Introductions for Identity and Access Management Products

Identity and Access Management (IAM) is mainly used for identity management and access control of Baidu AI Cloud, tackling tasks such as centralized authorization and management of Cloud account, resources sharing and multi-user collaboration. Multi-user IAM is applicable to various functional roles within enterprises. By providing privileges of products to employees, you can share the resources in your account and help them to finish their work. When your company needs collaborative working and resources sharing, recommend you to use the Multi-user IAM.

The followings are typical scenarios to which the Multi-user IAM is applicable:

• For medium and large business customers: Achieve centralized management of resources and access control of employees of different departments within the business;
• For independent software vendor (ISV) or SaaS platform vendor: Achieve centralized resources management and access control for agent clients;
• For small and medium developers or small businesses: Add project members or collaborators to conduct resources management and access control.

For more information on multi-user IAM, see IAM Documentation.

Definitions

• Privilege: Means whether access to one or several interfaces is permitted, e.g., view task details, edit tasks and so on;
• Resources: Means the entity created and maintained by the user in the service and the smallest entity accessed by the user; in BLS, any tasks, collectors and collector groups belong to resources;
• Policy: Means a combination of privileges, resources, and user identities, such as read-only policy or custom policy;

System Policy Privileges Description

The system policies of BLS include read-only privileges, OPS privileges, and management privileges. The details are as follows:

Policy Names	Privileges Description	Privilege Scope
BLSReadPolicy	Read-only BLS Access Privileges	It is allowed to view task details, collector details, collectors group details and collector installation only;
BLSOperatePolicy	Means the BLS OPS privilege	Besides read-only privilege, it is also able to edit tasks, start/stop tasks, edit collectors, and collector groups;
BLSFullControlPolicy	It means the privilege for full control and management of BLS.	It has the all privileges for access to BLS;

Description of Privileges for Custom Policies

The types of privilege operation and scope of privilege for custom policy of BLS are described in detail as follows:

Resources Dimension	Privilege Name	Description
Task	View task details	No
	Edit task	Add and delete collectors for tasks, modify task configuration information
	Start/stop task	No
	Delete task	No
Collector	View collector’s detailed information	No
	Edit collector	Add or delete tasks for collector
	Delete collector	No
Collectors group	View detailed information of collectors group	No
	Edit collectors group	Add or delete collector for collectors group and modify description of collectors group
	Delete collectors group	No

Authorization Case

The authorization steps are as follows:

• Create a sub-user
• Create a custom policy
• Grant privileges to a sub-user
• Log in to a sub-user on the console and access the product

Create a Sub-user

Step 1: Click the user avatar at the upper right corner, and then "Multi-User IAM";

Step 2: Click "Create a sub-user". After the sub-user has been created successfully, the login link is as shown in the picture;

See Documentation on the multi-user IAM for more details.

Create a Custom Policy

Step 1: Click “Policy Management” on the left side, click “Create a Policy”, and then click “Create by Policy Generator”;

Step 2: Click “Add a Privilege”;

Step 3: Select "BLS", select “Privilege” and “Resources”, and then click "Finish";

Step 4: Click "Finish" again;

Grant privileges to a sub-user

Step 1: Click "Add a Privilege";

Step 2: Search for "bls", so that you can add "System Policy" and "Custom Policy” here; and then click "OK";

Console Login of sub-user and Product Access

Step 1: Visit the sub-user login link;

Step 2: Click BLS and access the product;