Identity and access management

Introduction

Identity and Access Management helps users manage resource access permissions within cloud accounts. It caters to various enterprise roles by granting different staff levels access to specific product permissions. For enterprises requiring multi-user collaboration for resource operations, using Identity and Access Management is recommended.

It is applicable to the following usage scenarios:

• Medium and large enterprise customers: Authorization management for multiple employees in the enterprise;
• Technology-oriented vendor or SAAS platform provider: Resource and permission management for proxy clients;
• Small and medium-sized developers or small enterprises: Add project members or collaborators for resource management.

Create User

1. After logging in with root account, select Identity and Access Management on the console to enter the User Management page;

   

2. Click User Management in the left navigation bar, and click Create User on the IAM User Management List page;
3. In the New User dialog box that appears, enter the username, confirm the details, and return to the IAM User Management List to view the newly created IAM user.

Configuration Policy

Public DNS supports both system policies and custom policies, allowing for product-level and instance-level permission control of DNS.

• System policy: A pre-defined set of permissions provided by the Baidu AI Cloud system for resource management. These can be directly assigned to IAM users, but users cannot modify them.
• Custom policy: A user-created, more granular set of permissions for resource management, allowing specific permissions to be configured for single instances. This provides flexibility to address the unique permission management needs of different users.

System Policy

The system policy includes 3 types of policies: management permission, operation and maintenance permission and read-only permission. The scope of permission is as follows:

Custom Policy

Custom policies authorize users at the instance level, differing from system policies as they apply exclusively to selected instances.

IAM users navigate to Policy Management via the left navigation bar, click Create Policy, enter the policy name, and select the service type (choose Intelligent Cloud DNS for public DNS or local DNS for private DNS). The default Visual Editor method for policy creation requires no modifications.

The scope of custom permission is detailed as follows:

User Authorization

Under User Management -> IAM User List, locate the relevant IAM user and click Add Permission in the Operations column. You can then authorize the user through either a System Policy or a Custom Policy.

Note: To change an IAM user's permissions without modifying existing policy rules, you must delete the current policy and assign a new one since existing policy permissions cannot be unchecked or edited directly.