Configure IAM Predefined Permission Policy

CCE uses IAM policy authorization, whereby the administrator of the Baidu AI Cloud account (or the IAM with system administrator permissions) grants the predefined CCE system policy to the IAM user/user group through Identity and Access Management (IAM), so that they have the read-only and management permissions of cluster-level resources (such as clusters, nodes and node groups). The CCE system policy authorization will apply to all clusters in all regions.

This document outlines the procedures and use of CCE with IAM policy-based authorization.

Description

This section covers CCE IAM policy authorization only for K8S Cluster CCE-level resources and associated cloud product/service permissions, excluding Kubernetes resource permissions at the cluster namespace level. For operational authorization of namespace Kubernetes resources, refer to Configuring Preset RBAC Permission Policies.

CCE pre-configured policies

You can use the following pre-configured policies to grant relevant permissions to IAM users:

Kind reminder

• CCE integrates with several cloud products/services. To simplify and optimize the authorization process, the CCE IAM system policy includes operational permissions for commonly integrated cloud products/services.
• By assigning the CCE IAM system policy to IAM users, they gain read-only or management permissions for K8S Cluster CCE, node resources, and related cloud products/services without needing to understand or handle multiple cloud product policies and authorizations.
• If the system policy doesn’t meet your authorization requirements, you can create a custom policy to allow or deny specific operations for particular cloud products/services.

Operation steps

Directly grant permissions to IAM users

You can associate policies directly with IAM users to grant the permissions defined in those policies.

1. Enter the Identity and Access Management console and select User Management > IAM User in the left navigation bar to enter the IAM User Management List page.
2. Select the target IAM user and click Username to enter the User Details page.
3. Click on Authorize and select the required policies in the Edit Permission pop-up window.
4. Click OK to confirm.

Authorize IAM users through user groups

Add IAM users to a user group to automatically grant them the permissions associated with the group's policies. To remove those permissions, simply delete the IAM user from the respective user group.

1. Enter the Identity and Access Management console and select Group Management in the left navigation bar to enter the Group Management List page.
2. Select the target user group, click Edit to enter the Edit Group page.
3. On the Edit Group page, select the necessary policies and add the corresponding IAM users.
4. Click OK to continue.