Introduction

Identity and Access Management (IAM) helps users manage access rights to resources under cloud accounts. It applies to different roles in the enterprise and can give different rights to different employees to use products. It is recommended that you use identity and access management when your enterprise has multi-user collaborative operation resources.

Applicable to the following scenarios:

• Customers of medium and large enterprises: Perform the authorized management of multiple employees in the company;
• Technology-based vendor or SAAS platform providers: Manage the resources and rights of the proxy clients;
• Small and medium developers or small enterprises: Add the project members or collaborators to manage the resources.

The identity and access management enables coordinated management and use of BMR resources by different persons or different departments in the company or organization. In the BMR, the clusters and scheduled tasks are resources. In the coordination, the master user creates the sub-user and assigns the access policy.

Overview of access policy:

The access control policies consist of the dimensions of permission and resource. The permission means the user's executable actions, such as creation, deletion, check, and modification; the resource means the cluster or scheduled task. The permissions comprise the types of coarse granularity and fine granularity. The coarse granularity permission does not limit resources, and it can correspond to different fine granularity permissions; the fine granularity permission needs to select one or more resources. The sub-user granted with a certain strategy has access to corresponding resources.

Policy example:

ACL{ //the policy has READ coarse granularity permission to all resources;
"resource": ["*"], //resource
"permission": [ //permission
         "READ"
]
}；
   
ACL{ //the policy has ScaleCluster (expand/reduce capacity) fine granularity permission to a cluster;
"resource": ["cluster/ clusterID"], //resource
"permission": [ //permission
" ScaleCluster"
]
}.

Notes:

• Master user owns all resources of BMR, and the master user assumes the expenses on resources created or deleted by the sub-user.
• The sub-user and master user have the same permissions to the operation of cluster templates, which have no permission control.
• The policy change takes effect after 5 minutes.

Create Sub-users

1. After the user having a primary account number logs in, select "Identity and Access Management" in the console to enter the user administration page.

2. Click "User Management" in the left navigation bar, and click "New User" on the "Sub-user Management List" page.
3. In the popped up "New User" dialog box, enter and confirm "User Name", and return to "Sub-user Management List" to view the new sub-user.

Configuration Policies

The permission policy has two types: [System Privilege Policy](#System Policy) and [Custom Privielge Policy](#Custom Policy). They are used to control BMR's product-level permission and resource-level permission, respectively.

• System policy: A permission set predefined by Baidu AI Cloud system to manage resources. Such policies can directly grant permission to the sub-user, which is used rather than modified by the user.
• Custom policy: It is created by users, more detailed permission set for managing resources, which can configure permission for a single instance, and can ensure differentiated permission management of accounts to different users more flexibly.

System Policies

Click "Resources Management" to enter the policy management page. The system policy is preset for users by BMR and cannot be modified by users. You can enter "bmr" in the right search box to view all BMR system policies.

The four system policies provided by BMR and their permissions are as follows:

Custom Policies

By clicking "Custom Policy", entering the policy name, and selecting service type of "Baidu MapReduce BMR", the sub-user can add the custom policy to add custom permissions. You can add custom policies by configuring policy generator or editing policy files. The fine granularity permission is the only option for policy generator, and coarse granularity permission and fine granularity permission are two options for editing policy files. You can set and modify the policy according to specific permissions.

Policy Generator

For the policy generator, there are two resources: cluster and scheduled task. The resource box represents the fine granularity permission for that resource. After selecting the permission, you can click different regions in "Select resources" to see the resources under the region. Click "Finish" after selecting the resources.

Note: Cluster and scheduled tasks are parallel resources. In the policy, you can configure the permission to one or both of such resources.

Editing Policy Files

Essentially, the policy file is a JSON file, and permission and resource in the file are used to define permission and resource. For easy editing, the permission list shows all coarse and fine granularity permissions by default, and you can delete elements in the list as needed.

Note:

You cannot add or delete any field (such as service and region) in the policy file, and you cannot change the field name.

The definition of all fields in the policy file is as follows:

User Authorization

Select "Add Privilege" in the "Operation" column of the corresponding sub-user in "User Administration-> Sub-User Administration List" page, and select and authorize the system privileges or custom policies for users.

Note:

If you modify the permissions of the sub-user without modifying the existing policy rules, you can only delete the existing policies and add policies, but you cannot cancel the added policy permissions.

Service Authorization

For the sub-users to use BMR services, you need to authorize permission to other services in Baidu AI Cloud. The permission policy and influence the scope of services are as follows:

System policies cover all policies above.

Sub-user Login

After the user having a primary account number has authorized the sub-user, it can send the link to the sub-user; the sub-user can log in to the management console of the main account through the IAM user login link, and operate and view the main account resources based on authorized policies.

For other detailed operations, please see Identity and Access Management.

Privilege Model

Selecting a coarse granularity permission policy means selecting all fine granularity permissions corresponding to the coarse granularity permission. From the way of naming, it can be seen the name of coarse granularity permission includes uppercase characters only, and the name of fine granularity permission is camel case.

Notes:

• LIST_ALL_STEP coarse granularity permission means access to all job lists, including job lists on the cluster page;
• READ coarse granularity permission or ReadStep fine granularity permission for specified cluster ID means access only to job lists on the cluster page, and you can view job details with such permission.