Identity and access management
Introduction
Identity and Access Management helps users manage resource access permissions within cloud accounts. It caters to various enterprise roles by granting different staff levels access to specific product permissions. For enterprises requiring multi-user collaboration for resource operations, using Identity and Access Management is recommended.
It is applicable to the following usage scenarios:
- Medium and large enterprise customers: Authorization management for multiple employees in the enterprise;
- Technology-oriented vendor or SAAS platform provider: Resource and permission management for proxy clients;
- Small and medium-sized developers or small enterprises: Add project members or collaborators for resource management.
Create User
-
After logging into the root account, select Identity and Access Management from the console to access the user management page.
- Click on User Management in the left navigation bar, then click New User on the IAM User Management List page.
- In the New User dialog box that appears, enter the username, confirm the details, and return to the IAM User Management List to view the newly created IAM user.
Configuration Policy
CCE currently supports system policies for implementing product-level permission control within the service.
- System policy: A pre-defined set of permissions provided by the Baidu AI Cloud system for resource management. These can be directly assigned to IAM users, but users cannot modify them.
System Policy
The system policies include 3 types: full control over CCE management, operation and maintenance management of CCE, and development management of CCE. The scope of permissions is detailed as follows:
| Policy name | Permission | Permission scope |
|---|---|---|
| CCEFullControlPolicy | Full control over CCE management: IAM users have full management permissions for CCE resources and CCE applications. Users can create and delete clusters, manage resources such as nodes within clusters, and deploy and delete applications in clusters via Kubernetes. They are applicable to global administrators. |
Resource Management: Create clusters ; delete clusters ; change cluster remarks ; add nodes ; delete nodes ; edit auto scaling policies Application Management: ; download cluster configuration files ; access the Kubernetes console ; create/delete namespaces ; create/delete Kubernetes applications such as deployments, services, ConfigMaps and secrets |
| CCEOperatePolicy | Operation and maintenance management permissions for CCE: IAM users have partial management permissions for CCE resources and CCE applications. Users cannot create new clusters or delete existing clusters, but can manage node resources within clusters. They are applicable to operation and maintenance personnel who need to perform resource operation and maintenance and scaling. |
Resource Management: change cluster notes ; add clusters ; change cluster remarks ; edit auto scaling strategy Application Management: download cluster configuration files ; access the Kubernetes console ; create/delete namespaces ; create/delete Kubernetes applications such as deployments, services, ConfigMaps and secrets |
| CCEDevelopPolicy | Permission to develop and manage CCE: IAM users do not have management permissions for CCE resources, but can manage applications deployed in the cluster via Kubernetes. They are applicable to developers who need to release and modify applications. |
Application Management: ; download cluster configuration files ; access the Kubernetes console ; create/delete namespaces ; create/delete Kubernetes applications such as deployments, services, ConfigMaps and secrets |
User Authorization
Under User Management -> IAM User List, locate the relevant IAM user and click Add Permission in the Operations column. You can then authorize the user through either a System Policy or a Custom Policy.
Note: To change an IAM user's permissions without modifying existing policy rules, you must delete the current policy and assign a new one since existing policy permissions cannot be unchecked or edited directly.
Sign in as IAM User
After the root account authorizes the IAM user, it can share the login link with the IAM user. The IAM user can then access the root account's management console via this link and operate or view the root account's resources based on the granted policies.
For other detailed operations, refer to: Identity and Access Management.