IAM primary-IAM user access control

Overview

Under your Baidu AI Cloud account, you can use IAM to create IAM users with their own AccessKeys. Your Baidu AI Cloud account is referred to as the root account, while the created accounts are called IAM users. Using an IAM user's AccessKey allows operations and access to resources authorized by the root account. BOS integrates the IAM user system, enabling the creation of IAM users through the console's multi-user access control feature to achieve:

1. Intra-account authorization: Authorize IAM users within your account to manage cloud resources (buckets and objects) under the same account.
2. Cross-account authorization: Authorize IAM users in your account to manage cloud resources (buckets and objects) in other accounts.

When granting permissions, it's recommended to strictly adhere to the principle of minimum permission, restricting users to specific operations (e.g., read-only authorization) and limiting access to resources with specified prefixes to avoid over-granting, which could lead to unauthorized actions and data security risks.

Application scenarios

• Enterprise IAM user management and permission separation

  Enterprise A has purchased various cloud resources (like BCC instances, RDS instances, BLB instances, and BOS storage) through its Baidu AI Cloud account. The employees of Enterprise A need to manage these resources, including purchasing, operations and maintenance, and online application deployment. Employees in different roles have varying responsibilities, requiring distinct permissions. For security reasons, Enterprise A doesn't want to share the root account's access keys. Instead, it will create corresponding IAM users for employees based on their roles. These IAM users can only perform authorized operations and do not need independent metering and billing. All resource costs will be charged to the root account. Enterprise A can revoke an IAM user's permissions or delete the IAM user at any time.

• Cross-enterprise resource operation and authorization management

  Let Enterprises A and B represent two different companies. Enterprise A has purchased various cloud resources (like BCC instances, RDS instances, BLB instances, and BOS storage) to support its business. To stay focused on its business systems, Enterprise A entrusts or authorizes Enterprise B to handle tasks such as cloud resource operations and maintenance (O&M) and monitoring. Enterprise B can then assign these tasks to its employees by creating corresponding IAM users for them. Enterprise B can finely manage the permissions of its employees for accessing and operating A's cloud resources. If the partnership or O&M contract between A and B ends, Enterprise A can promptly revoke the permissions granted to Enterprise B.

Policy file description

The IAM primary user grants permissions to IAM users using associated policies. A policy file, essentially a JSON document, is used to define permissions and resources. Below is a blank template for creating a policy file:

1{
2    "accessControlList": [
3        {
4            "service": "bce:bos",
5            "region": "*",
6            "effect": "Allow",
7            "permission": [],
8            "resource": [],
9        }
10    ]
11}

The meaning of each field in the policy file is as follows:

The BOS APIs corresponding to each permission are as follows:

Description of system policy configuration

To make operations easier for users, Baidu AI Cloud has two pre-configured system policies: BosFullAccess and BosListAndReadAccess.

• BosFullAccess: Grants full management permissions for Baidu AI Cloud Object Storage (BOS).
• BosListAndReadAccess: Grants read-only permissions for Baidu AI Cloud Object Storage (BOS).

Description:

• System policies are not modifiable or deletable.

On the Policy Management page, click the "View" button next to the policy name in the operations column to access the JSON files for the two system policies.

Description of custom policy configuration

If you need to customize more fine-grained permission control, you can create a custom policy. A custom policy allows users to define the resources and permissions of IAM users through a policy file, enabling more precise control over permissions and resources. A policy is essentially a JSON file. You can refer to [Policy File Description](#Policy file description) or the following typical scenario examples. You can also use the BOS ACL Editor Tool to obtain policy templates and configure custom policies. In the examples below, the bucket name is assumed to be mybucket.

Authorize an IAM user full management permission for a specific bucket (management via console)

1{
2    "accessControlList": [
3        {
4            "service": "bce:bos",
5            "region": "*",
6            "effect": "Allow",
7            "permission": [
8                "FULL_CONTROL"
9            ],
10            "resource": [
11                "mybucket",
12                "mybucket/*"
13            ]
14        },
15        {
16            "service": "bce:bos",
17            "region": "*",
18            "effect": "Allow",
19            "permission": [
20                "ListBuckets"
21            ],
22            "resource": [
23                "*"
24            ]
25        }
26    ]
27}

Note:

• The resource field must include both "mybucket" and "mybucket/*".
• To manage a bucket through the console, you also need the ListBuckets permission; otherwise, the bucket list cannot be displayed.
• IAM users support cross-account resource authorization. For instance, "mybucket" can belong to another account. Suppose there are two accounts: Account A owns "mybucket," and Account B has an IAM user. Account A can grant Account B permission to access "mybucket" by updating the bucket permissions. Account B can then create a custom policy to further grant its IAM user the permissions needed to manage "mybucket.\

Authorize an IAM user full management permission for a specific bucket (without using console management or BOS desktop)

1{
2    "accessControlList": [
3        {
4            "service": "bce:bos",
5            "region": "*",
6            "effect": "Allow",
7            "permission": [
8                "FULL_CONTROL"
9            ],
10            "resource": [
11                "mybucket",
12                "mybucket/*"
13            ]
14        }
15    ]
16}

Note:

• The resource field must include both mybucket and mybucket/*.
• If you’re not managing the bucket through the console, there’s no need to enable the ListBuckets permission. You can use BOS peripheral tools or SDKs directly to access the BOS service.

Authorize an IAM user read-only permission for a specific prefix (directory)

Suppose a bucket is used to store photos, organized by shooting location, with subdirectories for each year under each location. Now, you need to assign an IAM user read-only access for the directory "mybucket/shanghai/2013/". The directory structure is as follows:

1mybucket //bucket
2	|-- beijing
3	|	|--2010
4	|	|--2011
5	|-- shanghai
6	|	|--2012
7 | |--2013 //Grant read-only permission for this directory
8	|--shenzhen
9		|--2014
10		|--2015

Assume the IAM user already knows the paths of all files, and the IAM user needs permission to list files:

1{
2    "accessControlList": [
3        {
4            "service": "bce:bos",
5            "region": "*",
6            "effect": "Allow",
7            "permission": [
8                "LIST",
9                "READ"
10            ],
11            "resource": [
12                "mybucket/shanghai/2013/",
13                "mybucket/shanghai/2013/*"
14            ]
15        },
16        {
17            "service": "bce:bos",
18            "region": "*",
19            "effect": "Allow",
20            "permission": [
21                "READ"
22            ],
23            "resource": [
24                "mybucket"
25            ]
26        }
27    ]
28}

Other descriptions:

• If an IAM user needs to upload files via the BOS console, you must not only grant the requested permissions but also configure the user's access mode as both Programmatic Access and Console Password Access; otherwise, file uploads will fail.