Managing CBH Instance Permissions and Supported Actions

This section describes fine-grained permissions management for your CBH. If your account does not need individual IAM users, then you may skip over this section.

By default, new IAM users do not have any permissions assigned. You need to add a user to one or more groups, and assign permissions policies to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

Permissions are classified into roles and policies based on the authorization granularity. Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions.

Supported Actions

CBH provides system-defined policies that can be directly used in IAM. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control.

Permission: A statement in a policy that allows or denies certain operations.
Action: Specific operations that are allowed or denied.

Table 1 Supported Actions (IAM 3.0)
Permission	API	Action	IAM Project	Enterprise Project
Querying total ECS quota	GET /v2/{project_id}/cbs/instance/ecs-quota	cbh:instance:getEcsQuota	√	×
Querying the AZ of a CBH instance	GET /v2/{project_id}/cbs/available-zone	cbh:instance:getAvailableZones	√	×
Logging in to a CBH instance	POST /v2/{project_id}/cbs/instance/login	cbh:instance:login	√	×
Stopping a CBH instance	POST /v2/{project_id}/cbs/instance/stop	cbh:instance:stop	√	×
Restarting a CBH instance	POST /v2/{project_id}/cbs/instance/reboot	cbh:instance:reboot	√	×
Upgrading the CBH system version	POST /v2/{project_id}/cbs/instance/upgrade	cbh:instance:upgrade	√	×
Changing the password of the admin user for a CBH instance	PUT /v2/{project_id}/cbs/instance/password	cbh:instance:resetPassword	√	×
Starting a CBH instance	POST /v2/{project_id}/cbs/instance/start	cbh:instance:start	√	×
Expanding a CBH instance edition	PUT /v2/{project_id}/cbs/instance	cbh:instance:alterSpec	√	×
Creating a CBH instance	POST /v2/{project_id}/cbs/instance	cbh:instance:create	√	√
Binding or unbinding an EIP	POST /v2/{project_id}/cbs/instance/{server_id}/eip/bind POST /v2/{project_id}/cbs/instance/{server_id}/eip/unbind	cbh:instance:eipOperate	√	×
Creating a CBH agency	POST /v2/{project_id}/cbs/agency/authorization	cbh:agency:authorize	√	×
Querying the CBH instance list	GET /v2/{project_id}/cbs/instance/list	cbh:instance:list	√	×
Changing the VPC a bastion host instance belongs to	PUT /v2/{project_id}/cbs/instance/vpc	cbh:instance:switchInstanceVpc	√	×
Logging in to a bastion host instance as user admin	GET /v2/{project_id}/cbs/instances/{server_id}/admin-url	cbh:instance:loginInstanceAdmin	√	×
Changing the type of a single-node CBH instance	PUT /v2/{project_id}/cbs/instance/type	cbh:instance:changeInstanceType	√	×
Obtaining the operation link for an asset managed by the bastion host	GET /v2/{project_id}/cbs/instance/get-om-url	cbh:instance:getOmUrl	√	×

Parent topic: Permissions Management

Предыдущая статья

Creating Custom Policies for CBH Instances

Следующая статья

Creating a CBH Instance

Была ли эта статья полезна?

Поддержка Юридические документы