management plane of GES, and uses the IAM API for obtaining a user token as an example to demonstrate how to call an API.
Due to the limitations of IAM 1.0, which only had RBAC authorization, the agency permissions for these two scenarios were relatively large. In reality, GES did not require such extensive permissions.
IAM or enterprise projects: Type of projects for which an action will take effect. Policies that contain actions supporting both IAM and enterprise projects can be assigned to user groups and take effect in both IAM and Enterprise Management.
The IAM page is displayed. Choose Agencies in the left navigation pane. Then, delete any unnecessary agencies to ensure that GES has a sufficient quota for you to create an agency.
Related Services IAM Identity and Access Management (IAM) authenticates access to GES on Huawei Cloud. VPC GES uses Virtual Private Cloud (VPC) to provide clusters with network topologies to isolate clusters and control access.
Configuring fine-grained permissions for the graph requires IAM user viewing permissions and GES Manager or higher permissions. If there is no IAM user viewing permission, refer to User Details to import IAM users.
iam:roles:createRole, iam:permissions:grantRoleToAgencyOnDomain, iam:agencies:getAgency, iam:agencies:createAgency, iam:roles:updateRole, iam:permissions:grantRoleToAgency, and iam:permissions:grantRoleToAgencyOnProject.
Figure 1 shows the response header fields for the IAM API used to obtain a user token. The x-subject-token header field is the desired user token. This token can then be used to authenticate the calling of other APIs.
Figure 5 Clicking Download Obtaining Token-based Authentication Information Query the IAM endpoint by referring to Regions and Endpoints.
Figure 5 Clicking Download Obtaining Token-based Authentication Information Query the IAM endpoint by referring to Regions and Endpoints.
Creating a User and Using GES To implement fine-grained permissions management for your GES, you can use Identity and Access Management (IAM). This involves creating IAM users and groups and granting specific permissions to them.
Policy IAM supports both system-defined and custom policies. System-defined Policies System-defined policies cover various common actions of a cloud service. System-defined policies can be used to assign permissions to user groups, but they cannot be modified.
Domain name IAM account used to log in to the management console userName No. Mandatory for password-based authentication. Username IAM username used to log in to the management console password No. Mandatory for password-based authentication.
Figure 3 Importing IAM users In the Import IAM User dialog box, enter the ID and username of the IAM user to be added and click OK. The system will add the IAM user to GES so that the IAM user can be selected in the user group.
GES uses the following infrastructure resources: IAM VPC OBS For details about how to view and increase quotas, see Quotas.
IAM can be used free of charge. You pay only for the resources in your account. For more information about IAM, see IAM Service Overview. GES Permissions By default, new IAM users do not have permissions assigned.
Table 4 Common GES operations supported by each IAM policy GES Operation Dependent IAM Permission Importing IAM users iam:users:listUsers (custom policy), IAM ReadOnlyAccess (system policy), or Server Administrator role.
When using a token for authentication, cache it to prevent frequently calling the IAM API used to obtain a user token. To obtain the token, the GES scope must be project (cannot be domain).
