From d48c6004e45e0ea4f7d7ed44492a5b3c9132b663 Mon Sep 17 00:00:00 2001 From: "Wei, Hongmin" Date: Mon, 9 Sep 2024 12:18:24 +0000 Subject: [PATCH] IAM UMN 20240116 Version Reviewed-by: Rogal, Marcel Co-authored-by: Wei, Hongmin Co-committed-by: Wei, Hongmin --- docs/iam/umn/ALL_META.TXT.json | 693 ++++++++++++++++++++++- docs/iam/umn/CLASS.TXT.json | 14 +- docs/iam/umn/en-us_image_0289500726.png | Bin 16748 -> 0 bytes docs/iam/umn/en-us_topic_0046611300.html | 20 +- docs/iam/umn/en-us_topic_0046613147.html | 8 +- docs/iam/umn/en-us_topic_0046613148.html | 4 +- docs/iam/umn/en-us_topic_0046661675.html | 6 +- docs/iam/umn/en-us_topic_0079496985.html | 4 +- docs/iam/umn/en-us_topic_0079496986.html | 2 +- docs/iam/umn/en-us_topic_0079620341.html | 14 +- docs/iam/umn/iam_01_0003.html | 2 +- docs/iam/umn/iam_01_0012.html | 7 + docs/iam/umn/iam_01_0013.html | 2 +- docs/iam/umn/iam_01_0016.html | 28 +- docs/iam/umn/iam_01_0023.html | 2 +- docs/iam/umn/iam_01_0029.html | 31 +- docs/iam/umn/iam_01_0030.html | 5 +- docs/iam/umn/iam_01_0063.html | 10 +- docs/iam/umn/iam_01_0430.html | 6 +- docs/iam/umn/iam_01_0607.html | 4 +- docs/iam/umn/iam_01_0653.html | 2 +- docs/iam/umn/iam_01_0655.html | 9 +- docs/iam/umn/iam_01_0703.html | 2 +- docs/iam/umn/iam_01_0704.html | 4 +- docs/iam/umn/iam_03_0002.html | 4 +- docs/iam/umn/iam_03_0004.html | 4 +- docs/iam/umn/iam_06_0001.html | 4 +- docs/iam/umn/iam_06_0004.html | 4 +- docs/iam/umn/iam_07_0001.html | 4 +- docs/iam/umn/iam_07_0003.html | 4 +- docs/iam/umn/iam_08_0003.html | 6 +- docs/iam/umn/iam_08_0004.html | 8 +- docs/iam/umn/iam_08_0005.html | 2 +- docs/iam/umn/iam_08_0007.html | 2 +- docs/iam/umn/iam_08_0008.html | 42 +- docs/iam/umn/iam_08_0009.html | 10 +- docs/iam/umn/iam_08_0010.html | 2 +- docs/iam/umn/iam_08_0025.html | 2 +- docs/iam/umn/iam_08_0251.html | 2 +- docs/iam/umn/iam_08_0252.html | 10 +- docs/iam/umn/iam_08_0254.html | 2 +- docs/iam/umn/iam_08_0255.html | 2 +- docs/iam/umn/iam_08_0256.html | 2 +- docs/iam/umn/iam_08_0259.html | 6 +- 44 files changed, 834 insertions(+), 167 deletions(-) delete mode 100644 docs/iam/umn/en-us_image_0289500726.png diff --git a/docs/iam/umn/ALL_META.TXT.json b/docs/iam/umn/ALL_META.TXT.json index 6608b731..461aa89e 100644 --- a/docs/iam/umn/ALL_META.TXT.json +++ b/docs/iam/umn/ALL_META.TXT.json @@ -1,841 +1,1516 @@ [ + { + "dockw":"User Guide" + }, { "uri":"iam_01_0021.html", + "node_id":"iam_01_0021.xml", "product_code":"iam", "code":"1", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Service Overview", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Service Overview", "githuburl":"" }, { "uri":"iam_01_0026.html", + "node_id":"iam_01_0026.xml", "product_code":"iam", "code":"2", "des":"Identity and Access Management (IAM) provides identity authentication, permissions management, and access control. With IAM, you can create users for individuals, systems", "doc_type":"usermanual", "kw":"What Is IAM?,Service Overview,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"What Is IAM?", "githuburl":"" }, { "uri":"en-us_topic_0046611276.html", + "node_id":"en-us_topic_0046611276.xml", "product_code":"iam", "code":"3", "des":"IAM provides the following basic functions:Refined permissions managementYou can control user access to different projects and grant different permissions to users for th", "doc_type":"usermanual", "kw":"IAM Features,Service Overview,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"IAM Features", "githuburl":"" }, { "uri":"iam_01_0023.html", + "node_id":"iam_01_0023.xml", "product_code":"iam", "code":"4", "des":"You can manage users in your account and their security credentials. In addition, you can configure identity federation so that users in other systems can access the clou", "doc_type":"usermanual", "kw":"Identity Management,Service Overview,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Identity Management", "githuburl":"" }, { "uri":"iam_01_0024.html", + "node_id":"iam_01_0024.xml", "product_code":"iam", "code":"5", "des":"You can grant users permissions to access different resources.Plan user groups and grant permissions to each user group.Add a user to a specific user group so that the us", "doc_type":"usermanual", "kw":"Permissions Management,Service Overview,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Permissions Management", "githuburl":"" }, { "uri":"iam_01_0035.html", + "node_id":"iam_01_0035.xml", "product_code":"iam", "code":"6", "des":"To prevent personal data, such as the username, password, and mobile number, from being accessed by unauthorized entities or individuals, IAM encrypts the data before sto", "doc_type":"usermanual", "kw":"Personal Data Protection Mechanism,Service Overview,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Personal Data Protection Mechanism", "githuburl":"" }, { "uri":"iam_01_0027.html", + "node_id":"iam_01_0027.xml", "product_code":"iam", "code":"7", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Getting Started", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Getting Started", "githuburl":"" }, { "uri":"iam_01_0034.html", + "node_id":"iam_01_0034.xml", "product_code":"iam", "code":"8", "des":"Your account has full access to your resources. For security purposes, create a security administrator and perform routine management as the security administrator.If a u", "doc_type":"usermanual", "kw":"Getting Started with IAM,Getting Started,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Getting Started with IAM", "githuburl":"" }, { "uri":"iam_07_0002.html", + "node_id":"iam_07_0002.xml", "product_code":"iam", "code":"9", "des":"For security purposes, create a security administrator and manage users in your account as the security administrator.Programmatic access: Users can access cloud services", "doc_type":"usermanual", "kw":"Username,Creating a Security Administrator,Getting Started,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Creating a Security Administrator", "githuburl":"" }, { "uri":"iam_01_0030.html", + "node_id":"iam_01_0030.xml", "product_code":"iam", "code":"10", "des":"As a security administrator, you can create user groups and grant them permissions.To enable users to directly view their permissions, set a description for the user grou", "doc_type":"usermanual", "kw":"Creating a User Group and Assigning Permissions,Getting Started,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Creating a User Group and Assigning Permissions", "githuburl":"" }, { "uri":"iam_01_0031.html", + "node_id":"iam_01_0031.xml", "product_code":"iam", "code":"11", "des":"As a security administrator, you can create a user and add the user to a user group. The user automatically inherits the permissions of the user group.For security purpos", "doc_type":"usermanual", "kw":"Username,Creating a User and Adding the User to a User Group,Getting Started,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Creating a User and Adding the User to a User Group", "githuburl":"" }, { "uri":"iam_01_0032.html", + "node_id":"iam_01_0032.xml", "product_code":"iam", "code":"12", "des":"You can log in to the cloud platform as an IAM user and access cloud services based on granted permissions.If either of the following has been configured on Security Sett", "doc_type":"usermanual", "kw":"Logging In as an IAM User,Getting Started,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Logging In as an IAM User", "githuburl":"" }, { "uri":"iam_01_0040.html", + "node_id":"iam_01_0040.xml", "product_code":"iam", "code":"13", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"User Guide", "githuburl":"" }, { "uri":"iam_01_06.html", + "node_id":"iam_01_06.xml", "product_code":"iam", "code":"14", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"IAM Users", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"IAM Users", "githuburl":"" }, { "uri":"en-us_topic_0046611303.html", + "node_id":"en-us_topic_0046611303.xml", "product_code":"iam", "code":"15", "des":"If you need to share resources in your account to other users, you can create users by using the console or by calling an API, and set security credentials and required p", "doc_type":"usermanual", "kw":"Username,Creating a User,IAM Users,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Creating a User", "githuburl":"" }, { "uri":"en-us_topic_0079496985.html", + "node_id":"en-us_topic_0079496985.xml", "product_code":"iam", "code":"16", - "des":"IAM users created without being added to any groups do not have permissions. You can assign permissions to these IAM users on the IAM console. After authorization, the us", + "des":"IAM users created without being added to any groups do not have permissions. You can assign permissions to these IAM users on the IAM console. Then the users can use clou", "doc_type":"usermanual", "kw":"Assigning Permissions to an IAM User,IAM Users,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Assigning Permissions to an IAM User", "githuburl":"" }, { "uri":"iam_01_0552.html", + "node_id":"iam_01_0552.xml", "product_code":"iam", "code":"17", "des":"You can log in to the console as an IAM user or obtain the IAM user login link from the administrator and then use the link to log in.Domain name: The name of the account", "doc_type":"usermanual", "kw":"Logging In as an IAM User,IAM Users,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Logging In as an IAM User", "githuburl":"" }, { "uri":"en-us_topic_0046661675.html", + "node_id":"en-us_topic_0046661675.xml", "product_code":"iam", "code":"18", "des":"You can modify the user information, including the status, access type, description, external identity ID, and belonged user group.If the job responsibilities of a user a", "doc_type":"usermanual", "kw":"Viewing and Modifying User Information,IAM Users,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Viewing and Modifying User Information", "githuburl":"" }, { "uri":"iam_02_0004.html", + "node_id":"iam_02_0004.xml", "product_code":"iam", "code":"19", "des":"After an IAM user is deleted, they can no longer log in and their username, password, access keys, and authorizations will be cleared and cannot be recovered.Make sure th", "doc_type":"usermanual", "kw":"Deleting an IAM User,IAM Users,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Deleting an IAM User", "githuburl":"" }, { "uri":"iam_01_0653.html", + "node_id":"iam_01_0653.xml", "product_code":"iam", "code":"20", "des":"As an administrator, you can reset the password of an IAM user if the user has forgotten the password and no email address or mobile number has been bound to the user.To ", "doc_type":"usermanual", "kw":"Changing the Login Password of an IAM User,IAM Users,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Changing the Login Password of an IAM User", "githuburl":"" }, { "uri":"en-us_topic_0080335069.html", + "node_id":"en-us_topic_0080335069.xml", "product_code":"iam", "code":"21", "des":"You can modify user permissions using either of the following methods:Change the user groups to which a user belongs on the Modify User page. Choose this method if you wa", "doc_type":"usermanual", "kw":"Modifying User Permissions,IAM Users,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Modifying User Permissions", "githuburl":"" }, { "uri":"en-us_topic_0079497018.html", + "node_id":"en-us_topic_0079497018.xml", "product_code":"iam", "code":"22", "des":"Resources in different projects or regions are isolated. You can access resources only in the projects or regions for which you have been granted permissions. If you do n", "doc_type":"usermanual", "kw":"Switching Projects or Regions,IAM Users,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Switching Projects or Regions", "githuburl":"" }, { "uri":"iam_01_0655.html", + "node_id":"iam_01_0655.xml", "product_code":"iam", "code":"23", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"User Groups and Authorization", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"User Groups and Authorization", "githuburl":"" }, { "uri":"en-us_topic_0046611269.html", + "node_id":"en-us_topic_0046611269.xml", "product_code":"iam", "code":"24", "des":"You can plan user groups based on user responsibilities and grant the required permissions to the user groups. Users inherit permissions from the user groups to which the", "doc_type":"usermanual", "kw":"Creating a User Group and Assigning Permissions,User Groups and Authorization,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Creating a User Group and Assigning Permissions", "githuburl":"" }, { "uri":"iam_03_0002.html", + "node_id":"iam_03_0002.xml", "product_code":"iam", "code":"25", - "des":"A user inherits permissions from the groups to which the user belongs. To change the permissions of a user, add the user to a new group or remove the user from an existin", + "des":"A user inherits permissions from the groups which the user belongs to. To change the permissions of a user, add the user to a new group or remove the user from an existin", "doc_type":"usermanual", "kw":"Adding Users to or Removing Users from a User Group,User Groups and Authorization,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Adding Users to or Removing Users from a User Group", "githuburl":"" }, { "uri":"iam_01_0430.html", + "node_id":"iam_01_0430.xml", "product_code":"iam", "code":"26", "des":"To delete a user group, do the following:To delete multiple user groups at a time, do the following:", "doc_type":"usermanual", - "kw":"Deleting a User Group,User Groups and Authorization,User Guide", - "title":"Deleting a User Group", + "kw":"Deleting User Groups,User Groups and Authorization,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], + "title":"Deleting User Groups", "githuburl":"" }, { "uri":"en-us_topic_0085605493.html", + "node_id":"en-us_topic_0085605493.xml", "product_code":"iam", "code":"27", "des":"As a security administrator, you can view and modify the basic information, permissions, and users of a user group. You can modify users' permissions by changing the grou", "doc_type":"usermanual", "kw":"Viewing and Modifying User Group Information,User Groups and Authorization,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Viewing and Modifying User Group Information", "githuburl":"" }, { "uri":"iam_03_0004.html", + "node_id":"iam_03_0004.xml", "product_code":"iam", "code":"28", "des":"To revoke a policy or role attached to a user group, do the following:To revoke multiple policies or roles attached to a user group, do as follows:", "doc_type":"usermanual", "kw":"Revoking Permissions of a User Group,User Groups and Authorization,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Revoking Permissions of a User Group", "githuburl":"" }, { "uri":"iam_01_0657.html", + "node_id":"iam_01_0657.xml", "product_code":"iam", "code":"29", "des":"Cloud services interwork with each other. Roles of some services take effect only if they are assigned along with roles of other services.For example, the DNS Administrat", "doc_type":"usermanual", "kw":"Assigning Dependency Roles,User Groups and Authorization,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Assigning Dependency Roles", "githuburl":"" }, { "uri":"iam_01_0015.html", + "node_id":"iam_01_0015.xml", "product_code":"iam", "code":"30", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Permissions", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Permissions", "githuburl":"" }, { "uri":"iam_01_019.html", + "node_id":"iam_01_019.xml", "product_code":"iam", "code":"31", "des":"By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users ", "doc_type":"usermanual", "kw":"Basic Concepts,Permissions,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Basic Concepts", "githuburl":"" }, { "uri":"iam_01_0601.html", + "node_id":"iam_01_0601.xml", "product_code":"iam", "code":"32", "des":"Roles are a type of coarse-grained authorization mechanism that defines service-level permissions based on user responsibilities. IAM provides a limited number of roles f", "doc_type":"usermanual", "kw":"Roles,Permissions,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Roles", "githuburl":"" }, { "uri":"iam_01_0017.html", + "node_id":"iam_01_0017.xml", "product_code":"iam", "code":"33", "des":"A fine-grained policy consists of the policy version (the Version field) and statement (the Statement field).Version: Distinguishes between role-based access control (RBA", "doc_type":"usermanual", "kw":"Policy Syntax,Permissions,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Policy Syntax", "githuburl":"" }, { "uri":"iam_01_0016.html", + "node_id":"iam_01_0016.xml", "product_code":"iam", "code":"34", - "des":"You can create custom policies to supplement system-defined policies and implement more refined access control.Global services: Select this option if the services to whic", + "des":"You can create custom policies to supplement system-defined policies and implement more refined access control.Select Allow or Deny.Select a cloud service.Only one cloud ", "doc_type":"usermanual", "kw":"Creating a Custom Policy,Permissions,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Creating a Custom Policy", "githuburl":"" }, { "uri":"iam_01_0600.html", + "node_id":"iam_01_0600.xml", "product_code":"iam", "code":"35", "des":"Use the following method to assign permissions of the FullAccess policy to a user but also forbid the user from accessing CTS. Create a custom policy for denying access t", "doc_type":"usermanual", "kw":"Custom Policy Use Cases,Permissions,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Custom Policy Use Cases", "githuburl":"" }, { "uri":"en-us_topic_0046611308.html", + "node_id":"en-us_topic_0046611308.xml", "product_code":"iam", "code":"36", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Security Settings", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Security Settings", "githuburl":"" }, { "uri":"iam_07_0001.html", + "node_id":"iam_07_0001.xml", "product_code":"iam", "code":"37", "des":"You can configure the account settings, critical operation protection, login authentication policy, password policy, and access control list (ACL) on the Security Setting", "doc_type":"usermanual", "kw":"Security Settings Overview,Security Settings,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Security Settings Overview", "githuburl":"" }, { "uri":"iam_01_0703.html", + "node_id":"iam_01_0703.xml", "product_code":"iam", "code":"38", "des":"As an account administrator, both you and your IAM users can manage basic information on this page.A mobile number or an email address can be bound only to one account or", "doc_type":"usermanual", "kw":"Basic Information,Security Settings,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Basic Information", "githuburl":"" }, { "uri":"iam_01_0029.html", + "node_id":"iam_01_0029.xml", "product_code":"iam", "code":"39", "des":"Only an administrator can configure critical operation protection, and IAM users can only view the configurations. If an IAM user needs to modify the configurations, the ", "doc_type":"usermanual", "kw":"Critical Operation Protection,Security Settings,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Critical Operation Protection", "githuburl":"" }, { "uri":"iam_01_0704.html", + "node_id":"iam_01_0704.xml", "product_code":"iam", "code":"40", - "des":"The Login Authentication Policy tab of the Security Settings page provides the Session Timeout, Account Lockout, Recent Login Information, Recent Login Information, and C", + "des":"The Login Authentication Policy tab of the Security Settings page provides the Session Timeout, Account Lockout, Account Disabling, Recent Login Information, and Custom I", "doc_type":"usermanual", "kw":"Login Authentication Policy,Security Settings,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Login Authentication Policy", "githuburl":"" }, { "uri":"iam_01_0607.html", + "node_id":"iam_01_0607.xml", "product_code":"iam", "code":"41", "des":"The Password Policy tab of the Security Settings page provides the Password Composition & Reuse, Password Expiration, and Minimum Password Age settings.Only the administr", "doc_type":"usermanual", "kw":"Password Policy,Security Settings,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Password Policy", "githuburl":"" }, { "uri":"iam_07_0003.html", + "node_id":"iam_07_0003.xml", "product_code":"iam", "code":"42", "des":"The ACL tab of the Security Settings page provides the IP Address Ranges, IPv4 CIDR Blocks, and VPC Endpoints settings for allowing user access only from specified IP add", "doc_type":"usermanual", "kw":"ACL,Security Settings,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"ACL", "githuburl":"" }, { "uri":"en-us_topic_0066738518.html", + "node_id":"en-us_topic_0066738518.xml", "product_code":"iam", "code":"43", "des":"Projects are used to group and isolate OpenStack resources, including compute, storage, and network resources. A project can be a department or a project team. Resources ", "doc_type":"usermanual", "kw":"Projects,User Guide,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Projects", "githuburl":"" }, { "uri":"en-us_topic_0079496986.html", + "node_id":"en-us_topic_0079496986.xml", "product_code":"iam", "code":"44", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Agencies", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Agencies", "githuburl":"" }, { "uri":"iam_01_0054.html", + "node_id":"iam_01_0054.xml", "product_code":"iam", "code":"45", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Account Delegation", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Account Delegation", "githuburl":"" }, { "uri":"iam_06_0001.html", + "node_id":"iam_06_0001.xml", "product_code":"iam", "code":"46", "des":"The agency function enables you to delegate another account to implement O&M on your resources based on assigned permissions.You can delegate resource access only to acco", "doc_type":"usermanual", "kw":"Delegating Resource Access to Another Account,Account Delegation,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Delegating Resource Access to Another Account", "githuburl":"" }, { "uri":"en-us_topic_0046613147.html", + "node_id":"en-us_topic_0046613147.xml", "product_code":"iam", "code":"47", "des":"By creating an agency, you can share your resources with another account, or delegate an individual or team to manage your resources. You do not need to share your securi", "doc_type":"usermanual", "kw":"Creating an Agency (by a Delegating Party),Account Delegation,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Creating an Agency (by a Delegating Party)", "githuburl":"" }, { "uri":"iam_01_0063.html", + "node_id":"iam_01_0063.xml", "product_code":"iam", "code":"48", "des":"When a trust relationship is established between your account and another account, you become a delegated party. By default, only your account and the members of the admi", "doc_type":"usermanual", "kw":"(Optional) Assigning Permissions to an IAM User (by a Delegated Party),Account Delegation,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"(Optional) Assigning Permissions to an IAM User (by a Delegated Party)", "githuburl":"" }, { "uri":"en-us_topic_0046613148.html", + "node_id":"en-us_topic_0046613148.xml", "product_code":"iam", "code":"49", - "des":"When an account establishes a trust relationship with your account, you become a delegated party. You and all the users you have authorized can switch to the delegating a", + "des":"When an account establishes a trust relationship with your account, you become a delegated party. The IAM users that are granted agency permissions can switch to the dele", "doc_type":"usermanual", "kw":"Switching Roles (by a Delegated Party),Account Delegation,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Switching Roles (by a Delegated Party)", "githuburl":"" }, { "uri":"iam_06_0004.html", + "node_id":"iam_06_0004.xml", "product_code":"iam", "code":"50", "des":"Services on the cloud platform interwork with each other, and some cloud services are dependent on other services. To delegate a cloud service to access other services an", "doc_type":"usermanual", - "kw":"Cloud Service Delegation,Agencies,User Guide", - "title":"Cloud Service Delegation", + "kw":"Cloud Service Agency,Agencies,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], + "title":"Cloud Service Agency", "githuburl":"" }, { "uri":"iam_01_0730.html", + "node_id":"iam_01_0730.xml", "product_code":"iam", "code":"51", "des":"To modify the permissions, validity period, and description of an agency, click Modify in the row containing the agency you want to modify.You can change the cloud servic", "doc_type":"usermanual", "kw":"Deleting or Modifying Agencies,Agencies,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Deleting or Modifying Agencies", "githuburl":"" }, { "uri":"en-us_topic_0059870089.html", + "node_id":"en-us_topic_0059870089.xml", "product_code":"iam", "code":"52", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Identity Providers", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Identity Providers", "githuburl":"" }, { "uri":"en-us_topic_0079620341.html", + "node_id":"en-us_topic_0079620341.xml", "product_code":"iam", "code":"53", "des":"The cloud platform provides identity federation based on Security Assertion Markup Language (SAML) or OpenID Connect. This function allows users in your enterprise manage", "doc_type":"usermanual", "kw":"identity federation,Introduction,Identity Providers,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Introduction", "githuburl":"" }, { "uri":"iam_08_0251.html", + "node_id":"iam_08_0251.xml", "product_code":"iam", "code":"54", "des":"IAM supports two SSO types: virtual user SSO and IAM user SSO. This section describes the two SSO types and their differences, helping you to choose an appropriate type f", "doc_type":"usermanual", "kw":"Application Scenarios of Virtual User SSO and IAM User SSO,Identity Providers,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Application Scenarios of Virtual User SSO and IAM User SSO", "githuburl":"" }, { "uri":"iam_08_0002.html", + "node_id":"iam_08_0002.xml", "product_code":"iam", "code":"55", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Virtual User SSO via SAML", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Virtual User SSO via SAML", "githuburl":"" }, { "uri":"iam_08_0021.html", + "node_id":"iam_08_0021.xml", "product_code":"iam", "code":"56", "des":"The cloud platform supports identity federation with Security Assertion Markup Language (SAML), which is an open standard that many identity providers (IdPs) use. During ", "doc_type":"usermanual", "kw":"Overview of Virtual User SSO via SAML,Virtual User SSO via SAML,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Overview of Virtual User SSO via SAML", "githuburl":"" }, { "uri":"iam_08_0003.html", + "node_id":"iam_08_0003.xml", "product_code":"iam", "code":"57", "des":"To establish a trust relationship between an enterprise IdP and the cloud platform, upload the metadata file of the cloud platform to the enterprise IdP, and then create ", "doc_type":"usermanual", "kw":"Step 1: Create an IdP Entity,Virtual User SSO via SAML,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Step 1: Create an IdP Entity", "githuburl":"" }, { "uri":"iam_08_0252.html", + "node_id":"iam_08_0252.xml", "product_code":"iam", "code":"58", "des":"You can configure parameters in the enterprise IdP to determine what information will be sent to the cloud platform. The cloud platform authenticates the federated identi", "doc_type":"usermanual", "kw":"Step 2: Configure the Enterprise IdP,Virtual User SSO via SAML,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Step 2: Configure the Enterprise IdP", "githuburl":"" }, { "uri":"iam_08_0004.html", + "node_id":"iam_08_0004.xml", "product_code":"iam", "code":"59", "des":"After an enterprise IdP user logs in to the cloud platform, the cloud platform authenticates the identity and assigns permissions to the user based on the identity conver", "doc_type":"usermanual", "kw":"Step 3: Configure Identity Conversion Rules,Virtual User SSO via SAML,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Step 3: Configure Identity Conversion Rules", "githuburl":"" }, { "uri":"iam_08_0025.html", + "node_id":"iam_08_0025.xml", "product_code":"iam", "code":"60", "des":"Federated users can initiate a login from the IdP or SP.Initiating a login from an IdP, for example, Microsoft Active Directory Federation Services (AD FS) or Shibboleth.", "doc_type":"usermanual", "kw":"Step 4: Verify the Federated Login,Virtual User SSO via SAML,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Step 4: Verify the Federated Login", "githuburl":"" }, { "uri":"iam_08_0005.html", + "node_id":"iam_08_0005.xml", "product_code":"iam", "code":"61", "des":"Configure a federated login entry in the enterprise IdP so that enterprise users can use the login link to access the cloud platform.An IdP entity has been created on the", "doc_type":"usermanual", "kw":"(Optional) Step 5: Configure a Federated Login Entry in the Enterprise IdP,Virtual User SSO via SAML", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"(Optional) Step 5: Configure a Federated Login Entry in the Enterprise IdP", "githuburl":"" }, { "uri":"iam_08_0253.html", + "node_id":"iam_08_0253.xml", "product_code":"iam", "code":"62", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"IAM User SSO via SAML", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"IAM User SSO via SAML", "githuburl":"" }, { "uri":"iam_08_0254.html", + "node_id":"iam_08_0254.xml", "product_code":"iam", "code":"63", "des":"The cloud platform supports identity federation with Security Assertion Markup Language (SAML), which is an open standard that many identity providers (IdPs) use. During ", "doc_type":"usermanual", "kw":"Overview of IAM User SSO via SAML,IAM User SSO via SAML,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Overview of IAM User SSO via SAML", "githuburl":"" }, { "uri":"iam_08_0255.html", + "node_id":"iam_08_0255.xml", "product_code":"iam", "code":"64", "des":"To establish a trust relationship between an enterprise IdP and the cloud platform, upload the metadata file of the cloud platform to the enterprise IdP, and then create ", "doc_type":"usermanual", "kw":"Step 1: Create an IdP Entity,IAM User SSO via SAML,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Step 1: Create an IdP Entity", "githuburl":"" }, { "uri":"iam_08_0256.html", + "node_id":"iam_08_0256.xml", "product_code":"iam", "code":"65", "des":"You can configure parameters in the enterprise IdP to determine what information will be sent to the cloud platform. The cloud platform authenticates the federated identi", "doc_type":"usermanual", "kw":"Step 2: Configure the Enterprise IdP,IAM User SSO via SAML,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Step 2: Configure the Enterprise IdP", "githuburl":"" }, { "uri":"iam_08_0257.html", + "node_id":"iam_08_0257.xml", "product_code":"iam", "code":"66", "des":"For the IAM user SSO type, you must configure an external identity ID for the IAM user which the federated user maps to on the cloud platform. The external identity ID mu", "doc_type":"usermanual", "kw":"Step 3: Configure an External Identity ID,IAM User SSO via SAML,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Step 3: Configure an External Identity ID", "githuburl":"" }, { "uri":"iam_08_0258.html", + "node_id":"iam_08_0258.xml", "product_code":"iam", "code":"67", "des":"Federated users can initiate a login from the IdP or SP.Initiating a login from an IdP, for example, Microsoft Active Directory Federation Services (AD FS) or Shibboleth.", "doc_type":"usermanual", "kw":"Step 4: Verify the Federated Login,IAM User SSO via SAML,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Step 4: Verify the Federated Login", "githuburl":"" }, { "uri":"iam_08_0259.html", + "node_id":"iam_08_0259.xml", "product_code":"iam", "code":"68", "des":"Configure a federated login entry in the enterprise IdP so that enterprise users can use the login link to access the cloud platform.An IdP entity has been created on the", "doc_type":"usermanual", "kw":"(Optional) Step 5: Configure a Federated Login Entry in the Enterprise IdP,IAM User SSO via SAML,Use", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"(Optional) Step 5: Configure a Federated Login Entry in the Enterprise IdP", "githuburl":"" }, { "uri":"iam_08_0022.html", + "node_id":"iam_08_0022.xml", "product_code":"iam", "code":"69", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Virtual User SSO via OpenID Connect", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Virtual User SSO via OpenID Connect", "githuburl":"" }, { "uri":"iam_08_0010.html", + "node_id":"iam_08_0010.xml", "product_code":"iam", "code":"70", "des":"This section describes how to configure identity federation and how identity federation works.The following describes how to configure your enterprise IdP and the cloud p", "doc_type":"usermanual", "kw":"Overview of Virtual User SSO via OpenID Connect,Virtual User SSO via OpenID Connect,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Overview of Virtual User SSO via OpenID Connect", "githuburl":"" }, { "uri":"iam_08_0009.html", + "node_id":"iam_08_0009.xml", "product_code":"iam", "code":"71", "des":"To establish a trust relationship between an enterprise IdP and the cloud platform, set the user redirect URLs and create OAuth 2.0 credentials in the enterprise IdP. On ", "doc_type":"usermanual", "kw":"Step 1: Create an IdP Entity,Virtual User SSO via OpenID Connect,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Step 1: Create an IdP Entity", "githuburl":"" }, { "uri":"iam_08_0008.html", + "node_id":"iam_08_0008.xml", "product_code":"iam", "code":"72", "des":"Federated users are named FederationUser by default in the cloud platform. These users can only log in to the cloud platform and they do not have any other permissions. Y", "doc_type":"usermanual", "kw":"Step 2: Configure Identity Conversion Rules,Virtual User SSO via OpenID Connect,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Step 2: Configure Identity Conversion Rules", "githuburl":"" }, { "uri":"iam_08_0007.html", + "node_id":"iam_08_0007.xml", "product_code":"iam", "code":"73", "des":"Configure a federated login entry in the enterprise IdP so that enterprise users can use the login link to access the cloud platform.An IdP entity has been created on the", "doc_type":"usermanual", "kw":"(Optional) Step 3: Configure Login Link in the Enterprise Management System,Virtual User SSO via Ope", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"(Optional) Step 3: Configure Login Link in the Enterprise Management System", "githuburl":"" }, { "uri":"en-us_topic_0079620340.html", + "node_id":"en-us_topic_0079620340.xml", "product_code":"iam", "code":"74", "des":"An identity conversion rule is a JSON object which can be modified. The following is an example JSON object:[ \n { \n \"remote\": [ \n { \n ", "doc_type":"usermanual", "kw":"Syntax of Identity Conversion Rules,Identity Providers,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Syntax of Identity Conversion Rules", "githuburl":"" }, { "uri":"iam_10_0002.html", + "node_id":"iam_10_0002.xml", "product_code":"iam", "code":"75", "des":"MFA authentication provides an additional layer of protection on top of the username and password. If you enable MFA authentication, users need to enter the username and ", "doc_type":"usermanual", "kw":"MFA Authentication and Virtual MFA Device,User Guide,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"MFA Authentication and Virtual MFA Device", "githuburl":"" }, { "uri":"iam_01_0011.html", + "node_id":"iam_01_0011.xml", "product_code":"iam", "code":"76", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Auditing", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Auditing", "githuburl":"" }, { "uri":"iam_01_0012.html", + "node_id":"iam_01_0012.xml", "product_code":"iam", "code":"77", "des":"Table 1 lists Identity and Access Management (IAM) operations that can be recorded by Cloud Trace Service (CTS).", "doc_type":"usermanual", "kw":"IAM Operations That Can Be Recorded by CTS,Auditing,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"IAM Operations That Can Be Recorded by CTS", "githuburl":"" }, { "uri":"iam_01_0013.html", + "node_id":"iam_01_0013.xml", "product_code":"iam", "code":"78", "des":"After you enable CTS, it records key operations performed on IAM. You can view the operation records of the last 7 days on the CTS console.The following filters are avail", "doc_type":"usermanual", "kw":"Viewing Audit Logs,Auditing,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Viewing Audit Logs", "githuburl":"" }, { "uri":"iam_01_0000.html", + "node_id":"iam_01_0000.xml", "product_code":"iam", "code":"79", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"FAQs", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"FAQs", "githuburl":"" }, { "uri":"iam_01_0002.html", + "node_id":"iam_01_0002.xml", "product_code":"iam", "code":"80", "des":"For account security purposes, you are advised to enable login authentication. After this function is enabled, users need to enter an SMS, MFA, or email verification code", "doc_type":"usermanual", "kw":"How Do I Enable Login Authentication?,FAQs,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"How Do I Enable Login Authentication?", "githuburl":"" }, { "uri":"iam_01_0003.html", + "node_id":"iam_01_0003.xml", "product_code":"iam", "code":"81", "des":"MFA authentication provides an additional layer of protection on top of the username and password. If MFA–based login authentication is enabled, you will need to enter a ", "doc_type":"usermanual", "kw":"How Do I Bind a Virtual MFA Device?,FAQs,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"How Do I Bind a Virtual MFA Device?", "githuburl":"" }, { "uri":"iam_01_0001.html", + "node_id":"iam_01_0001.xml", "product_code":"iam", "code":"82", "des":"After MFA–based login authentication is enabled, you need to enter an MFA verification code in addition to the username and password when logging in to the console. Open ", "doc_type":"usermanual", "kw":"How Do I Obtain MFA Verification Codes?,FAQs,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"How Do I Obtain MFA Verification Codes?", "githuburl":"" }, { "uri":"iam_01_0004.html", + "node_id":"iam_01_0004.xml", "product_code":"iam", "code":"83", "des":"You can unbind the virtual MFA device as long as the mobile phone used to bind the MFA device is available and the MFA application is still installed on the phone.On the ", "doc_type":"usermanual", "kw":"How Do I Unbind a Virtual MFA Device?,FAQs,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"How Do I Unbind a Virtual MFA Device?", "githuburl":"" }, { "uri":"en-us_topic_0046611300.html", + "node_id":"en-us_topic_0046611300.xml", "product_code":"iam", "code":"84", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Change History,User Guide", + "search_title":"", + "metedata":[ + { + "prodname":"iam", + "documenttype":"usermanual" + } + ], "title":"Change History", "githuburl":"" } diff --git a/docs/iam/umn/CLASS.TXT.json b/docs/iam/umn/CLASS.TXT.json index 129937d4..a0bdfb22 100644 --- a/docs/iam/umn/CLASS.TXT.json +++ b/docs/iam/umn/CLASS.TXT.json @@ -135,7 +135,7 @@ "code":"15" }, { - "desc":"IAM users created without being added to any groups do not have permissions. You can assign permissions to these IAM users on the IAM console. After authorization, the us", + "desc":"IAM users created without being added to any groups do not have permissions. You can assign permissions to these IAM users on the IAM console. Then the users can use clou", "product_code":"iam", "title":"Assigning Permissions to an IAM User", "uri":"en-us_topic_0079496985.html", @@ -216,7 +216,7 @@ "code":"24" }, { - "desc":"A user inherits permissions from the groups to which the user belongs. To change the permissions of a user, add the user to a new group or remove the user from an existin", + "desc":"A user inherits permissions from the groups which the user belongs to. To change the permissions of a user, add the user to a new group or remove the user from an existin", "product_code":"iam", "title":"Adding Users to or Removing Users from a User Group", "uri":"iam_03_0002.html", @@ -227,7 +227,7 @@ { "desc":"To delete a user group, do the following:To delete multiple user groups at a time, do the following:", "product_code":"iam", - "title":"Deleting a User Group", + "title":"Deleting User Groups", "uri":"iam_01_0430.html", "doc_type":"usermanual", "p_code":"23", @@ -297,7 +297,7 @@ "code":"33" }, { - "desc":"You can create custom policies to supplement system-defined policies and implement more refined access control.Global services: Select this option if the services to whic", + "desc":"You can create custom policies to supplement system-defined policies and implement more refined access control.Select Allow or Deny.Select a cloud service.Only one cloud ", "product_code":"iam", "title":"Creating a Custom Policy", "uri":"iam_01_0016.html", @@ -351,7 +351,7 @@ "code":"39" }, { - "desc":"The Login Authentication Policy tab of the Security Settings page provides the Session Timeout, Account Lockout, Recent Login Information, Recent Login Information, and C", + "desc":"The Login Authentication Policy tab of the Security Settings page provides the Session Timeout, Account Lockout, Account Disabling, Recent Login Information, and Custom I", "product_code":"iam", "title":"Login Authentication Policy", "uri":"iam_01_0704.html", @@ -432,7 +432,7 @@ "code":"48" }, { - "desc":"When an account establishes a trust relationship with your account, you become a delegated party. You and all the users you have authorized can switch to the delegating a", + "desc":"When an account establishes a trust relationship with your account, you become a delegated party. The IAM users that are granted agency permissions can switch to the dele", "product_code":"iam", "title":"Switching Roles (by a Delegated Party)", "uri":"en-us_topic_0046613148.html", @@ -443,7 +443,7 @@ { "desc":"Services on the cloud platform interwork with each other, and some cloud services are dependent on other services. To delegate a cloud service to access other services an", "product_code":"iam", - "title":"Cloud Service Delegation", + "title":"Cloud Service Agency", "uri":"iam_06_0004.html", "doc_type":"usermanual", "p_code":"44", diff --git a/docs/iam/umn/en-us_image_0289500726.png b/docs/iam/umn/en-us_image_0289500726.png deleted file mode 100644 index f20088ed1dfd0951bb958ec67f9d4c092d37ae2a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 16748 zcmc(`cT`h*w=NuYqg&jFTPa%*upt->SSZp3MFgamNEemfqy(gdD2fUQC=gJPVvrh= z(2_uaL{UIMKx!Z)pdd9QbOHp(UAW)(eD{3k-f`Y@?j7U)!B``UwbrlC`OIfNGuF&R zUw~hX9|Qsk7~HsK0Rrs-gFw4rzwZU^>`RpV3S4#tS?KG6upP&yfgiuQ>lo{RK;=mX zHeL9D-}~?1unhu%4u0PG+l7=nC=LSY>@v8fWA(s^#n>Nd)yHUBKs?wDxLw2$Ez{sZU`$gn3-Lfz*_ zLrhv)W@c^5%iX}e<3jv$p6aI-F7G_>+oJ-Zo$JRFMLU<@59;g;&E|@?vrOP z)@et+KX9fnhXyA`SOh=bq6~*qO|*(L@!mZb7=%t0K zsgBIA4D4S(@1uT7(!`H2voD2`v%;KkjNue1KUNUVx1}YvP+rS7bAoyb_|p9%Ieadv zl>}ym(pRoHRJ18kMU;)!bQR zE{bhFcaZzdnkF?HTG)qmycE?qTS#>tZ)lTK(DIWBX3n%ma>|A&b?pMhjzy6~S%I05 z{BfBj$eAcH0dk`oi?$NN5}<^OPS*N4OCQVq8CZWy_x zImr5!2ZOd3Id`^{HC?|4=zyzv@o&P`-PX3+1aEim!!gKv{E)}n7ta4_k({tOE2nZ} z?79H`u2(t)LTqk?%7E8OHqmIL;K}R>^Bb~pY42R6c`?TA>BqpUO|z;&zTH1P<#YQm zmg@2h6|G3&m0{ovJ*+6Pif)aLi63*1Foi&7uEU1>5iTPpZ`ixP2+C`8o=MpHf@H$N z;NOO@7jg17GhRrIggGZ=#I~;J3#aWN5QpRu#h3rJ^{C%b^35gBDC0ty7ejC1-A7`G zhnaVR!@$@v@1X)@1Q{2%^p6I6+2(_yC8<)3;=3AdtAj;dY;)mNc}7Qv=w6X?4);{; z38X9YE%Pd@SKFbrt@Q;4elfBy1TUjpy|gf&h+k)o1{OIO*?TP9Xk92UOSz?BWNtSq ztY>ZTQKeU(n0;l4FPWoTP^u70nD**67*bk7#ptM~>vfWh0uCnZ!r9q%$wBNzwpI^Q^ zHA}BFDF<7Fft#(#v$GK8(XmdCZ_l{*VVYSAdVxrA#D2FfCNhu17-`jh&d#FtG@KKb%N zMzUB5^?(*>T?f_&qgSK|#Y_98uR;lm-0y+H3C-jQYGCTEJrq^c5F>+a_!u|vMi z4ScIPN!nEqxId9KM{!rTITtT;E;~_zHaJyneRYE#ZkdV*Ast%yaMhF)sOi?e)qynV zIg>!ov%=Z*dG(dLym@m}{^gDKj6RIsQUO-!Cux{Sx<9JqN&jYt_egt99ty~UoXSh? zL)#D4lY^)ERq7{}mJ%gY2J3h5TkidQajWhg%xGi!EjP-x&2$Dc?|a3k?u!@CEny=d zOC7b4ttt71Ct=A~ujtqjJZ9|ldoxg1P=0pe%6=69Lc7I_BG%gcDUea1w{&K~LC;cD z9yV@~YmUA_mDg{?33b-EkK>!xegIDEPs)yW&poe0&#MUPxjv-jQzWsvC7EV}PTO+- z%w4aImNvg_#yL9zGh$Ts>Y~yP!B)DzjZY=Yzn0CFrCVVv8nrgpf`9?QIB$FgrkdjO z0`fLOEI4<42N#ikj*WfQ0eh$oDUqf(7ZuWeZMa+0`;Y+A zUFo>K2rUB+_`+WgE3WepE4;q|By#cv zB`@Wb$eg6rYq;{t6KftE{I;#C|8M*hY z7oR%=e$PZIbry7fsi4y(0`@rBN4X*OjNFqoTZK{v){L$_o|S!_2bl7 zvZHGXIZHA<_3fl{Bm-NwN{u}cRzE(N>RCx2e#2vy6XmzUU zQNUpYdMAR^m3?1oSKsd>w)VV!brBTd_F+qTGtYeA=|e~*e!-(iupNNA#pgn1yF$#9 zDobtJ#rzx~$H{m-$jRc~4V2Aa^;*FL&9M(J1+CV7j1o9E7fBIy?AVqiq6QOH!FhYyPyV!5J#ro1?w_ z#Q2SJj}ziZ&OWI}Qt7?Dw)!GL>yxtP)PZbl9lXf-}U+r%Ti1ivj z5#dW=4H4~=mQ09E3F6fcU%h$tV>q)_X>KjnlCiC|@Z_$~rzT_h>Y~We_n!Sfo`-}) z3PnzII8P-uCr+)|6u+JbaB%6fq}3$HU*Eq`}-$A6?jGMesAVCSJ23u*K9 zRkD;dS?NoG@nFb2Qac?3E%uJqB6mz1H@!Txe$;+tK{E`GMzldRAmtqr?Ml!%Yd9zC#4oYI}8yUk2ZS z^noVXP0x(wo@Fm}Xf-BYu7hca-k+M}dm z*@!jm(nWAhe{`c!S`C%I2j6Di{|-JB*&|xD6~1-bh@FuST5S2!6)SIB>{!;zVwPSq z353|oK`{ZYKu8#HqDe60jBUQ5FhgS-7LyG|$~EIe&cQMZOmeaY&iE1ZZG*-HwBvHd z4J3fQ>w2!JsM`tW$9mus>LqN>d~SD2=tdN^Fo$Vpg|QQ+(%z-<3uIhJPB#=a-VO>O zc%L|gN3Gc;?kUb?K~*XqW5Oz%`j=2a4$sZnn%)%Vy#8GnlDAcm`%>&+uNcbDcLq%K zSvM3NR-BSd{dqsnQ^>0qcC**|W?Ng4RSQzVxm;}leW!&(eD9ZHm%XW+73IZw0M7Nf z;iq%9Cb|>;dWgE8=jR|5wONztv_t}x zy_*N+e)v`qW=VBDSHtWZ2uK-oU-x9RK}&;$gN<=84|QulLXY*pN(P~)XQ_Ak0B!qQ zk$wMuhFUG#uGUVGOi0wPg3UoOGJR-k7=x@>ggjewAibc)TgQ$)(WmuoF*ql_)&1++ zyL0gQ;!Hx%E0*K@54Z4RaUEJq_d<7FO9DddP*3$fm68`-3V{jFA3rPN(?vR1Z}1k^ zM(A5oE#qFuYR)!=mYm;)319K*Cw8`DcVj$PNR+wLNZn8IxVk@+#$i;__=GrJ7y&Wm z)O$pk517e4e;d(%cD09z`$E)YjkSj3q*m`IC24O3TD`*^_U(!L9GIWWQrOSW=LH9u zg)9J`$t*jyCD)?=Z0{75!X}SVFmCNL0n?B4`1Z+i|8|9I>i?u%&hpK4ZN|Ad4=2A%|*hO4`OY%?fTX@iI6H3RD;x+#GSyz{^DgJB2_5zxb{68|83ru2b! zK>w+)*zuPC_o$%%ztaRbfQ#nfGKf(-PurRL^<<$8aF zcTR+_k%`HsS4-DL{A?R;#@CyQHLVN9P>yrCWT1l&uj&*NiZ%i6V4(D@bG1wNK+^0! z(QJ1?&5ifyZ&I>amtU;A)g>HV$+jm-iUMIUb$Fh+hs18s(42P_y$yT;^mBg!6FUC& zruy{fF&`k9SB~hQS6BV4SD(EquI*BxIWT8}cC0Os>lw>M{1Ng}Km1nj}AStZ|}N`)3(s5zF9!H32<2^E!9*>b3L^ecBJ-q0jk^ zd2#CrDhw~t)yvKJ>vY73RB5Ng)?wig1@|@^Y9m^2$t}%R^^`orab~es>84|2^3~|l zTjj0zL=X5}ojRSIb&t;)Rm=1`c|Q^S%IzIyhA)E5S~rb#Bvv!NxoKcuk7N}N95>ow)FJ%WoFm32X2??5_b$0iZTt-o^`NCVG}JOU5~cEd+>0 zZoZ_2fA=4NiWVt(9}ql-u~SOQ880+MFx2!$hLY)|3Q8QmdgFfG?WV1t=hr@4D$Mpv z9|ZdKyYV3%yI;T{}pw5#h*ExezQQ|O4H(V};k#{mC=Hx-d~%wza9&QnK6<=kAnbJcY9H z^Z-9!S6!#()^qO!^D8xD*nJKMbak{B&}Pdwc(n|;gdMhkny1^>Hb#xvc_P2N*jHwyb7;Hwx9dHsZ9A4$#j7QM{p?8l6tzb5^g; z?SFIhXb3~8zBH)tAi-~I?-0SaR*qWTYDBu|WMOq;ZU;#L;ch_7BNgv{2X(Bs40pT} z;c(~CZU6PLlbMyoYJG}=keX3kL+s{;D7D5lY26Lg&hvXE2b`%Zm%Br*k52AOzDpu+74 z$|X9%pO=JB1mjDlRyRM^DF4j*vwyniluv8#8$Vlt8LIIMZ$^a*bA7Ex!I%EzEcRxb z;c!$}#C+Qk<1u0$^MbxKVTHlbE96~|-KVv}ZR$)vc0G9{#hIt=BsIGFF2||L z*cxpW+g}+)bQP-d4QHftJ!_>9H_4o22YK2AfX)ZrxAZU;E>D(P(zPzDgj?M*7`EX< zS9Yvr%h^|Z6#EXpWf5$fc@;(q_qpqBU1O~7?8!;>>vo}8YIu6x_Jegeu#X?!Pc@8> z!+uBWW;#6T4YIzza(THviO%%$G>=)VFSoa7kwymrO3PcZPlTGz75|YVlC)h|H*oH^UI!p z@$rus=6Y_0Zz>j7y%?*71@w3_b^@Lgjg*2o^2nKyJI9$SK2?88A=tZLPq6M^v*(@{ zGcDj?TI>5q$d2CP7lWT%^3h9^)$58=HLcg$%r1AA+e$+0Pv~(uC35l|p^34&anT97aeLcq zz4|iNtby(P1Z5Q+2ab;kKsL`p`pIx{6|CH*u$*-;(r;m@A8@0Z*jwc^Wj$oOGRD3- zKzk(nrw^lcrMJ|a;YBTVc|086=@nBcw@tv z4bPnmC!ns}cg@+xRYF47KIXc{1B}z{50(njc0Sj1jE1oMHM_eql$fJXRPNyzdEdu` zLEP0Pu!GRGp~Cy)9M|Cxek(`v=cWtO7?Ns{#VBP0a4b9ABpeJ;M@0xa6f6P&Xhd3OTgq>Z4 zi0(nfVM!9wmQ#NnLZanfVK=yjW#FGEk-zHw`3~@+`t0&tOZ4*2d!1No8$$&BFz6{s zc54oKM*JLImqO6)f zIm$hn+neuqZ6@TsNJ6xthZ(g*54ljYBvQT5Kr+qmZeNY4l*Cub-jcmtghI0|_{{Yj z9gC_oMgVJ5PBKnd4@cR%2b!4`{Rz_t$L($|Zw?ORye)MkYRR|PE;ul|Lp+bRV62tA zZ9?ZfH$T_)i}A_vB>7RSQmgVicbsR;$BrIF(jU0+)0FXI>;0LdsdKRnPjXBjXU`dZ z_@-sXOsf9=m&BK3LbKQH5nflYW zTbZf34$s?S0I?W@bO04t&rXWZanhc1cnur}22F@&h2`FhWLmh4XA8chP3Re=HRgvc zO=ll%FVyL@tR0rNH0soLLPQYF3bs<5M^oo5xb0_+bED9!>5`4upj3H_fZ zXMb@~f*A>eH4B$=*GixUlXM-k%QCxigBMgI=RKUIe5(E%>EVz2ki|W2x8^ea%AwmA zWaV2b0aphlxO}>+uq5iX(q+j@ zPzAHCD=WVVLHKK2#F0n5(KcJkVt7xhbQt_{vl0&1`#^LgsRUC60ZpZ028 z_%<91PV*hAs>o3C8b~qK_Pi4N#!bY+2{*)}YIkJjI`KDj99QrnYsY`#**8S~F(~3*}T};r8W>cx- zfcIk_`%6q>4nbZmXwRX1$P%onsfi6EA65SdexKjirr8ajZ|}(PmV;tDLbDY;>0h=v zAN3hwlb!ZimUfdeIf;Q%R%&y-yO)N!QnX3u#Pam*?F@Tz#{~-OcW6Lo%hwk-GcSck z1t*pozBT=%we}4_JFYS??cuDe#glmj5%3;nO3L%>VT`zf;l(%Qj$q`}%AniS z{Qe^ItF@dYqCL(i>ULpHNQDGr`UaEx%pP*-QcuilIb3zGbpKNU@#=Mpv&P=4hBe|U zB2oEUvy~=o#K^2`Broi>?PfA1$s||s-~%!J1&AYo4v>=e9(ssxnOA+rOZry7To6j<433NiUdxB zxEl9v#~}iSk-j+``3Q;zGDp2dl1VHq00nECuP2CI zlbH*&uX<1{K5``MGEF|~oC=S_8_3zv{HgnDd(ZJm{=FNA%o|N6pJ|l^Cr-cK5afd$ z>G2i|mW*vkY6t|(ykkwlpg2FHuf)0%KuEB$!kkr2(HooVv*{Q)xr~F)vVXFjwdJ$JH1^g)SH z+)N3-@J!p-4G7X#CG5|wtCXPZg8c+$(&{AJA|MLqxm9=~uawd(fc)-Rpp zV1xb~A$~soeWXQ9f7;e~?W^^ID~!7qg(j?Pe8e)5!wiiqdd$_KPYNne8i{sOO(CX8 zovp?6qUfSC4tVTTb#cB)vsE+UJiqq#Yp%_k`giE*7Dv+NdKT@sgsbUu+e+>o8Y)HB z&>Yv9>ofMf{9JmMXsLYf6y2WUauwD0`I!{2rfA85;;{$x#S|h^qF+)=nG3;mnm8V! zHcl8K!K90DiVUKErqb@QpsJYFTu)uGP(1{Ch>?I}sW_-YHY)Of za?#Ya1?Vwpd=k;LDU>&@6WU#LvUm?;?vegE8JXtxN*Qwg^%f{|K?c=*KQJZxv;xIw zGLLTX-c1wMXGXaXe*5EFxm6Fk;{`boSef{a6vZmmn@vqIy?HE1 zY1(T$`gD%W#;bj%lg$Y#o0q%v^nXmbt2kv|rkHEVmd)^I@=h+bZ<6Jv3r}f>_N*(I zoA!7~!iWFZ=G4mnjGKTGFTmx!qOzc3`#?VnJKJ(NWUYlQ+}s^_L5Z~eijgUfi?uJ2 zno<%V?X&KYNiSSvkno#SCqx^3n7KQZ{iZL_dfzv`{CjqZc8z!+cp@{phV6NFX4Eq* zc}FOq?V;>8+0^-P6zwFP6|_(1$J^f?c3WHId?H|l@a zBM`9crRwm6Z}&}hUzr{aTKoP^4yh8sbD zxmuR#xPJNeX9(N2@D>t`96Nlhr6{j@->oCt zeJ9%&7)YQEER4{;nBS!bA*b;TYo3Bn_SDRxPS0_A;qMk6pIxt>P1sXESLIJ$^YYP1 z(;q5=r8V({Qw1t1Lq6JMIBI2ME+Feet<2Bjl^f7$XR0Gip>$`L+j`4|;ll#SNY9p^_y z*-70$z)vg=_FHpZ>lYBHM}%cEf<``J>H8cE4&oX;1XG?(QR6FK;`&^$QEDJaUUQ)m%Mc8(rjI&Y5A#x3eE^53CKbA zkJa_;AvIb3z~$K(nv28PQFT$+>B>>`0!=fuX6sm9vn2yvmBY8x)zt+JddiZ-PqiJ_}j6)na>$Ptf}J zS_!IjIJq}*c3>E3oTc2;p|&K1elXy&%IcjaxV77sF|PIKvOwEm;<6U&kNC8u9pf&d{dc(VNhec62uqDSKV}}{SLLwK z$?V0BH>rns_+NdNP$qBw*P`pVo`K}tsJ!=hYu{@9k=j8Cc+_3$=2XRJvNItvM*V50 z)F4fJ4$dUXO7awCNJ5jY{}$Ay}Hb?5GHJ9 zhC6$!2Zr9l87aKz!1Rn2x8WWs)VT?2uHF>-{&ZZtA3Jm#NNNh1T9H z;RNd&ro?cVcdcA!PLy&J(oBf>H7A2<=ifH7!N7bPE&U z+z^h&di{*1heV684+S2sKuafWY%`)8`-@!QM1X7Uf5+-qw0o9T4;xzDO|<1gA^VEC zr`P`~rb``A2vY}WZ%^k$N&gjQU-?^%Ju9X2dM%GK@*;CqUgMl|c`GZPe_Gh#K3&AO zlW6HSq2APzOl+nI)>ESimDSC1VfI_w5T8LcO7QR*V4rXONQy_`4v5GHFjtv9VYo3A z?2Ny6h3b+Btz(LACi|x`?(Tc|yLC}{yE~qqo@~`tt*m|0E2^bwNeVKh_&FHH7v^mp z=&E0Zb(4bQTQy5=LSzIf=c(H(+ZO0US^D~Tv|mq!^59crUU^DlG0P6Reff4;1bkuf zn0mog0WJkPITW35?_;jGUGI^BKvZjtC}s$9v2;Sw+t7~b)xN0!J}11S_7D5o_wIt~ zb-v=%iewFdO8T0eLj9x2PkHh!tR#YMoT1T9$_al|+np8OS10=hd8zdJ$_zn`-{A86 za!d)<-0Nu9LTf9nukk&Q8(}}_Ep}Azf|q!wn_!iUCqES!XEGkR1QL7_zz@Wa^h}wL zsj3dqAH+`>Gwz~o+8JXRcyGo=ghM1=-MtrpSfuC<)3d?r=Bgpnzmn8-Nt!?)e68eG zs0IoHajKxhxQ6VIJbirWF+iE%?KyqOxKJU$dgI!o(aj(e7&OCOe=-^Te2B`0#SmwA7nh4^w{<{sZdfUvboGfLE2Rte`s&5e5pCKWI9 zP_{iyA^k^X1_8Fqr*8)D7w%YPo*!XKyN>K6!Mp%!IK`Ki$|C5s4gZCa3EK+CmHaLh z@ztCSmyIlP1>1fqiY^s7$*0CLiV?65!H*1k%+il)ajqHW5U}%!9Qt)Pk=)u@;_t{@tRT`FR_;*oK1D zSm*3)^tr){D_? zWVS<|3uUS9Qb<86L zs}E)EQ*&aW_-~sBn|ztVHP`5CJ6Tk1|6F<+anrB~0EDtpX)-Vk#hJxC&=0vMJIU-? zuhLc&IAw;0I+UmH=<8hRmX(PENJ#mqqLXj4v)N#>uboOLl6vB*HXUPh6NpCWc_c9< zZ`v2kRc803b4h}^tJ8Qm!!(coE|^aoqkXC59C%(aPD>ka94^H*LfW##eR0tb2`xbw z0dqbF$e%P7k_GO3UTbaPx)8tB`ijmq$Wee`$BUUaLf_2;da%H@vxyC>2A}q>IDG2~ zx#2}U%MzE6@@+1$Mq}Kn9MuxFs;26N3rv>7a$TjNy_&r3DnTvosJJ@o=a?fOx#%vG zJ~sY1W;j#!Sg`u42hqnD*YEf(pi4DVBS%t+42u}%6X$7d))bAsgXfLq=1$js2-CVf z0~fj8c8(<Av9*$k~CjND1DcLp|Z zJp7+i2@TT=53FdJ|<5sVp z>ExpZkHC0C9WbB};?wLPsO+P7XQ{#NkHsut?jAW~955E%`@qf3DJTexr*kd`hm>2jnogQsrcEIS1)rnr=K+uIjB;`P=Ly1Esv z;CcS=4Cl79*yz<*!3^36|FdH4r@1ij{V82&_=Zc@g736*ZE9;=K2> zJ-kuAROK%;8+uiB< z@qrQ2fO0GbgFa7=x%N0)h6tVl{3v<|=`qB=fd}Iyt3{AV@59h_y&t8nOK1E>@(D#k zg!UNL5$z(StM4qD&mkuq@!`f*?Ysbp+B1nXwjCtS>+HZ0mMABi=m$f>V~(7Sy$d~? zhl-FQ8zFa>?S<49jg8tTZAJo{=6Yka!hnak_QtZ2%7|(gudnx8>G7ajij+hbmtNGE zy~jh%uz>l7DV`%q$@{fuySOz$P#+h_sqk1^*BqH(68h=_3XETue}wJpY3FP-o*!}i zD%YVnpgyiv^qh3h5m5efB3ru0v3ggL=BC15P95~mtPW%qbJH7)bcFkRBdips((^1Z ziR7Y9&HZA%hCOq`T2{(}hb8P`IE&-;fI4?}rvkv)y>>P^o*pEz&-l`O%d;bnoZdwX z`uR6?ks}Fh>FdsqdPu+Y4MCWzjNjsiSm@mG__V@t)U0{#RA6xPXHBpe;Nrx2D>OjC zBZF1!e68AS%=8!Q=;#O-C&l5ow-oEK-_YWzt$m>*u-d^4Dys>d)62NdIbnsik;WOB z9t*ZAFsx&nnh{Sr7DK7WVOxXtcIl+QJXJ}}?{fPOSYO=H`1#eDCGTYRh(lZE;#w1f2p+}l;d z_v{L%UavL(^j(aji56EK#PfUdJQyTVy&;Q%5Vio{K9(s93bCKOo!%kAs9+@hd5zhd zJK55#$JGwgLO2LT@}v4?vpQ)e6iiFokrD93+4Ji*qI?(lLSxLN!Yw|5TZyxnnhugu5(<5=dkTe6Fsc^VBGHe9kDC3pXF=AtEbi*-4%nE(Dvz37j7<9_rI=^ zUEYj%1ye;`f7Ek(B%jsW>HgadDK9V7^>wr4X6}_N^_j%{OnTpFLGC+0+YQy}&|wKl z)AF{?sBq(x4`LZ0P=ia8E;$E{2%tBG{{erHK>_ArQRJdsIk3Hk@9h?gzH-mKy ze%yR?OCz@ExIhv|5$P zojURS(PlQ_7+LMVvkHT;frzAEMNaeo>zcCt%0>Ss?>*?M)}b~m9TT*V8y|ESNK_dh z4(9pruRMttfzf%169~4h3l$#XQh7Vk|R0?G_# zyQQ3NJ10m^Hq}3qif9F@(*~oKYRLqbv8L*(`M{lK@^L_|)J}DT-&<%p77&01eX2TY z>o-3}u7#pS+7DBHw|O}jG(j_vk#zU9BUUvfh*bxehhi^`ydYl48?GGkuN|zYm=Lzz z5zrj}?QMAVMF$nQ3)ncXbq4Ro&x0Ct1rj!Sj{ z{Bk?$sY6dK_JbkziZE@Ra~tYs(;WjJi6_oJs21O>=81!M0=p%lYbu=-Esy6b)oWf< zBr}8QAA*r?`K7x6r9$!#ThTRT#?Ca~jj-v}gpk6VRJuAd7WM9!dAH~TNe_&iR@FHm zMbTvX#oqnzDQ++W>*P1DyOX%4%b^y@#XEDHB4M0qC%@t8!qC8de|2*VtWC1i7q#1o zTQt|^$NI63-kc49E)lu)_ki=a_em){-~9y-brwsXXqJln4H!&op~V3(s%#NZHPh>5 zfeqAXNBCMRI9@v^qK`8U#K=>o-~uOhSUg#GK$7*m;raIKJl*&x!mZ%3x`tR%#Jc#* z4%?L~1=JM+SI}|m;|Tpkzx-vMmLm8W$kN|@p|IW-TFY^NeZFTPvEDYG{1EK)qIbeDh+^2OsMw|!b-6deD04FVe$RAyDUdbWsq|Fv z9+|$UQg`72m8V97n8Cl7OXgC3dRFu>V*Ly}KtvW6P3n z{&>$utW=bGM-0)$5yI(d#yjRgWjGkE$yq+7?A^ZBy6KU^*l!8DFKpE}Bhq5oM zyoSHpY_nX4<`-^23qZ*!O4OOXl%QzB#kpf{_kqx9!&f9g+vg;@{ri zNoisSw9TrryN1^K{-U;8;JrmvoK{|U^nWj;4$dIz!)`ng;!E7I3nJ~AP10drRP3AI zVP2F4wC?r`n?_i@{9Jh#S7W#F7qagaR;A=QN0qyHO|zbOJbUSFVU`m*@D}SIauDeXEy!!=epjsPI@#DG)O6 z1ZN=p!zp(8IdxX=5ms!W(~aOpT5`(W9pzsZf_>Bm9U=e?X&e`=)o0vuP6di75rF4hu7MOfv!9N)Om+q8|cF-A(z|+UrE(7qe7~;lMwfe zHneASZ-N>3Dc=P{YsKeN5Ea$uEU2a191dPm)R{$cgH4AJfUIr+w(%-NK0K;@MP-Pu ziwRU1PqWoq1~ZOyX63Mb!^%do`X>{k{8Uj~XjLg-$(ba$XZ7e}wqHFUqxq$5*ahNV z(LMpF3~$g9Cb^#~u?^5gkYGwPwtyG)xJDaoL%;}ueY^RSv65;dR zLo7j-DCooX4?(TnAEN9QCn*CBWDc!^H8hr7VSFM#j8cnf;n5GL3;nzLB(odS|4dix z0?i)yhnnM?@{TkAf2_&=?-*y{klBGhwRil&!*1f;=7U_sy%R@NU(LpN0=Ga0dM4Mf Iy0@eM2hH&bjQ{`u diff --git a/docs/iam/umn/en-us_topic_0046611300.html b/docs/iam/umn/en-us_topic_0046611300.html index 52fa48ef..7ec38255 100644 --- a/docs/iam/umn/en-us_topic_0046611300.html +++ b/docs/iam/umn/en-us_topic_0046611300.html @@ -2,13 +2,25 @@

Change History

-
+ + + +
Table 1 Change history

Released On

+
- + + + + + +
Table 1 Change history

Released On

What's New

2023-07-20

+

2024-07-09

+

This release incorporates the following change:

+

Added TSI login in Table 1.

+

2024-01-16

+

This release incorporates the following change:

+

Modified ELB critical operations described in Table 1.

+

2023-07-20

This release incorporates the following changes:

@@ -29,7 +41,7 @@

2023-04-04

This release incorporates the following changes:

- +

2023-02-21

@@ -40,7 +52,7 @@

Added section Deleting an IAM User.

Added section Changing the Login Password of an IAM User.

Added section Adding Users to or Removing Users from a User Group.

-

Added section Deleting a User Group.

+

Added section Deleting User Groups.

Added section Revoking Permissions of a User Group.

Added section Assigning Dependency Roles.

Added section Roles.

diff --git a/docs/iam/umn/en-us_topic_0046613147.html b/docs/iam/umn/en-us_topic_0046613147.html index 25d2a6d1..21a3916b 100644 --- a/docs/iam/umn/en-us_topic_0046613147.html +++ b/docs/iam/umn/en-us_topic_0046613147.html @@ -1,15 +1,15 @@

Creating an Agency (by a Delegating Party)

-

By creating an agency, you can share your resources with another account, or delegate an individual or team to manage your resources. You do not need to share your security credentials (the password and access keys) with the delegated party. Instead, the delegated party can log in with its own account credentials and then switches the role to your account and manage your resources.

+

By creating an agency, you can share your resources with another account, or delegate an individual or team to manage your resources. You do not need to share your security credentials (the password or access keys) with the delegated party. Instead, the delegated party can log in with its own account credentials and then switches the role to your account and manage your resources.

Prerequisites

Before creating an agency, complete the following operations:

-

Procedure

  1. Log in to the IAM console.
  2. On the IAM console, choose Agencies from the navigation pane, and click Create Agency in the upper right corner.

    Figure 1 Creating an agency
    +

    Procedure

    1. Log in to the IAM console.
    2. On the IAM console, choose Agencies from the left navigation pane, and click Create Agency in the upper right corner.

      Figure 1 Creating an agency

    3. Enter an agency name.

      Figure 2 Setting the agency name
      -

    4. Specify the agency type as Account, and enter the name of a delegated account.

      • Account: Share resources with another account or delegate an individual or team to manage your resources. The delegated account can only be an account, rather than an IAM user or a federated user.
      • Cloud service: Delegate a specific service to access other services. For more information, see Cloud Service Delegation.
      +

    5. Specify the agency type as Account, and enter the name of a delegated account.

      • Account: Share resources with another account or delegate an individual or team to manage your resources. The delegated account can only be an account, rather than an IAM user or a federated user.
      • Cloud service: Delegate a specific service to access other services. For more information, see Cloud Service Agency.
      -

    6. Set the validity period and enter a description for the agency.
    7. Click Next.
    8. Select the policies or roles to be attached to the agency, click Next, and select the authorization scope.

      • Assigning permissions to an agency is similar to assigning permissions to a user group. The two operations differ only in the number of available permissions. For details about how to assign permissions to a user group, see Assigning Permissions to an IAM User.
      • Agencies cannot be assigned the Security Administrator role. For account security, grant permissions required to agencies based on the principle of least privilege.
      +

    9. Set the validity period and enter a description for the agency.
    10. Click Next.
    11. Select the policies or roles to be attached to the agency, click Next, and select the authorization scope.

      • Assigning permissions to an agency is similar to assigning permissions to a user group. The two operations differ only in the number of available permissions. For details about how to assign permissions to a user group, see Assigning Permissions to an IAM User.
      • Agencies cannot be assigned the Security Administrator role. For account security purposes, only grant the required permissions to the agency based on the principle of least privilege (PoLP).

    12. Click OK.

      After creating an agency, provide your domain name, agency name, agency ID, and agency permissions to the delegated party. The delegated party can then switch the role to your account and manage specific resources based on the assigned permissions.

      diff --git a/docs/iam/umn/en-us_topic_0046613148.html b/docs/iam/umn/en-us_topic_0046613148.html index 0b660a9d..1dd62ff4 100644 --- a/docs/iam/umn/en-us_topic_0046613148.html +++ b/docs/iam/umn/en-us_topic_0046613148.html @@ -1,10 +1,10 @@

      Switching Roles (by a Delegated Party)

      -

      When an account establishes a trust relationship with your account, you become a delegated party. You and all the users you have authorized can switch to the delegating account and manage resources under the account based on assigned permissions.

      +

      When an account establishes a trust relationship with your account, you become a delegated party. The IAM users that are granted agency permissions can switch to the delegating account and manage resources under the account based on the granted permissions.

      Prerequisites

      • A trust relationship has been established between your account and another account.
      • You have obtained the delegating account name and agency name.
      -

      Procedure

      1. Log in to the management console using your account or log in as the IAM user created in 2.

        The IAM user created in 2 of (Optional) Assigning Permissions to an IAM User (by a Delegated Party) can switch roles to manage resources for the delegating party.

        +

        Procedure

        1. Log in to the management console using your account or log in as the IAM user created in 2.

          The IAM user created in 2 can switch roles to manage resources for the delegating party.

        2. Hover the mouse pointer over the username in the upper right corner and choose Switch Role.
        3. On the Switch Role page, enter the domain name of the delegating party.

          After you enter the domain name, the agencies created under this account will be automatically displayed after you click the agency name text box. Select an authorized one from the drop-down list.

          diff --git a/docs/iam/umn/en-us_topic_0046661675.html b/docs/iam/umn/en-us_topic_0046661675.html index e625ae3e..6ee9a8dc 100644 --- a/docs/iam/umn/en-us_topic_0046661675.html +++ b/docs/iam/umn/en-us_topic_0046661675.html @@ -2,7 +2,7 @@

          Viewing and Modifying User Information

          You can modify the user information, including the status, access type, description, external identity ID, and belonged user group.

          -

          If the job responsibilities of a user are changed, you can change the groups to which the user belongs to modify the user permissions. You can also change the virtual MFA device and access keys of the user by choosing More > Security Settings in the row containing the target user. If a user forgot their password or access keys, you can modify the login credentials of the user.

          +

          If the job responsibilities of a user are changed, you can change the permissions assigned for that user by changing the groups which the user belongs to. You can also change the virtual MFA device and access keys of the user by choosing More > Security Settings in the row containing the target user. If a user forgot their password or access keys, you can modify the login credentials of the user.

          As an administrator, you can modify the basic information about an IAM user, change the security settings of the user and the groups to which the user belongs, and view or delete the assigned permissions. To view or modify user information, click Security Settings in the row containing the IAM user.

          To adjust the item columns displayed on the list, click . The Username and Operation columns are displayed by default, and the Status column cannot be removed. You can also select Description, Last Login, Created, Access Type, Virtual MFA Device, Password Age, and Access Key (Status, Age, and AK).

          @@ -14,12 +14,12 @@

          User Groups

          An IAM user inherits permissions from the groups to which the user belongs. You can change the permissions assigned for an IAM user by changing the groups to which the user belongs. To modify the permissions of a user group, see Viewing and Modifying User Group Information.

          Your account belongs to the default group admin, which cannot be changed.

          -
          • Click Add to User Groups, and select one or more groups to which the user will belong. The user then inherits permissions of these groups.
          • Click Remove on the right of a user group and click Yes. The user no longer has the permissions assigned to the group.
          +
          • Click Add to User Group, and select one or more groups to which the user will belong. The user then inherits permissions of these groups.
          • Click Remove on the right of a user group and click Yes. The user no longer has the permissions assigned to the group.

          Security Settings

          As an administrator, you can modify the MFA device, login credential, login protection, and access keys of an IAM user on this page. If you are an IAM user and need to change your mobile number, email address, or virtual MFA device, see Security Settings.

          • MFA Authentication: You can change the multi-factor authentication (MFA) settings of an IAM user on the Security Settings page.
            • Change the mobile number or email address of the user.

              The mobile number and email address of the IAM user cannot be the same as those of your account or other IAM users.

              -
            • Remove the MFA device from the user. For more information about MFA authentication and virtual MFA device, see MFA Authentication and Virtual MFA Device.
            +
          • Remove the virtual MFA device from the user. For more information about MFA authentication and virtual MFA device, see MFA Authentication and Virtual MFA Device.
          • Login Credentials: You can change the login password of the IAM user. For more information, see Changing the Login Password of an IAM User.
          • Login Protection: You can change the login verification method of the IAM user. Three verification methods are available: virtual MFA device, SMS, and email.

            This option is disabled by default. If you enable this option, the user will need to enter a verification code in addition to the username and password when logging in to the console.

          • Access Keys: You can manage access keys of the IAM user.
          diff --git a/docs/iam/umn/en-us_topic_0079496985.html b/docs/iam/umn/en-us_topic_0079496985.html index 6000aee0..91c2e65d 100644 --- a/docs/iam/umn/en-us_topic_0079496985.html +++ b/docs/iam/umn/en-us_topic_0079496985.html @@ -1,7 +1,7 @@ -

          Assigning Permissions to an IAM User

          -

          IAM users created without being added to any groups do not have permissions. You can assign permissions to these IAM users on the IAM console. After authorization, the users can use cloud resources in your account as specified by their permissions.

          +

          Assigning Permissions to an IAM User

          +

          IAM users created without being added to any groups do not have permissions. You can assign permissions to these IAM users on the IAM console. Then the users can use cloud resources based on the assigned permissions.

          An IAM user obtains permissions from the user groups to which the user belongs. After you attach policies or roles to a group and add a user to the group, the user inherits the permissions defined by the policies or roles.

          • If you do not add an IAM user to any group, the user will not have permissions for accessing any cloud services. For details on how to assign permissions to an IAM user, see Creating a User Group and Assigning Permissions and Adding Users to or Removing Users from a User Group.
          • If you have been added to the default group admin, you have administrator permissions and you can perform all operations on all cloud services.
          • For the system-defined permissions of all cloud services supported by IAM, see "Permissions".
          • If you add a user to multiple user groups, the user inherits the permissions that are assigned to all the groups.

          Procedure

          1. In the user list, click Authorize in the row that contains the target user.
          2. On the Authorize User page, select an authorization mode and permissions.

            • Inherit permissions from user groups: Add the IAM user to certain groups to inherit their permissions.

              If you select this option, select the user groups to which the user will belong.

              diff --git a/docs/iam/umn/en-us_topic_0079496986.html b/docs/iam/umn/en-us_topic_0079496986.html index 301b075f..5400eb8e 100644 --- a/docs/iam/umn/en-us_topic_0079496986.html +++ b/docs/iam/umn/en-us_topic_0079496986.html @@ -6,7 +6,7 @@
              • Account Delegation
                • -
              • Cloud Service Delegation
                +
              • Cloud Service Agency
              • Deleting or Modifying Agencies
                • diff --git a/docs/iam/umn/en-us_topic_0079620341.html b/docs/iam/umn/en-us_topic_0079620341.html index 28abdcc0..7e5ab055 100644 --- a/docs/iam/umn/en-us_topic_0079620341.html +++ b/docs/iam/umn/en-us_topic_0079620341.html @@ -1,7 +1,7 @@

                Introduction

                -

                The cloud platform provides identity federation based on Security Assertion Markup Language (SAML) or OpenID Connect. This function allows users in your enterprise management system to access through single sign-on (SSO).

                +

                The cloud platform provides identity federation based on Security Assertion Markup Language (SAML) or OpenID Connect. This function allows users in your enterprise management system to access the cloud platform through single sign-on (SSO).

                Basic Concepts

                @@ -14,7 +14,7 @@ - @@ -31,12 +31,12 @@ - -
                Table 1 Basic concepts

                Concept

                An IdP collects and stores user identity information, such as usernames and passwords, and authenticates users during login. For identity federation between an enterprise and the cloud platform, the identity authentication system of the enterprise is an identity provider and is also called "enterprise IdP". Popular third-party IdPs include Microsoft Active Directory Federation Services (AD FS) and Shibboleth.

                Service Provider (SP)

                +

                Service provider (SP)

                A service provider establishes a trust relationship with an IdP and provides services based on the user information provided by the IdP. For identity federation between an enterprise and the cloud platform, the cloud platform is a service provider.

                SAML 2.0

                SAML 2.0 is an XML-based protocol that uses securityTokens containing assertions to pass information about an end user between an IdP and an SP. It is an open standard ratified by the Organization for the Advancement of Structured Information Standards (OASIS) and is being used by many IdPs. For more information about this standard, see SAML 2.0 Technical Overview. The cloud platform implements identity federation in compliance with SAML 2.0. To successfully federate users to the cloud platform, ensure that your enterprise IdP is compatible with this protocol.

                +

                SAML 2.0 is an XML-based protocol that uses security tokens containing assertions to pass information about an end user between an IdP and an SP. It is an open standard ratified by the Organization for the Advancement of Structured Information Standards (OASIS) and is being used by many IdPs. For more information about this standard, see SAML 2.0 Technical Overview. The cloud platform implements identity federation in compliance with SAML 2.0. To successfully federate your enterprise users with the cloud platform, ensure that your enterprise IdP is compatible with this protocol.

                OpenID Connect

                OpenID Connect is a simple identity layer on top of the Open Authorization 2.0 (OAuth 2.0) protocol. IAM implements identity federation in compliance with OpenID Connect 1.0. To successfully federate users to the cloud platform, ensure that your enterprise IdP is compatible with this protocol.

                +

                OpenID Connect is a simple identity layer on top of the Open Authorization 2.0 (OAuth 2.0) protocol. IAM implements identity federation in compliance with OpenID Connect 1.0. To successfully federate your enterprise users with the cloud platform, ensure that your enterprise IdP is compatible with this protocol.

                OAuth 2.0

                @@ -48,8 +48,8 @@
                -

                Advantages of Identity Federation

                • Easy identity management

                  As an administrator, you only need to create accounts for your employees in your enterprise management system. The employees can use their own accounts to access both the enterprise management system and the cloud platform.

                  -
                • Simplified operations

                  Employees can log in to the cloud platform from the enterprise management system.

                  +

                  Advantages of Identity Federation

                  • Easy identity management

                    With an identity provider, the administrator can manage workforce identities outside of the cloud platform and give these external workforce identities permissions to use resources on the cloud platform.

                    +
                  • Simplified operations

                    Workforce users can use their existing accounts in the enterprise to access the cloud platform through SSO.

                    Figure 1 Advantages of identity federation
                  @@ -110,7 +110,7 @@
-

Precautions

  • Ensure that your enterprise IdP server and the cloud platform use Greenwich Mean Time (GMT) time in the same time zone.
  • The identity information (such as email address or mobile number) of federated users is stored in the enterprise IdP. Federated users are mapped to the cloud platform as virtual identities, so their access to the cloud platform has the following restrictions:
    • Federated users do not need to perform a 2-step verification when performing critical operations even though critical operation protection (login protection or operation protection) is enabled.
    • Federated users cannot create access keys with unlimited validity, but they can obtain temporary access credentials (access keys and securityTokens) using user or agency tokens.

      If a federated user needs an access key with unlimited validity, they can contact the account administrator or an IAM user to create one. An access key contains the permissions granted to a user, so it is recommended that the federated user request an IAM user in the same group to create an access key.

      +

      Precautions

      • Ensure that your enterprise IdP server and the cloud platform use Greenwich Mean Time (GMT) time in the same time zone.
      • The identity information (such as email address or mobile number) of federated users is stored in the enterprise IdP. Federated users are mapped to the cloud platform as virtual identities, so their access to the cloud platform has the following restrictions:
        • Federated users do not need to perform a 2-step verification when performing critical operations even though critical operation protection (login protection or operation protection) is enabled.
        • Federated users cannot create access keys with unlimited validity, but they can obtain temporary access credentials (access keys and security tokens) using user or agency tokens.

          If a federated user needs an access key with unlimited validity, they can contact the account administrator or an IAM user to create one. An access key contains the permissions granted to a user, so it is recommended that the federated user request an IAM user in the same group to create an access key.

      diff --git a/docs/iam/umn/iam_01_0003.html b/docs/iam/umn/iam_01_0003.html index 0e373fd5..d30ad0da 100644 --- a/docs/iam/umn/iam_01_0003.html +++ b/docs/iam/umn/iam_01_0003.html @@ -12,7 +12,7 @@

  • Add your account to an MFA application.

    • Scanning the QR code

      Open the MFA application on your mobile phone, click the plus sign + on the application, and scan the QR code displayed on the Bind Virtual MFA Device page. Your account is then automatically added to the application, with the username and secret key displayed.

      -
    • Manually entering the secret key

      Open the MFA application on your mobile phone, click the plus sign + on the application, and manually enter the secret key displayed on the Bind Virtual MFA Device page.

      +
    • Manually entering the secret key

      Open the MFA application on your mobile phone, click the plus sign + on the application, and manually enter the secret key displayed on the Bind Virtual MFA Device page.

      The manual entry function is time-based. Ensure that automatic time setup has been enabled on your mobile phone.

    diff --git a/docs/iam/umn/iam_01_0012.html b/docs/iam/umn/iam_01_0012.html index e98b9088..3c0ca99b 100644 --- a/docs/iam/umn/iam_01_0012.html +++ b/docs/iam/umn/iam_01_0012.html @@ -137,6 +137,13 @@

    • federationLoginNoPwdFailed

    TSI login

    +

    user

    +

    tsiLogin

    +

    Creating a user group

    userGroup

    diff --git a/docs/iam/umn/iam_01_0013.html b/docs/iam/umn/iam_01_0013.html index eab06263..32614938 100644 --- a/docs/iam/umn/iam_01_0013.html +++ b/docs/iam/umn/iam_01_0013.html @@ -3,7 +3,7 @@

    Viewing Audit Logs

    After you enable CTS, it records key operations performed on IAM. You can view the operation records of the last 7 days on the CTS console.

    Viewing IAM Audit Logs

    1. Log in to the management console.
    2. Click Service List in the upper part of the page and choose Cloud Trace Service under Management & Deployment.
    3. In the navigation pane, choose Trace List.
    4. Click Filter in the upper right corner of the trace list to set filter conditions.

      The following filters are available:
      • Trace Source, Resource Type, and Search By
        • Select a filter criteria from the drop-down list. Specifically, select IAM from the Trace Source drop-down list.
        • If you select Trace name for Search By, select a trace name.
        • If you select Resource ID for Search By, select or enter a resource ID.
        • If you select Resource name for Search By, select or enter a resource name.
        -
      • Operator: Select an operator (a user rather than domain).
      • Trace Status: Available options include All trace statuses, normal, incident, and warning.
      • Specify the start time and end time for querying traces.
      +
    5. Operator: Select an operator (a user rather than domain).
    6. Trace Status: Available options include All trace statuses, normal, incident, and warning.
    7. Specify the start time and end time for querying traces.

  • Click Query.
  • Expand the details of a trace, as shown in Figure 1.

    Figure 1 Expanding trace details

  • Click View Trace in the Operation column. In the View Trace dialog box as shown in Figure 2, the trace details are displayed.

    Figure 2 Viewing a trace
    diff --git a/docs/iam/umn/iam_01_0016.html b/docs/iam/umn/iam_01_0016.html index 0fba3e0e..5a8f71da 100644 --- a/docs/iam/umn/iam_01_0016.html +++ b/docs/iam/umn/iam_01_0016.html @@ -2,32 +2,28 @@

    Creating a Custom Policy

    You can create custom policies to supplement system-defined policies and implement more refined access control.

    -

    Creating a Custom Policy in the Visual Editor

    1. On the IAM console, choose Policies in the navigation pane, and click Create Custom Policy.
    2. Enter a policy name.
    3. Select a scope based on the type of services related to this policy.

      • Global services: Select this option if the services to which the policy is related must be deployed in the Global region. When creating custom policies for globally deployed services, specify the scope as Global services. Custom policies of this scope must be attached to user groups for the global service project.
      • Project-level services: Select this option if the services to which the policy is related must be deployed in specific regions. When creating custom policies for regionally deployed services, specify the scope as Project-level services. Custom policies of this scope must be attached to user groups for specific projects except the global service project.
      -

      For example, when creating a custom policy containing the action evs:volumes:create for EVS, specify the scope as Project-level services.

      -

      A custom policy can contain actions of multiple services that are globally accessible or accessible through region-specific projects. To define permissions required to access both global and project-level services, create two custom policies and specify the scope as Global services and Project-level services.

      -
      -

    4. Select Visual editor.
    5. Set the policy content.

      1. Select Allow or Deny.
      2. Select a cloud service.

        Only one cloud service can be selected for each permission block. To configure permissions for multiple cloud services, click Add Permissions or switch to the JSON view.

        +

        Creating a Custom Policy in the Visual Editor

        1. On the IAM console, choose Policies in the navigation pane, and click Create Custom Policy.
        2. Enter a policy name.
        3. Select Visual editor.
        4. Set the policy content.

          1. Select Allow or Deny.
          2. Select a cloud service.

            Only one cloud service can be selected for each permission block. To configure permissions for multiple cloud services, click Add Permissions or switch to the JSON view.

          3. Select actions.
          4. Select all resources, or select specific resources by specifying their paths.
          5. (Optional) Add request conditions by specifying condition keys, operators, and values. -
            Table 1 Condition parameters

            Name

            +
            - - - - - - - @@ -38,11 +34,7 @@

          6. (Optional) To add another permission block for the policy, click Add Permissions. Alternatively, click the plus (+) icon on the right of an existing permission block to clone its permissions.
          7. (Optional) Enter a brief description for the policy.
          8. Click OK.
          9. Attach the policy to a user group. Users in the group then inherit the permissions defined in the policy.
            10. -

            Creating a Custom Policy in JSON View

            1. On the IAM console, choose Policies in the navigation pane, and click Create Custom Policy.
            2. Enter a policy name.
            3. Select a scope based on the type of services related to this policy.

              • Global services: Select this option if the services to which the policy is related must be deployed in the Global region. When creating custom policies for globally deployed services, specify the scope as Global services. Custom policies of this scope must be attached to user groups for the global service project.
              • Project-level services: Select this option if the services to which the policy is related must be deployed in specific regions. When creating custom policies for regionally deployed services, specify the scope as Project-level services. Custom policies of this scope must be attached to user groups for specific projects except the global service project.
              -

              For example, when creating a custom policy containing the action evs:volumes:create for EVS, specify the scope as Project-level services.

              -

              A custom policy can contain actions of multiple services that are globally accessible or accessible through region-specific projects. To define permissions required to access both global and project-level services, create two custom policies and specify the scope as Global services and Project-level services.

              -
              -

            4. Select JSON.
            5. (Optional) Click Select Existing Policy, and select a policy to use it as a template, such as VPC Admin.
            6. Click OK.
            7. Modify the statement in the template.

              • Effect: Set it to Allow or Deny.
              • Action: Enter the actions provided in the API actions table of the EVS service, for example, evs:volumes:create.
                • The version of each custom policy is fixed at 1.1.
                +

                Creating a Custom Policy in JSON View

                1. On the IAM console, choose Policies in the navigation pane, and click Create Custom Policy.
                2. Enter a policy name.
                3. Select JSON.
                4. (Optional) Click Select Existing Policy, and select a policy to use it as a template, such as VPC Admin.
                5. Click OK.
                6. Modify the statement in the template.

                  • Effect: Set it to Allow or Deny.
                  • Action: Enter the actions provided in the API actions table of the EVS service, for example, evs:volumes:create.
                    • The version of each custom policy is fixed at 1.1.

                7. (Optional) Enter a brief description for the policy.
                8. Click OK. If the policy list is displayed, the policy is created successfully.
                9. Attach the policy to a user group. Users in the group then inherit the permissions defined in the policy.
                diff --git a/docs/iam/umn/iam_01_0023.html b/docs/iam/umn/iam_01_0023.html index 3654093a..45d19512 100644 --- a/docs/iam/umn/iam_01_0023.html +++ b/docs/iam/umn/iam_01_0023.html @@ -3,7 +3,7 @@

                Identity Management

                You can manage users in your account and their security credentials. In addition, you can configure identity federation so that users in other systems can access the cloud platform through SSO.

                Domain

                A domain, also called an "account", is created upon successful registration with the cloud platform. The domain has full access permissions for its cloud services and resources.

                -

                For security purposes, create a security administrator and grant them Security Administrator permissions to manage users and their permissions in your account.

                +

                For security purposes, create a security administrator and grant them Security Administrator permissions to manage users and their permissions in your account.

                Figure 1 Account management model

                User

                You or other administrators can create users for employees, systems, or applications in IAM. The users can log in to the console or access APIs using their own identity credentials (passwords and access keys).

                diff --git a/docs/iam/umn/iam_01_0029.html b/docs/iam/umn/iam_01_0029.html index 7dddd88f..dc8309bb 100644 --- a/docs/iam/umn/iam_01_0029.html +++ b/docs/iam/umn/iam_01_0029.html @@ -14,7 +14,7 @@
                1. Go to the Security Settings page.
                2. Click the Critical Operations tab, and click Bind in the Virtual MFA Device row.
                3. Set up the MFA application by scanning the QR code or manually entering the secret key.

                  You can bind a virtual MFA device to your account by scanning the QR code or entering the secret key.

                  • Scanning the QR code

                    Open the MFA application on your mobile phone, and use the application to scan the QR code displayed on the Bind Virtual MFA Device page. Your account or IAM user is then added to the application.

                  • Manually entering the secret key

                    Open the MFA application on your mobile phone, and enter the secret key.

                    -

                    Your account is manually added using the time-based algorithm. Ensure that automatic time setting has been enabled on your mobile phone.

                    +

                    The user can be manually added only using time-based one-time passwords (TOTP). You are advised to enable automatic time setting on your mobile phone.

                4. View the verification codes on the MFA application. The code is automatically updated every 30 seconds.
                5. On the Bind Virtual MFA Device page, enter two consecutive verification codes and click OK.
                @@ -22,39 +22,39 @@

                Login Protection

                After login protection is enabled, you and IAM users created using your account will need to enter a verification code in addition to the username and password during login. Enable this function for account security.

                For the account, only the account administrator can enable login protection for it. For IAM users, both the account administrator and other administrators can enable this feature for the users.

                • (Administrator) Enabling login protection for an IAM user

                  To enable login protection for an IAM user, go to the Users page and choose More > Security Settings in the row that contains the IAM user. In the Login Protection area on the displayed Security Settings tab, click next to Verification Method, and select a verification method from SMS, email, or virtual MFA device.

                  -
                • Enabling login protection for your account

                  To enable login protection, click the Critical Operations tab on the Security Settings page, click Enable next to Login Protection, select a verification method, enter the verification codes, and click OK.

                  +
                • Enabling login protection for your account

                  To enable login protection, click the Critical Operations tab on the Security Settings page, click Enable next to Login Protection, select a verification method, enter the verification code, and click OK.

                Operation Protection

                • Enabling operation protection

                  After operation protection is enabled, you and IAM users created using your account need to enter a verification code when performing a critical operation, such as deleting an ECS. This function is enabled by default. To ensure resource security, keep it enabled.

                  The verification is valid for 15 minutes and you do not need to be verified again when performing critical operations within the validity period.

                1. Go to the Security Settings page.
                2. On the Critical Operations tab, locate the Operation Protection row and click Enable.
                3. Select Enable and then select Self-verification or Verification by another person.

                  If you select Verification by another person, an identity verification is required to ensure that this verification method is available.

                  -
                  • Self-verification: You or IAM users themselves perform verification when performing a critical operation.
                  • Verification by another person: The specified person completes verification when you or IAM users perform a critical operation. Only SMS and email verification are supported.
                  +
                  • Self-verification: You or IAM users themselves perform verification when performing a critical operation.
                  • Verification by another person: The specified person completes verification when you or IAM users perform a critical operation. Only SMS and email verification are supported.

                4. Click OK.
                • Disabling operation protection

                If operation protection is disabled, you and IAM users created using your account do not need to enter a verification code when performing a critical operation.

                -
                1. Go to the Security Settings page.
                2. On the Critical Operations tab, locate the Operation Protection row and click Change.
                3. Select Disable and click OK.
                4. Enter a verification code.

                  • Self-verification: The administrator who wants to disable operation protection completes the verification. SMS, email, and virtual MFA verification are supported.
                  • Verification by another person: The specified person completes the verification. Only SMS and email verification are supported.
                  +
                  1. Go to the Security Settings page.
                  2. On the Critical Operations tab, locate the Operation Protection row and click Change.
                  3. Select Disable and click OK.
                  4. Enter a verification code.

                    • Self-verification: The administrator who wants to disable operation protection completes the verification. SMS, email, and virtual MFA verification are supported.
                    • Verification by another person: The specified person completes the verification. Only SMS and email verification are supported.

                  5. Click OK.
                  -
                  • Each cloud service defines its own critical operations.
                  • When IAM users created using your account perform a critical operation, they will be prompted to choose a verification method from email, SMS, and virtual MFA device.
                    • If a user is only associated with a mobile number, only SMS verification is available.
                    • If a user is only associated with an email address, only email verification is available.
                    • If a user is not associated with an email address, mobile number, or virtual MFA device, the user will need to associate at least one of them before the user can perform any critical operations.
                    +
                    • Each cloud service defines its own critical operations.
                    • When IAM users created using your account perform a critical operation, they will be prompted to choose a verification method from email, SMS, and virtual MFA device.
                      • If a user is only associated with a mobile number, only SMS verification is available.
                      • If a user is only associated with an email address, only email verification is available.
                      • If a user is not associated with an email address, mobile number, or virtual MFA device, the user will need to associate at least one of them before they can perform any critical operations.
                    • You may not be able to receive email or SMS verification codes due to communication errors. In this case, you are advised to use a virtual MFA device for verification.
                    • If operation protection is enabled, IAM users need to enter verification codes when performing a critical operation. The verification codes are sent to the mobile number or email address bound to the IAM users.

                  Access Key Management

                  • Enabling access key management

                    After access key management is enabled, only the administrator can create, enable, disable, or delete access keys of IAM users. This function is disabled by default. To ensure resource security, enable this function.

                    To enable access key management, click the Critical Operations tab on the Security Settings page, and click in the Access Key Management row.

                  • Disabling access key management

                    After access key management is disabled, all IAM users can create, enable, disable, or delete their own access keys.

                    -

                    To enable access key management, click the Critical Operations tab on the Security Settings page, and click in the Access Key Management row.

                    +

                    To enable access key management, click the Critical Operations tab on the Security Settings page, and click in the Access Key Management row.

                  Information Self-Management

                  • Enabling information self-management

                    By default, information self-management is enabled, indicating that all IAM users can manage their own basic information (login password, mobile number, and email address). Determine whether to allow IAM users to manage their own information and what information they can modify.

                    -

                    To enable information self-management, click the Critical Operations tab on the Security Settings page, and click Enable next to Information Self-Management. Select Enable, select the information types that IAM users can modify, and click OK.

                    +

                    To enable information self-management, click the Critical Operations tab on the Security Settings page, and click Enable in the Information Self-Management row. Select Enable, select the information types that IAM users can modify, and click OK.

                  • Disabling information self-management

                    After you disable information self-management, only administrators can manage their own basic information. If IAM users need to modify their login password, mobile number, or email address, they can contact the administrator. For details, see Viewing and Modifying User Group Information.

                    To disable information self-management, click the Critical Operations tab on the Security Settings page, and click Change in the Information Self-Management row. In the displayed pane, select Disable and click OK.

                  Critical Operations

                  The following tables list the critical operations defined by each cloud service.

                  -
            Table 1 Condition parameters

            Name

            Description

            +

            Description

            Condition Key

            +

            Condition Key

            A key in the Condition element of a statement. There are global and service-level condition keys. Global condition keys (starting with g:) are available for operations of all services, while service-level condition keys (starting with a service abbreviation name such as obs:) are available only for operations of the corresponding service.

            +

            A key in the Condition element of a statement. There are global and service-level condition keys. Global condition keys (starting with g:) are available for operations of all services, while service-level condition keys (starting with a service abbreviation name such as obs:) are available only for operations of the corresponding service.

            Operator

            +

            Operator

            Used together with a condition key to form a complete condition statement.

            +

            Used together with a condition key to form a complete condition statement.

            Value

            +

            Value

            Used together with a condition key and an operator that requires a keyword, to form a complete condition statement.

            +

            Used together with a condition key and an operator that requires a keyword, to form a complete condition statement.
            Table 1 Critical operations defined by cloud services

            Service Type

            +
            @@ -97,7 +97,7 @@ - @@ -106,28 +106,27 @@ - - - - - diff --git a/docs/iam/umn/iam_01_0030.html b/docs/iam/umn/iam_01_0030.html index db9b2f36..c4efa34c 100644 --- a/docs/iam/umn/iam_01_0030.html +++ b/docs/iam/umn/iam_01_0030.html @@ -5,8 +5,9 @@

            Procedure

            1. Choose Management & Deployment > Identity and Access Management.
            2. In the navigation pane, choose User Groups.
            3. On the User Groups page, click Create User Group.
            4. Enter a user group name.
            5. (Optional) Enter a description for the user group.

              To enable users to directly view their permissions, set a description for the user group. For example, if you assign the Security Administrator role to a user group, you can set any description in the Description text box. For example: Security Administrator: Permissions for creating, deleting, and modifying users as well as granting permissions to users. For details about the permissions for all cloud services, see Permission Description.

            6. Click OK.

              The user group is displayed in the user group list.

              -

            7. In the row containing the user group, click Manage Permissions.
            8. On the Permissions tab page, click Assign Permissions above the permission list.
            9. Specify the authorization scope. If you select Region-specific projects, select one or more projects in the drop-down list.

              • Global service project: Services deployed without specifying physical regions are called global services, such as Object Storage Service (OBS), and Tag Management Service (TMS). Permissions for these services must be assigned in the global service project.
              • Region-specific projects: Services deployed in specific regions are called project-level services. Permissions for these services need to be assigned in region-specific projects and take effect only for the corresponding regions. If you want the permissions to take effect for all regions, grant them in all these regions.
              -

            10. Select policies and click OK.
            +

          10. In the row containing the user group, click Authorize in the Operation column.
          11. Assign permissions for region-specific projects to the user group.

            1. Select desired permissions for project-level services and click Next.
            2. Set Scope to Regional-specific projects, select the regional project, and click OK.
            +

          12. Assign permissions for global services to the user group.

            1. Select permissions for global services, such as OBS OperateAccess, and click Next.
            2. Select All resources for Scope and click OK.
            +

            13. diff --git a/docs/iam/umn/iam_01_0063.html b/docs/iam/umn/iam_01_0063.html index 1aa88480..241385a4 100644 --- a/docs/iam/umn/iam_01_0063.html +++ b/docs/iam/umn/iam_01_0063.html @@ -1,13 +1,13 @@

            (Optional) Assigning Permissions to an IAM User (by a Delegated Party)

            -

            When a trust relationship is established between your account and another account, you become a delegated party. By default, only your account and the members of the admin group can manage resources for the delegating party. To authorize IAM users to manage these resources, assign permissions to the users.

            +

            When a trust relationship is established between your account and another account, you become a delegated party. By default, only your account and the members of the admin group can manage resources for the delegating party. To authorize IAM users to manage these resources, assign permissions to the users.

            You can authorize an IAM user to manage resources for all delegating parties, or authorize the user to manage resources for a specific delegating party.

            Prerequisites

            • A trust relationship has been established between your account and another account.
            • You have obtained the name of the delegating account and the name and ID of the created agency.

            Procedure

            1. Create a user group and grant permissions to it.

              1. On the User Groups page, click Create User Group.
              2. Enter a user group name.
              3. Click OK.
              4. In the row containing the user group, click Authorize.
              5. Create a custom policy.

                This step is used to create a policy containing permissions required to manage resources for a specific agency. If you want to authorize an IAM user to manage resources for all agencies, go to 1.f.

                -
                1. On the Select Policy/Role page, click Create Policy in the upper right corner of the permission list.
                2. Enter a policy name.
                3. Select JSON for Policy View.
                4. In the Policy Content area, enter the following content:
                  {
+
                  1. On the Select Policy/Role page, click Create Policy in the upper right corner of the permission list.
                  2. Enter a policy name.
                  3. Select JSON for Policy View.
                  4. In the Policy Content area, enter the following content:
                    {
         "Version": "1.1",
         "Statement": [
                 {
@@ -23,12 +23,12 @@
                 }
         ]
 }
                    
-
                     
                    • Replace b36b1258b5dc41a4aa8255508xxx... with the agency ID obtained from a delegating party. Do not make any other changes.
                    • For more information about permissions, see Permissions.
                    
+
                     
                    • Replace b36b1258b5dc41a4aa8255508xxx... with the agency ID obtained from a delegating party. Do not make any other changes.
                    • For more information about permissions, see Permissions.
                    
 
                    
 
                  5. Click Next.
                  
-
                5. Select the policy created in the previous step or the Agent Operator role and click Next.
                  • Custom policy: Allows a user to manage resources only for a specific agency.
                  • Agent Operator role: Allows a user to manage resources for all agencies.
                  +
                6. Select the policy created in the previous step or the Agent Operator role and click Next.
                  • Custom policy: Allows a user to manage resources only for an agency identified by a specific ID.
                  • Agent Operator role: Allows a user to manage resources for all agencies.
                7. Specify the authorization scope.
                8. Click OK.
                -

              6. Create an IAM user and add the user to the user group.

                1. On the Users page, click Create User.
                2. On the Create User page, enter a username.
                3. For the access type, select Management console access and Set by user.
                4. Enable login protection and click Next.
                5. Select the user group created in 1 and click Create.

                  After the authorization is complete, the IAM user can switch to the account of the delegating party and manage specific resources under the account.

                  +

                6. Create an IAM user and add the user to the user group.

                  1. On the Users page, click Create User.
                  2. On the Create User page, enter a username.
                  3. Select Management console access for Access Type and then select Set by user for Credential Type.
                  4. Enable login protection and click Next.
                  5. Select the user group created in 1 and click Create.

                    After the authorization is complete, the IAM user can switch to the account of the delegating party and manage specific resources under the account.

                diff --git a/docs/iam/umn/iam_01_0430.html b/docs/iam/umn/iam_01_0430.html index 0eb36277..f7a219e8 100644 --- a/docs/iam/umn/iam_01_0430.html +++ b/docs/iam/umn/iam_01_0430.html @@ -3,12 +3,12 @@ -

                Deleting a User Group

                +

                Deleting User Groups

                Procedure

                To delete a user group, do the following:

                -
                1. Log in to the IAM console. In the navigation pane, choose User Groups.
                2. In the user group list, click Delete in the row that contains the user group to be deleted.
                3. In the displayed dialog box, click Yes.
                +
                1. Log in to the IAM console. In the navigation pane, choose User Groups.
                2. In the user group list, click Delete in the row that contains the user group to be deleted.
                3. In the displayed dialog box, click Yes.

                Batch Deleting User Groups

                To delete multiple user groups at a time, do the following:

                -
                1. Log in to the IAM console. In the navigation pane, choose User Groups.
                2. In the user group list, select the user groups to be deleted and click Delete above the list.
                3. In the displayed dialog box, click Yes.
                +
                1. Log in to the IAM console. In the navigation pane, choose User Groups.
                2. In the user group list, select the user groups to be deleted and click Delete above the list.
                3. In the displayed dialog box, click Yes.
                diff --git a/docs/iam/umn/iam_01_0607.html b/docs/iam/umn/iam_01_0607.html index aac7208a..90c322a5 100644 --- a/docs/iam/umn/iam_01_0607.html +++ b/docs/iam/umn/iam_01_0607.html @@ -8,7 +8,7 @@

                Only the administrator can configure the password policy, and IAM users can only view the configurations. If an IAM user needs to modify the configurations, the user can request the administrator to perform the modification or grant the required permissions.

                You can configure the password policy to ensure that IAM users create strong passwords and rotate them periodically. In the password policy, you can define password requirements, such as minimum password length, whether to allow consecutive identical characters in a password, and whether to allow previously used passwords.

                Password Composition & Reuse

                • Ensure that the password contains 2 to 4 of the following character types: uppercase letters, lowercase letters, digits, and special characters. By default, the password must contain at least 2 of these character types.
                • Set the minimum number of characters that a password must contain. The default value is 6 and the value range is from 6 to 32.
                • (Optional) Enable the Restrict consecutive identical characters option and set the maximum number of times that a character is allowed to be consecutively present in a password. For example, value 1 indicates that consecutive identical characters are not allowed in a password.
                • (Optional) Enable the Disallow previously used passwords option and set the number of previously used passwords that are not allowed. For example, value 3 indicates that the user cannot set the last three passwords that the user has previously used when setting a new password.
                -

                Changes to the password policy take effect the next time you or your IAM users change passwords. IAM users created later will also adhere to the updated password policy.

                +

                Changes to the password policy take effect the next time you or your IAM users change passwords. The new password policy will also apply to IAM users created later.

                Password Expiration

                Set a validity period for passwords so that users need to change their passwords periodically. The users will be prompted to change their passwords 15 days before password expiration. Expired passwords cannot be used to log in to the cloud platform.

                This option is disabled by default. The validity period ranges from 1 to 180 days.

                @@ -17,7 +17,7 @@

                After the password expires, users need to set a new password through the URL sent by email. The new password must be different from the old password.

                Minimum Password Age

                To prevent password loss due to frequent password changes, you can set a minimum period after which users are allowed to make a password change.

                -

                This option is disabled by default. If you enable this option, you can set a period from 0 to 1440 minutes.

                +

                This option is disabled by default. The validity period ranges from 0 to 1,440 minutes.

                The changes will take effect immediately for your account and all IAM users under your account.

                diff --git a/docs/iam/umn/iam_01_0653.html b/docs/iam/umn/iam_01_0653.html index ad55d311..d01abaf5 100644 --- a/docs/iam/umn/iam_01_0653.html +++ b/docs/iam/umn/iam_01_0653.html @@ -8,7 +8,7 @@

                To reset the login password of an IAM user, click Security Settings in the row containing the user, click next to Login Password in the Login Credentials area, and select a password type.

                • You can reset the password of an IAM user on the Security Settings page.
                • IAM users can change their passwords on the Basic Information tab.
                -
                • Set by user: A one-time login URL will be emailed to the user. The user can then click on the link to set a password.
                • Automatically generated: A password will be automatically generated and then sent to the user by email.
                • Set now: You set a new password and send the new password to the user.
                +
                • Set by user: A one-time login URL will be emailed to the user. The user can then click on the link to set a password.
                • Automatically generated: A password will be automatically generated and then sent to the user by email.
                • Set now: You set a new password and send the new password to the user.
                diff --git a/docs/iam/umn/iam_01_0655.html b/docs/iam/umn/iam_01_0655.html index c416fa86..ed08e97c 100644 --- a/docs/iam/umn/iam_01_0655.html +++ b/docs/iam/umn/iam_01_0655.html @@ -1,18 +1,15 @@ - -

                User Groups and Authorization

                - -

                +

                User Groups and Authorization

                +

                -
                • Creating a User Group and Assigning Permissions
                • Adding Users to or Removing Users from a User Group
                  • -
                • Deleting a User Group
                  +
                • Deleting User Groups
                • Viewing and Modifying User Group Information
                  • diff --git a/docs/iam/umn/iam_01_0703.html b/docs/iam/umn/iam_01_0703.html index aae4fa7b..930db06a 100644 --- a/docs/iam/umn/iam_01_0703.html +++ b/docs/iam/umn/iam_01_0703.html @@ -5,7 +5,7 @@

                  Basic Information

                  As an account administrator, both you and your IAM users can manage basic information on this page.

                  -
                  • A mobile number or an email address can be bound only to one account or IAM user.
                  • Only one mobile number, email address, and virtual MFA can be bound to an account or IAM user.
                  +
                  • A mobile number or an email address can be bound only to one account or IAM user.
                  • Only one mobile number, email address, and virtual MFA device can be bound to an account or IAM user.

                  Changing the Login Password, Mobile Number, Virtual MFA Device, or Email Address

                  The methods for changing the login password, mobile number, virtual MFA device, and email address are similar. To change the login password, do as follows:

                  1. Go to the Security Settings page.
                  2. Click the Basic Information tab, and click Change in the Login Password row.
                  3. (Optional) Select email address or mobile number verification, and enter the verification code.

                    If neither email address nor mobile number is bound, no verification is required.

                    diff --git a/docs/iam/umn/iam_01_0704.html b/docs/iam/umn/iam_01_0704.html index f6239d56..159435dc 100644 --- a/docs/iam/umn/iam_01_0704.html +++ b/docs/iam/umn/iam_01_0704.html @@ -4,7 +4,7 @@

                    Login Authentication Policy

                    -

                    The Login Authentication Policy tab of the Security Settings page provides the Session Timeout, Account Lockout, Recent Login Information, Recent Login Information, and Custom Information settings. These settings take effect for both your account and the IAM users created using the account.

                    +

                    The Login Authentication Policy tab of the Security Settings page provides the Session Timeout, Account Lockout, Account Disabling, Recent Login Information, and Custom Information settings. These settings take effect for both your account and the IAM users created using the account.

                    Only the administrator can configure the login authentication policy, and IAM users can only view the configurations. If an IAM user needs to modify the configurations, the user can request the administrator to perform the modification or grant the required permissions.

                    Session Timeout

                    Set the session timeout that will apply if you or users created using your account do not perform any operations within a specific period.

                    Figure 1 Session Timeout
                    @@ -23,7 +23,7 @@

                    This option is disabled by default and can be enabled by the administrator.

                    Custom Information

                    Set custom information that will be displayed upon successful login. For example, enter the word Welcome.

                    -

                    No information is displayed by default, and the administrator can set custom information that will be displayed.

                    +

                    This option is disabled by default and can be enabled by the administrator.

                    You and all the IAM users created using your account will see the same information upon successful login.

                    diff --git a/docs/iam/umn/iam_03_0002.html b/docs/iam/umn/iam_03_0002.html index a2840b53..7882f766 100644 --- a/docs/iam/umn/iam_03_0002.html +++ b/docs/iam/umn/iam_03_0002.html @@ -4,10 +4,10 @@

                    Adding Users to or Removing Users from a User Group

                    -

                    A user inherits permissions from the groups to which the user belongs. To change the permissions of a user, add the user to a new group or remove the user from an existing group.

                    +

                    A user inherits permissions from the groups which the user belongs to. To change the permissions of a user, add the user to a new group or remove the user from an existing group.

                    Adding Users to a User Group

                    1. In the user group list, click Manage User in the row containing the target user group.
                    2. In the Manage User dialog box, select the usernames to be added.
                    3. Click OK.
                    -

                    Removing Users from a User Group

                    1. In the user group list, click Manage User in the row containing the target user group.
                    2. In the Selected Users area, click x in the row containing the usernames to be removed and click OK.
                    +

                    Removing Users from a User Group

                    1. In the user group list, click Manage User in the row containing the target user group.
                    2. In the Selected Users area, locate the user to be removed and click the ×. Then, click OK.
                    diff --git a/docs/iam/umn/iam_03_0004.html b/docs/iam/umn/iam_03_0004.html index de73cae5..5466256a 100644 --- a/docs/iam/umn/iam_03_0004.html +++ b/docs/iam/umn/iam_03_0004.html @@ -6,9 +6,9 @@

                    Revoking Permissions of a User Group

                    Procedure

                    To revoke a policy or role attached to a user group, do the following:

                    -
                    1. Log in to the . In the navigation pane, choose User Groups.
                    2. Click the name of the user group to go to the group details page.
                    3. On the Permissions tab, click Delete in the row that contains the role or policy you want to delete.
                    4. In the displayed dialog box, click Yes.
                    +
                    1. Log in to the . In the navigation pane, choose User Groups.
                    2. Click the name of the user group to go to the group details page.
                    3. On the Permissions tab, click Delete in the row that contains the role or policy you want to delete.
                    4. In the displayed dialog box, click Yes.

                    Batch Revoking Permissions of a User Group

                    To revoke multiple policies or roles attached to a user group, do as follows:

                    -
                    1. Log in to the . In the navigation pane, choose User Groups.
                    2. Click the name of the user group to go to the group details page.
                    3. On the Permissions page, select the roles or policies you want to delete and click Delete above the list.
                    4. In the displayed dialog box, click Yes.
                    +
                    1. Log in to the . In the navigation pane, choose User Groups.
                    2. Click the name of the user group to go to the group details page.
                    3. On the Permissions page, select the roles or policies you want to delete and click Delete above the list.
                    4. In the displayed dialog box, click Yes.
                    diff --git a/docs/iam/umn/iam_06_0001.html b/docs/iam/umn/iam_06_0001.html index 775f1e9e..f35b06ae 100644 --- a/docs/iam/umn/iam_06_0001.html +++ b/docs/iam/umn/iam_06_0001.html @@ -4,12 +4,12 @@

                    The agency function enables you to delegate another account to implement O&M on your resources based on assigned permissions.

                    You can delegate resource access only to accounts. The accounts can then delegate access to IAM users under them.

                    -

                    The following is the procedure for delegating access to resources in one account to another account. Account A is the delegating party and account B is the delegated party.

                    +

                    The following is the procedure for delegating resource access to another account. Account A is the delegating party and account B is the delegated party.

                    1. Account A creates an agency in IAM to delegate resource access to account B.

                      Figure 1 (Account A) Creating an agency

                    2. (Optional) Account B assigns permissions to an IAM user to manage specific resources for account A.

                      1. Create a user group, and grant it permissions required to manage account A's resources.
                      2. Create a user and add the user to the user group.
                      Figure 2 (Account B) Authorizing an IAM user to manage delegated resources
                      -

                    3. Account B or the authorized user manages account A's resources.

                      1. Log in to account B's account and switch the role to account A.
                      2. Switch to region A and manage account A's resources in this region.
                      +

                    4. Account B or the authorized user manages account A's resources.

                      1. Use account B to log in and switch the role to account A.
                      2. Switch to region A and manage account A's resources in this region.
                      Figure 3 (Account B) Switching the role

                    diff --git a/docs/iam/umn/iam_06_0004.html b/docs/iam/umn/iam_06_0004.html index 7349e5a5..3f746df4 100644 --- a/docs/iam/umn/iam_06_0004.html +++ b/docs/iam/umn/iam_06_0004.html @@ -3,10 +3,10 @@ -

                    Cloud Service Delegation

                    +

                    Cloud Service Agency

                    Services on the cloud platform interwork with each other, and some cloud services are dependent on other services. To delegate a cloud service to access other services and perform resource O&M, create an agency for the service.

                    IAM provides two methods to create a cloud service agency:

                    -
                    1. Creating a cloud service agency on the IAM console

                      Take an OBS agency as an example. The agency allows OBS to call cloud services, for example, to read monitoring data from AOM.

                      +
                      1. Creating a cloud service agency on the IAM console

                        For example, create an agency for OBS and grant it permissions to read monitoring data from AOM.

                      2. Automatically creating a cloud service agency to use certain resources

                        The following takes Scalable File Service (SFS) as an example to describe the procedure for automatically creating a cloud service agency:

                        1. Go to the SFS console.
                        2. On the Create File System page, enable static data encryption.
                        3. A dialog box is displayed requesting you to confirm the creation of an SFS agency. After you click OK, the system automatically creates an SFS agency with KMS CMKFullAccess permissions for the current project. With the agency, SFS can obtain KMS keys for encrypting or decrypting file systems.
                        4. You can view the agency in the agency list on the IAM console.
                      diff --git a/docs/iam/umn/iam_07_0001.html b/docs/iam/umn/iam_07_0001.html index 11738a48..2e94f184 100644 --- a/docs/iam/umn/iam_07_0001.html +++ b/docs/iam/umn/iam_07_0001.html @@ -5,7 +5,7 @@

                      Security Settings Overview

                      You can configure the account settings, critical operation protection, login authentication policy, password policy, and access control list (ACL) on the Security Settings page. For details, see Basic Information, Critical Operation Protection, Login Authentication Policy, Password Policy, and ACL. This chapter describes how to access the Security Settings page and who is the intended audience.

                      -

                      Intended Audience

                      Table 1 lists the intended audience of different functions provided on the Security Settings page and their access permissions for the functions.

                      +

                      Intended Audience

                      Table 1 lists the intended audience of different functions provided on the Security Settings page and their access permissions for the functions.

            Table 1 Critical operations defined by cloud services

            Service Category

            Service

            • Deleting a vault
            • Deleting a backup
            • Restoring a backup
            • Deleting a policy
            • Dissociating a resource
            • Accepting a backup

            Network

            +

            Networking

            Domain Name Service (DNS)

            Virtual Private Cloud (VPC)

            • Releasing or unbinding an EIP
            • Deleting a VPC peering connection
            • Security group operations
              • Deleting an inbound or outbound rule
              • Modifying an inbound or outbound rule
              • Deleting inbound or outbound rules
              +
            • Releasing or unbinding an EIP
            • Deleting a VPC peering connection
            • Security group operations
              • Deleting an inbound or outbound rule
              • Modifying an inbound or outbound rule
              • Batch deleting inbound or outbound rules

            Elastic Load Balance (ELB)

            • Classic load balancers
              • Deleting a load balancer
              • Deleting a listener
              • Deleting a certificate
              • Disabling a load balancer
              -
            -
            • Shared load balancers
              • Deleting a load balancer
              • Deleting a listener
              • Deleting a certificate
              • Removing a backend server
              • Unbinding an EIP
              • Unbind a public or private IPv4 address
              • Unbinding an IPv6 address
              • Removing from IPv6 shared bandwidth
              +
            • Shared load balancers
              • Deleting a load balancer
              • Deleting a listener
              • Deleting a certificate
              • Removing a backend server
              • Unbinding an EIP
              • Unbind a public or private IPv4 address
              +
            • Dedicated load balancers
              • Deleting a load balancer
              • Deleting a listener
              • Deleting a certificate
              • Removing a backend server
              • Unbinding an EIP
              • Unbind a public or private IPv4 address
              • Unbinding an IPv6 address
              • Removing from IPv6 shared bandwidth

            Elastic IP (EIP)

            • Deleting a shared bandwidth
            • Releasing or unbinding an EIP
            • Releasing or unbinding EIPs
            +
            • Deleting a shared bandwidth
            • Releasing or unbinding an EIP
            • Batch releasing or unbinding EIPs

            Management & Deployment

            Identity and Access Management (IAM)

            • Disabling operation protection
            • Disabling login protection
            • Changing the mobile number
            • Changing the email address
            • Changing the login password
            • Changing the login authentication method
            • Deleting an IAM user
            • Disabling an IAM user
            • Deleting an agency
            • Deleting a user group
            • Deleting a policy
            • Deleting permissions
            • Creating an access key
            • Deleting an access key
            • Disabling an access key
            • Deleting the project
            • Modifying the status of access key management
            +
            • Disabling operation protection
            • Disabling login protection
            • Changing the mobile number
            • Changing the email address
            • Changing the login password
            • Changing the login authentication method
            • Deleting an IAM user
            • Disabling an IAM user
            • Deleting an agency
            • Deleting a user group
            • Deleting a policy
            • Deleting permissions
            • Creating an access key
            • Deleting an access key
            • Disabling an access key
            • Deleting a project
            • Modifying the status of access key management

            Application

            @@ -144,7 +143,7 @@
            • Resetting the administrator password
            • Deleting a DB instance
            • Deleting a database backup
            • Switching between primary and standby DB instances
            • Changing the database port
            • Deleting a database account
            • Deleting a database
            • Unbinding an EIP
            • Downloading a full backup

            Databases

            +

            Database

            Document Database Service (DDS)
            @@ -42,7 +42,7 @@
            Table 1 Intended audience

            Function

            -

            Accessing the Security Settings Page

            1. Log in to the IAM console as an administrator.
            2. In the left navigation pane, choose Security Settings.
            +

            Accessing the Security Settings Page

            1. Log in to the IAM console as an administrator.
            2. In the left navigation pane, choose Security Settings.
            • You and all IAM users created using your account can access the Security Settings page from the management console.
              1. Log in to the IAM console.
              2. In the left navigation pane, choose Security Settings.
            diff --git a/docs/iam/umn/iam_07_0003.html b/docs/iam/umn/iam_07_0003.html index 69c09c21..8f450920 100644 --- a/docs/iam/umn/iam_07_0003.html +++ b/docs/iam/umn/iam_07_0003.html @@ -5,8 +5,8 @@

            ACL

            The ACL tab of the Security Settings page provides the IP Address Ranges, IPv4 CIDR Blocks, and VPC Endpoints settings for allowing user access only from specified IP address ranges, IPv4 CIDR blocks, or VPC endpoints.

            -

            Only the administrator can configure the ACL. If an IAM user needs to configure the ACL, the user can request the administrator to perform the configuration or grant the required permissions.

            -
            Access type:
            • Console Access (recommended): The ACL takes effect only for IAM users who are created using your account and have access to the console.
            • API Access: The ACL controls users' API access through API Gateway and takes effect only for IAM users two hours after you complete the configuration.
            +

            Only the administrator can configure the ACL. If an IAM user needs to configure the ACL, the user can request the administrator to perform the configuration or grant the required permissions.

            +
            Access type:
            • Console Access (recommended): The ACL takes effect only for IAM users who are created using your account and have access to the console.
            • API Access: The ACL controls users' API access through API Gateway and takes effect only for IAM users two hours after you complete the configuration.
            • You can configure a maximum of 200 access control items.
            diff --git a/docs/iam/umn/iam_08_0003.html b/docs/iam/umn/iam_08_0003.html index 17ff303c..9d6da57b 100644 --- a/docs/iam/umn/iam_08_0003.html +++ b/docs/iam/umn/iam_08_0003.html @@ -10,7 +10,7 @@

          13. Upload the metadata file to the enterprise IdP server. For details, see the help documentation of the enterprise IdP.
          14. Obtain the metadata file of the enterprise IdP. For details, see the help documentation of the enterprise IdP.

            15. Creating an IdP Entity on the Cloud Platform

            To create an IdP entity on the IAM console, do as follows:

            -
            1. Log in to the IAM console, choose Identity Providers from the navigation pane, and click Create Identity Provider in the upper right corner.

              Figure 1 Creating an IdP entity
              +
              1. Log in to the IAM console, choose Identity Providers from the navigation pane, and click Create Identity Provider in the upper right corner.

                Figure 1 Creating an IdP entity

              2. Specify the name, protocol, SSO type, status, and description of the IdP entity.

                Figure 2 Setting IdP parameters
                Table 1 Basic parameters of an IdP

                Parameter

                @@ -124,11 +124,11 @@ -

                Related Operations

                • Viewing IdP information: In the IdP list, click View in the row containing the IdP, and view its basic information, metadata, and identity conversion rules.

                  To modify the configuration of an IdP, click Modify at the bottom of the details page.

                  +

                  Related Operations

                  • Viewing IdP information: In the IdP list, click View in the row containing the IdP, and view its basic information, metadata configuration, and identity conversion rules.

                    To modify the configuration of an IdP, click Modify at the bottom of the details page.

                  • Modifying an IdP: In the IdP list, click Modify in the row containing the IdP, and then change its status or modify the description, metadata, or identity conversion rules.
                  • Deleting an IdP: In the IdP list, click Delete in the row containing the IdP, and click Yes in the displayed dialog box.
                  -

                  Follow-Up Procedure

                  • Configure the enterprise IdP: Configure enterprise IdP parameters to determine what information can be sent to the cloud platform.
                  • Configure identity conversion rules: In the Identity Conversion Rules area, configure identity conversion rules to establish a mapping between enterprise users and IAM user groups. In this way, enterprise users can obtain the corresponding permissions in the cloud platform. For details, see Step 3: Configure Identity Conversion Rules.
                  • Verify the federated login: Check whether the enterprise user can log in to the cloud platform through SSO. For details, see Step 4: Verify the Federated Login.
                  +

                  Follow-Up Procedure

                  • Configure the enterprise IdP: Configure enterprise IdP parameters to determine what information can be sent to the cloud platform.
                  • Configure identity conversion rules: In the Identity Conversion Rules area, configure identity conversion rules to establish a mapping between enterprise users and IAM user groups. In this way, enterprise users can obtain the corresponding permissions in the cloud platform. For details, see Step 3: Configure Identity Conversion Rules.
                  • Verify the federated login: Check whether the enterprise user can log in to the cloud platform through SSO. For details, see Step 4: Verify the Federated Login.
                  diff --git a/docs/iam/umn/iam_08_0004.html b/docs/iam/umn/iam_08_0004.html index fc15871c..6888535f 100644 --- a/docs/iam/umn/iam_08_0004.html +++ b/docs/iam/umn/iam_08_0004.html @@ -1,15 +1,15 @@

                  Step 3: Configure Identity Conversion Rules

                  -

                  After an enterprise IdP user logs in to the cloud platform, the cloud platform authenticates the identity and assigns permissions to the user based on the identity conversion rules. You can customize identity conversion rules based on your service requirements. If you do not configure identity conversion rules, the username of the federated user on the cloud platform is FederationUser by default, and the federated user can only access the cloud platform by default.

                  +

                  After an enterprise IdP user logs in to the cloud platform, the cloud platform authenticates the identity and assigns permissions to the user based on the identity conversion rules. You can customize identity conversion rules based on your service requirements. If you do not configure identity conversion rules, the username of the federated user on the cloud platform is FederationUser by default, and the federated user can only access the cloud platform by default.

                  You can configure the following parameters for federated users:

                  • Username: Usernames of federated users in the cloud platform.
                  • User permissions: Permissions assigned to federated users in the cloud platform. You need to map the federated users to IAM user groups. In this way, the federated users can obtain the permissions of the user groups to use cloud resources. Ensure that user groups have been created. For details about how to create a user group, see Creating a User Group and Assigning Permissions.
                  -
                  • Modifications to identity conversion rules will take effect the next time federated users log in.
                  • To modify the permissions of a user, modify the permissions of the user group to which the user belongs. Then restart the enterprise IdP for the modifications to take effect.
                  +
                  • Modifications to identity conversion rules will take effect the next time federated users log in.
                  • To modify the permissions of a user, modify the permissions of the user group which the user belongs to. Then restart the enterprise IdP for the modifications to take effect.

                  Prerequisites

                  Procedure

                  If you configure identity conversion rules by clicking Create Rule, IAM will convert your specified parameters to the JSON format. Alternatively, you can click Edit Rule to directly configure rules in JSON format. For details, see Syntax of Identity Conversion Rules.

                  -
                  • Creating Rules
                    1. Log in to the IAM console as the administrator. In the navigation pane, choose Identity Providers.
                    2. In the IdP list, click Modify in the row containing the IdP.
                    3. In the Identity Conversion Rules area, click Create Rule. Then, configure the rules in the Create Rule dialog box.
                      +
                      • Creating Rules
                        1. Log in to the IAM console as the administrator. In the navigation pane, choose Identity Providers.
                        2. In the IdP list, click Modify in the row containing the IdP.
                        3. In the Identity Conversion Rules area, click Create Rule. Then, configure the rules in the Create Rule dialog box.
                          diff --git a/docs/iam/umn/iam_08_0005.html b/docs/iam/umn/iam_08_0005.html index 0804f648..39c012cd 100644 --- a/docs/iam/umn/iam_08_0005.html +++ b/docs/iam/umn/iam_08_0005.html @@ -5,7 +5,7 @@

                          Prerequisites

                          • An IdP entity has been created on the cloud platform. For details about how to create an IdP entity, see Step 1: Create an IdP Entity.
                          • The login entry for logging in to the cloud platform has been configured in the enterprise management system.

                          Procedure

                          1. Log in to the IAM console. In the navigation pane, choose Identity Providers.
                          2. Click View in the row containing the IdP.

                            Figure 1 Viewing IdP details
                            -

                          3. Copy the login link by clicking in the Login link row.

                            Figure 2 Copying the login link
                            +

                          4. Copy the login link by clicking in the Login Link row.

                            Figure 2 Copying the login link

                          5. Add the following statement to the page file of the enterprise management system:

                            <a href="<Login link>"> Cloud platform login entry </a>

                          6. Log in to the enterprise management system using your enterprise account, and click the configured login link to access the cloud platform.
                          diff --git a/docs/iam/umn/iam_08_0007.html b/docs/iam/umn/iam_08_0007.html index 49fbd7e2..4d269ab0 100644 --- a/docs/iam/umn/iam_08_0007.html +++ b/docs/iam/umn/iam_08_0007.html @@ -5,7 +5,7 @@

                          Prerequisites

                          • An IdP entity has been created on the cloud platform. For details about how to create an IdP entity, see Step 1: Create an IdP Entity.
                          • The login entry for logging in to the cloud platform has been configured in the enterprise management system.

                          Procedure

                          1. Log in to the IAM console. In the navigation pane, choose Identity Providers.
                          2. Click View in the row containing the IdP.

                            Figure 1 Viewing IdP details
                            -

                          3. Copy the login link by clicking in the Login link row.

                            Figure 2 Copying the login link
                            +

                          4. Copy the login link by clicking in the Login Link row.

                            Figure 2 Copying the login link

                          5. Add the following statement to the page file of the enterprise management system:

                            <a href="<Login link>"> Cloud platform login entry </a>

                          6. Log in to the enterprise management system using your enterprise account, and click the configured login link to access the cloud platform.
                          diff --git a/docs/iam/umn/iam_08_0008.html b/docs/iam/umn/iam_08_0008.html index 2c0f408f..9b5ab345 100644 --- a/docs/iam/umn/iam_08_0008.html +++ b/docs/iam/umn/iam_08_0008.html @@ -1,44 +1,43 @@

                          Step 2: Configure Identity Conversion Rules

                          -

                          Federated users are named FederationUser by default in the cloud platform. These users can only log in to the cloud platform and they do not have any other permissions. You can configure identity conversion rules on the IAM console to achieve the following:

                          +

                          Federated users are named FederationUser by default in the cloud platform. These users can only log in to the cloud platform and they do not have any other permissions. You can configure identity conversion rules on the IAM console to achieve the following:

                          • Display enterprise users with different names in the cloud platform.
                          • Assign permissions to enterprise users to use the cloud platform resources by mapping these users to IAM user groups. Ensure that you have created the required user groups. For details, see Creating a User Group and Assigning Permissions.
                          -
                          • Modifications to identity conversion rules will take effect only after the federated users log in again.
                          • To modify the permissions of a user, modify the permissions of the user group to which the user belongs. Then restart the enterprise IdP for the modifications to take effect.
                          +
                          • Modifications to identity conversion rules will take effect the next time federated users log in.
                          • To modify the permissions of a user, modify the permissions of the user group which the user belongs to. Then restart the enterprise IdP for the modifications to take effect.

                          Prerequisites

                          An IdP entity has been created, and the login link of the IdP is accessible. (For details about how to create and verify an IdP entity, see Step 1: Create an IdP Entity.)

                          Procedure

                          If you configure identity conversion rules by clicking Create Rule, IAM converts the rule parameters to the JSON format. Alternatively, you can click Edit Rule to configure rules in JSON format. For details, see Syntax of Identity Conversion Rules.

                          -
                          • Creating Rules
                            1. Log in to the IAM console as the administrator. In the navigation pane, choose Identity Providers.
                            2. In the IdP list, click Modify in the row containing the IdP.
                            3. In the Identity Conversion Rules area, click Create Rule. Then, configure the rules in the Create Rule dialog box.
                              Figure 1 Setting parameters
                              -
                              -
                          Table 1 Parameter description

                          Parameter

                          Description

                          @@ -39,7 +39,7 @@

                          Conditions that a federated user must meet to obtain permissions from the selected user groups.

                          Federated users who do not meet these conditions cannot access the cloud platform. You can create a maximum of 10 conditions for an identity conversion rule.

                          -

                          The Attribute and Value parameters are used for the enterprise IdP to transfer user information to the cloud platform through SAML assertions. The Condition parameter can be set to empty, any_one_of, or not_any_of. For details about these parameters, see Syntax of Identity Conversion Rules.

                          +

                          The Attribute and Value parameters are used for the enterprise IdP to transfer user information to the cloud platform through SAML assertions. The Condition parameter can be set to empty, any_one_of, or not_any_of. For details about these parameters, see Syntax of Identity Conversion Rules.

                          NOTE:
                          • An identity conversion rule can have multiple conditions. It takes effect only if all of the conditions are met.
                          • An IdP can have multiple identity conversion rules. If a federated user does not meet any of the conditions, the user will be denied to access the cloud platform.
                          Table 1 Parameter description

                          Parameter

                          +
                          • Creating Rules
                            1. Log in to the IAM console as the administrator. In the navigation pane, choose Identity Providers.
                            2. In the IdP list, click Modify in the row containing the IdP.
                            3. In the Identity Conversion Rules area, click Create Rule. Then, configure the rules in the Create Rule dialog box.
                              +
                              - - - - - - - - - - - @@ -48,10 +47,10 @@

                              For example, set an identity conversion rule for administrators in the enterprise management system.

                              -
                              • Username: FederationUser-IdP_admin
                              • User group: admin
                              • Rule condition: _NAMEID_ (attribute), any_one_of (condition), and 000000001 (value).

                                Only the user with ID 000000001 is mapped to IAM user FederationUser-IdP_admin and inherits permissions from the admin user group.

                                +
                                • Username: FederationUser-IdP_admin
                                • User group: admin
                                • Rule condition: _NAMEID_ (attribute), any_one_of (condition), and 000000001 (value).

                                  Only the user with ID 000000001 is mapped to IAM user FederationUser-IdP_admin and inherits permissions from the admin user group.

                              • In the Create Rule dialog box, click OK.
                              • On the Modify Identity Provider page, click OK.
                                • -
                              • Editing Rules
                                1. Log in to the IAM console as the administrator. In the navigation pane, choose Identity Providers.
                                2. In the IdP list, click Modify in the row containing the IdP.
                                3. In the Identity Conversion Rules area, click Edit Rule.
                                4. Edit the identity conversion rules in JSON format. For details, see Syntax of Identity Conversion Rules.
                                5. Click Validate to verify the syntax of the rules.
                                6. If the rule is correct, click OK in the Edit Rule dialog box, and click OK on the Modify Identity Provider page.

                                  If a message indicating that the JSON file is incomplete is displayed, modify the statements or click Cancel to cancel the modifications.

                                  +
                                7. Editing Rules
                                  1. Log in to the IAM console as the administrator. In the navigation pane, choose Identity Providers.
                                  2. In the IdP list, click Modify in the row containing the IdP.
                                  3. In the Identity Conversion Rules area, click Edit Rule.
                                  4. Edit the identity conversion rules in JSON format. For details, see Syntax of Identity Conversion Rules.
                                  5. Click Validate to verify the syntax of the rules.
                                  6. If the rule is correct, click OK in the Edit Rule dialog box, and click OK on the Modify Identity Provider page.

                                    If a message indicating that the JSON file is incomplete is displayed, modify the statements or click Cancel to cancel the modifications.

                              @@ -69,10 +68,3 @@ - - \ No newline at end of file diff --git a/docs/iam/umn/iam_08_0009.html b/docs/iam/umn/iam_08_0009.html index 6d3de86e..95441e03 100644 --- a/docs/iam/umn/iam_08_0009.html +++ b/docs/iam/umn/iam_08_0009.html @@ -2,12 +2,12 @@

                              Step 1: Create an IdP Entity

                              To establish a trust relationship between an enterprise IdP and the cloud platform, set the user redirect URLs and create OAuth 2.0 credentials in the enterprise IdP. On the IAM console, create an IdP entity and configure authorization information.

                              -

                              Prerequisites

                              • The enterprise administrator has created an account in the cloud platform, and has created user groups and assigned them permissions in IAM. For details, see Creating a User Group and Assigning Permissions. The user groups created in IAM will be mapped to federated users so that the federated users can obtain the permissions of the user groups to use cloud resources.
                              • The enterprise administrator has read the help documentation of the enterprise IdP or has understood how to use the enterprise IdP. Configurations of different enterprise IdPs differ greatly, so they are not described in this document. For details about how to obtain an enterprise IdP's OAuth 2.0 credentials, see the IdP help documentation.
                              +

                              Prerequisites

                              • The enterprise administrator has created an account on the cloud platform, and has created user groups and assigned them permissions in IAM. For details, see Creating a User Group and Assigning Permissions. The user groups created in IAM will be mapped to federated users so that the federated users can obtain the permissions of the user groups to use cloud resources.
                              • The enterprise administrator has read the help documentation of the enterprise IdP or has understood how to use the enterprise IdP. Configurations of different enterprise IdPs differ greatly, so they are not described in this document. For details about how to obtain an enterprise IdP's OAuth 2.0 credentials, see the IdP help documentation.
                              -

                              Creating OAuth 2.0 Credentials in the Enterprise IdP

                              1. Set redirect URLs https:///authui/oidc/redirect and https:///authui/oidc/post in the enterprise IdP so that users can be redirected to the OpenID Connect IdP in the cloud platform.
                              2. Obtain OAuth 2.0 credentials of the enterprise IdP.
                              +

                              Creating OAuth 2.0 Credentials in the Enterprise IdP

                              1. Set redirect URIs https:///authui/oidc/redirect and https:///authui/oidc/post in the enterprise IdP so that users can be redirected to the OpenID Connect IdP in the cloud platform.
                              2. Obtain OAuth 2.0 credentials of the enterprise IdP.
                              -

                              Creating an IdP Entity on the Cloud Platform

                              Create an IdP entity and configure authorization information in IAM to establish a trust relationship between the enterprise IdP and IAM

                              -
                              1. Log in to the IAM console, choose Identity Providers from the navigation pane, and click Create Identity Provider in the upper right corner.

                                Figure 1 Creating an IdP entity
                                +

                                Creating an IdP Entity on the Cloud Platform

                                Create an IdP entity and configure authorization information in IAM to establish a trust relationship between the enterprise IdP and IAM.

                                +
                                1. Log in to the IAM console, choose Identity Providers from the navigation pane, and click Create Identity Provider in the upper right corner.

                                  Figure 1 Creating an IdP entity

                                2. Enter an IdP name, select OpenID Connect and Enabled, and click OK.

                                  Figure 2 Setting IdP parameters

                                  The IdP name must be unique under your account. You are advised to use the domain name.

                                  @@ -100,7 +100,7 @@

                              -

                              Related Operations

                              • Viewing IdP information: In the IdP list, click View in the row containing the IdP, and view its basic information, metadata, and identity conversion rules.

                                To modify the configuration of an IdP, click Modify at the bottom of the details page.

                                +

                                Related Operations

                                • Viewing IdP information: In the IdP list, click View in the row containing the IdP, and view its basic information, metadata configuration, and identity conversion rules.

                                  To modify the configuration of an IdP, click Modify at the bottom of the details page.

                                • Modifying an IdP: In the IdP list, click Modify in the row containing the IdP, and then change its status or modify the description, metadata, or identity conversion rules.
                                • Deleting an IdP: In the IdP list, click Delete in the row containing the IdP, and click Yes in the displayed dialog box.
                                diff --git a/docs/iam/umn/iam_08_0010.html b/docs/iam/umn/iam_08_0010.html index 5edb05d1..6d8029ce 100644 --- a/docs/iam/umn/iam_08_0010.html +++ b/docs/iam/umn/iam_08_0010.html @@ -6,7 +6,7 @@

                                Overview of Virtual User SSO via OpenID Connect

                                This section describes how to configure identity federation and how identity federation works.

                                Configuring Identity Federation

                                The following describes how to configure your enterprise IdP and the cloud platform to trust each other.

                                -
                                1. Create an IdP entity and establish a trust relationship: Create OAuth 2.0 credentials in the enterprise IdP. In the cloud platform, create an IdP entity and establish a trust relationship between the two systems.
                                2. Configure identity conversion rules: Configure identity conversion rules in the cloud platform to map the users, user groups, and permissions in the enterprise IdP to the cloud platform.
                                3. Configure a federated login entry: Configure the login link in the enterprise IdP to allow enterprise users to be redirected to the cloud platform from your enterprise management system.
                                +
                                1. Create an IdP entity and establish a trust relationship: Create OAuth 2.0 credentials in the enterprise IdP. On the cloud platform, create an IdP entity and establish a trust relationship between the two systems.
                                2. Configure identity conversion rules: Configure identity conversion rules on the cloud platform to map the users, user groups, and permissions in the enterprise IdP to the cloud platform.
                                3. Configure a federated login entry: Configure the login link in the enterprise IdP to allow enterprise users to be redirected to the cloud platform from your enterprise management system.

                                How Identity Federation Works

                                Figure 1 shows the identity federation process between an enterprise management system and the cloud platform.

                                Figure 1 How identity federation works
                                diff --git a/docs/iam/umn/iam_08_0025.html b/docs/iam/umn/iam_08_0025.html index f9641cff..bf72d4c6 100644 --- a/docs/iam/umn/iam_08_0025.html +++ b/docs/iam/umn/iam_08_0025.html @@ -5,7 +5,7 @@

                                Step 4: Verify the Federated Login

                                Verifying the Federated Login

                                Federated users can initiate a login from the IdP or SP.

                                -
                                • Initiating a login from an IdP, for example, Microsoft Active Directory Federation Services (AD FS) or Shibboleth.
                                • Initiating a login from the SP. You can obtain the login link from the IdP details page on the IAM console.
                                +
                                • Initiating a login from an IdP, for example, Microsoft Active Directory Federation Services (AD FS) or Shibboleth.
                                • Initiating a login from the SP (the cloud platform). You can obtain the login link from the IdP details page on the IAM console.

                                The IdP-initiated login method depends on the IdP. For details, see the IdP help documentation. This section describes how to initiate a login from the SP.

                                1. Log in as a federated user.

                                  On the Identity Providers page of the IAM console, click View in the row containing the IdP. Click to copy the login link displayed in the Basic Information area, open the link using a browser, and then enter the username and password used in the enterprise management system.

                                  diff --git a/docs/iam/umn/iam_08_0251.html b/docs/iam/umn/iam_08_0251.html index a825c011..16a170c3 100644 --- a/docs/iam/umn/iam_08_0251.html +++ b/docs/iam/umn/iam_08_0251.html @@ -12,7 +12,7 @@
                                • The cloud products you use do not support virtual user SSO.
                                • You do not need virtual user SSO and want to simplify the IdP configuration.

                                Differences Between Virtual User SSO and IAM User SSO

                                The differences between virtual user SSO and IAM user SSO are described as follows:

                                -

                                1. Identity conversion: Virtual user SSO uses identity conversion rules while IAM user SSO uses external identity IDs for identity conversion. An IdP user will be mapped to an IAM user if the IAM_SAML_Attributes_xUserId value of the IdP user is the same as the external identity ID of the IAM user. When you use IAM user SSO, make sure that you have set IAM_SAML_Attributes_xUserId in the IdP and External Identity ID in the SP to the same value.

                                +

                                1. Identity conversion: Virtual user SSO uses identity conversion rules while IAM user SSO uses external identity IDs for identity conversion. If the IAM_SAML_Attributes_xUserId value of one or more IdP users is the same as the external identity ID of an IAM user, these IdP users will be mapped to the IAM user. When you use IAM user SSO, make sure that you have set IAM_SAML_Attributes_xUserId in the IdP and External Identity ID in the SP to the same value.

                                2. User identity in IAM: In virtual user SSO, the IdP user does not have a corresponding IAM user in the IAM user list. After the IdP user logs in, the system automatically creates a virtual user for it. In IAM user SSO, the IdP user has a IAM user mapped by external identity ID on the IAM console.

                                3. Permissions assignment in IAM: In virtual user SSO, the permissions of the IdP user are defined by the identity conversion rule. In IAM user SSO, the IdP user inherits the permissions of the user group which the mapped IAM user belongs to.

                                diff --git a/docs/iam/umn/iam_08_0252.html b/docs/iam/umn/iam_08_0252.html index 002110a2..1963fc07 100644 --- a/docs/iam/umn/iam_08_0252.html +++ b/docs/iam/umn/iam_08_0252.html @@ -18,15 +18,7 @@
                              - - - - -
                              Table 1 Parameter description

                              Parameter

                              Description

                              +

                              Description

                              Remarks

                              +

                              Remarks

                              Username

                              +

                              Username

                              Username of federated users in the cloud platform.

                              +

                              Username of federated users in the cloud platform.

                              To distinguish federated users from users in the cloud platform, it is recommended that you set the username to FederationUser-IdP_XXX. IdP indicates an IdP name, for example, AD FS or Shibboleth. XXX indicates a custom name.

                              +

                              To distinguish federated users from users in the cloud platform, it is recommended that you set the username to FederationUser-IdP_XXX. IdP indicates an IdP name, for example, AD FS or Shibboleth. XXX indicates a custom name.

                              NOTICE:
                              • The username of each federated user must be unique in the same IdP. Federated users with the same usernames in the same IdP will be mapped to the same IAM user in the cloud platform.
                              • The username can only contain letters, digits, spaces, hyphens (-), underscores (_), and periods (.). It cannot start with a digit and cannot contain the following special characters: ", \", \\, \n, \r

                              User Groups

                              +

                              User Groups

                              User groups which the federated users belong to in the cloud platform.

                              +

                              User groups which the federated users belong to in the cloud platform.

                              The federated users will inherit permissions from their user groups. You can select a user group that has already been created.

                              +

                              The federated users will inherit permissions from their user groups. You can select a user group that has already been created.

                              Rule Conditions

                              +

                              Rule Conditions

                              Conditions that a federated user must meet to obtain permissions from the selected user groups.

                              +

                              Conditions that a federated user must meet to obtain permissions from the selected user groups.

                              Federated users who do not meet these conditions cannot access the cloud platform. You can create a maximum of 10 conditions for an identity conversion rule.

                              +

                              Federated users who do not meet these conditions cannot access the cloud platform. You can create a maximum of 10 conditions for an identity conversion rule.

                              NOTE:
                              • An identity conversion rule can have multiple conditions. It takes effect only if all of the conditions are met.
                              • An IdP can have multiple identity conversion rules. If a federated user does not meet any of the conditions, the user will be denied to access the cloud platform.

                              Target URL which the federated user will be redirected to

                              During SSO login, the federated user will be redirected to a page on the cloud platform .

                              -

                              IAM_SAML_Attributes_xUserId

                              -

                              ID of an enterprise IdP user (federated user)

                              -

                              This parameter is mandatory when the SSO type is IAM user.

                              -

                              Each federated user is mapped to an IAM user. The IAM_SAML_Attributes_xUserId of the federated user is the same as the external identity ID of the corresponding IAM user.

                              +

                              During SSO login, the federated user will be redirected to a page on the cloud platform.

                              IAM_SAML_Attributes_domain_id

                              diff --git a/docs/iam/umn/iam_08_0254.html b/docs/iam/umn/iam_08_0254.html index 31488b0c..dfd29688 100644 --- a/docs/iam/umn/iam_08_0254.html +++ b/docs/iam/umn/iam_08_0254.html @@ -11,7 +11,7 @@

                              Configuring Identity Federation

                              The following describes how to configure your enterprise IdP and the cloud platform to trust each other.

                              Figure 1 Configuration of IAM user SSO via SAML
                              1. Create an IdP entity and establish a trust relationship: Create an IdP entity for your enterprise on the cloud platform. Then, upload the cloud platform metadata file to the enterprise IdP, and upload the metadata file of the enterprise IdP to the cloud platform.
                                Figure 2 Exchanging metadata files
                                -
                              2. Configure the enterprise IdP: Configure enterprise IdP parameters to determine what information can be sent to the cloud platform.
                              3. Configure an external identity ID on IAM: Establish a mapping between an IAM user and an enterprise user. When your enterprise IdP establishes SSO access to the cloud platform, the enterprise user can log in to the cloud platform as the IAM user with the specified external identity ID. For example, if an enterprise user IdP_Test_User is mapped to the IAM user Alice, the enterprise user IdP_Test_User will log in to the cloud platform as the IAM user Alice.
                                Figure 3 Mapping external identities to IAM users
                                +
                              4. Configure the enterprise IdP: Configure enterprise IdP parameters to determine what information can be sent to the cloud platform.
                              5. Configure an external identity ID: Establish a mapping between an IAM user and an enterprise user. When your enterprise IdP establishes SSO access to the cloud platform, the enterprise user can log in to the cloud platform as the IAM user with the specified external identity ID. For example, if an enterprise user IdP_Test_User is mapped to the IAM user Alice, the enterprise user IdP_Test_User will log in to the cloud platform as the IAM user Alice.
                                Figure 3 Mapping external identities to IAM users
                              6. Verify the federated login: Check whether the enterprise user can log in to the cloud platform through SSO.
                              7. (Optional) Configure a federated login entry: Configure the login link (see Figure 4) in the enterprise IdP to allow enterprise users to be redirected to the cloud platform from your enterprise management system.
                                Figure 4 SSO login model
                              diff --git a/docs/iam/umn/iam_08_0255.html b/docs/iam/umn/iam_08_0255.html index ecaca536..dc533a83 100644 --- a/docs/iam/umn/iam_08_0255.html +++ b/docs/iam/umn/iam_08_0255.html @@ -11,7 +11,7 @@

                            4. Upload the metadata file to the enterprise IdP server. For details, see the help documentation of the enterprise IdP.
                            5. Obtain the metadata file of the enterprise IdP. For details, see the help documentation of the enterprise IdP.

                              6. Creating an IdP Entity on the Cloud Platform

                              To create an IdP entity on the IAM console, do as follows:

                              -
                              1. Log in to the IAM console, choose Identity Providers from the navigation pane, and click Create Identity Provider in the upper right corner.

                                Figure 1 Creating an IdP entity
                                +
                                1. Log in to the IAM console, choose Identity Providers from the navigation pane, and click Create Identity Provider in the upper right corner.

                                  Figure 1 Creating an IdP entity

                                2. Specify the name, protocol, SSO type, status, and description of the IdP entity.

                                  Figure 2 Setting IdP parameters
                                  Table 1 Basic parameters of an IdP

                                  Parameter

                                  diff --git a/docs/iam/umn/iam_08_0256.html b/docs/iam/umn/iam_08_0256.html index 1a496c83..65d485bf 100644 --- a/docs/iam/umn/iam_08_0256.html +++ b/docs/iam/umn/iam_08_0256.html @@ -21,7 +21,7 @@

                                  ID of an enterprise IdP user (federated user)

                                  This parameter is mandatory when the SSO type is IAM user.

                                  -

                                  Each federated user is mapped to an IAM user. The IAM_SAML_Attributes_xUserId of the federated user is the same as the external identity ID of the corresponding IAM user.

                                  +

                                  Each federated user is mapped to an IAM user. The IAM_SAML_Attributes_xUserId of the federated user is the same as the external identity ID of the corresponding IAM user.

                                  IAM_SAML_Attributes_redirect_url

                                  diff --git a/docs/iam/umn/iam_08_0259.html b/docs/iam/umn/iam_08_0259.html index 55b1de5b..d220c6fe 100644 --- a/docs/iam/umn/iam_08_0259.html +++ b/docs/iam/umn/iam_08_0259.html @@ -7,9 +7,9 @@

                                  Configure a federated login entry in the enterprise IdP so that enterprise users can use the login link to access the cloud platform.

                                  Prerequisites

                                  • An IdP entity has been created on the cloud platform, and the login link for the IdP is available. For details, see Step 1: Create an IdP Entity.
                                  • The login entry for logging in to the cloud platform has been configured in the enterprise management system.
                                  -

                                  Procedure

                                  1. Log in to the IAM console. In the navigation pane, choose Identity Providers.
                                  2. Click View in the row containing the IdP.

                                    Figure 1 Viewing IdP details
                                    -

                                  3. Copy the login link by clicking in the Login link row.

                                    Figure 2 Copying the login link
                                    -

                                  4. Add the following statement to the page file of the enterprise management system:

                                    <a href="<Login link>"> Cloud platform login entry </a>
                                    +

                                    Procedure

                                    1. Log in to the IAM console. In the navigation pane, choose Identity Providers.
                                    2. Click View in the row containing the IdP.

                                      Figure 1 Viewing IdP details
                                      +

                                    3. Copy the login link by clicking in the Login Link row.

                                      Figure 2 Copying the login link
                                      +

                                    4. Add the following statement to the page file of the enterprise management system:

                                      <a href="<Login link>"> Cloud platform login entry </a>

                                    5. Log in to the enterprise management system using your enterprise account, and click the configured login link to access the cloud platform.