resource-formation-service/umn/source/service_overview/permission.rst

original_name

en-us_topic_0000002154657157.html

Permission

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

RFS is a project-level service accessed in specific physical regions. To assign RFS permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing RFS, the users need to switch to a region where they have been authorized to use this service.

You can grant permissions by using roles and policies.

• Roles: A coarse-grained authorization mechanism that defines permissions related to user responsibilities. This mechanism provides a limited number of service-level roles for authorization. Open Telekom Cloud services depend on each other. When you grant permissions using roles, you may need to attach any existing role dependencies. However, roles are not ideal for fine-grained authorization and least privilege access.
• Policies: A fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for least privilege access.

Table 1 RFS system-defined permissions

Item	Description	Type
RF FullAccess	All permissions for RFS.	System-defined policy
RF DeployByExecutionPlanOperations	Create, apply, and read permissions for execution plans and read permissions for stacks.	System-defined policy
RF ReadOnlyAccess	Read-only permissions for RFS.	System-defined policy

Table 2 <en-us_topic_0000002154657157__table65762630> lists the common operations supported by each system-defined policy of RFS. Please choose proper policies according to this table.

Table 2 Common RFS operations supported by system-defined permissions

Operation	RF FullAccess	RF DeployByExecutionPlanOperations	RF ReadOnlyAccess
Create a template	Y	x	x
Create a template version	Y	x	x
Delete a template	Y	x	x
Delete a template version	Y	x	x
List templates	Y	Y	Y
List template versions	Y	Y	Y
Show template metadata	Y	x	Y
Show template version content	Y	Y	Y
Show template version metadata	Y	x	Y
Update template metadata	Y	x	x
Parse template variables	Y	Y	Y
Apply execution plan	Y	Y	x
Create execution plan	Y	Y	x
Delete execution plan	Y	x	x
Get execution plan	Y	Y	Y
Get execution plan metadata	Y	Y	Y
List execution plans	Y	Y	Y
Create stack	Y	x	x
Delete stack	Y	x	x
Deploy stack	Y	x	x
Continue to deploy stack	Y	x	x
Continue to rollback stack	Y	x	x
Get stack metadata	Y	Y	Y
Get stack template	Y	Y	Y
List stack events	Y	Y	Y
List stack outputs	Y	Y	Y
List stack resources	Y	Y	Y
List stacks	Y	Y	Y
Update stack	Y	x	x

If predefined permissions cannot meet your requirements, you can create custom policies. Custom policies allow you to perform fine-grained access control flexibly. For details about how to create a custom policy, see Creating a Custom Policy. For details about RFS example custom policies, see Custom Policies <en-us_topic_0000002158636644>.

The following table lists fine-grained actions and dependencies for RFS.

Table 3 RFS fine-grained actions

System-defined Permission	Description	Dependencies	Scenario
rf:privateTemplate:create	Grant permissions to create a template	None	Create a template
rf:privateTemplate:createVersion	Grant permissions to create a template version	rf:privateTemplate:list rf:privateTemplate:listVersions rf:privateTemplate:showVersionContent	Create a template version
rf:privateTemplate:delete	Grant permissions to delete a template	rf:privateTemplate:list	Delete a template
rf:privateTemplate:deleteVersion	Grant permissions to delete a template version	rf:privateTemplate:list rf:privateTemplate:listVersions	Delete a template version
rf:privateTemplate:list	Grant permissions to list templates	None	List templates
rf:privateTemplate:listVersions	Grant permissions to list template versions	rf:privateTemplate:list	List template versions
rf:privateTemplate:showMetadata	Grant permissions to show template metadata	rf:privateTemplate:list	Show template properties such as template name, ID and description
rf:privateTemplate:showVersionContent	Grant permissions to show template version content	rf:privateTemplate:list rf:privateTemplate:listVersions	Show template version content
rf:privateTemplate:showVersionMetadata	Grant permissions to show template version metadata	rf:privateTemplate:list rf:privateTemplate:listVersions	Show template version properties such as template version ID and description
rf:privateTemplate:updateMetadata	Grant permissions to update template metadata	rf:privateTemplate:list	Update template properties such as template description
rf:template:parseTemplateVariables	Grant permissions to parse template variables	None	Parse and return all variable blocks in the template
rf:stack:applyExecutionPlan	Grant permissions to apply execution plan	rf:stack:listStacks rf:stack:getStackMetadata rf:stack:listExecutionPlans	Deploy a stack via applying an execution plan
rf:stack:createExecutionPlan	Grant permissions to create execution plan	Required to locate the desired stack rf:stack:listStacks Required for creating an execution plan from a private template rf:privateTemplate:list rf:privateTemplate:listVersions rf:privateTemplate:showVersionContent Required for configuring template variables rf:template:parseTemplateVariables Required for template resource encryption kms:cmk:list kms:dek:create kms:dek:crypto	Create an execution plan
rf:stack:deleteExecutionPlan	Grant permissions to delete execution plan	rf:stack:listStacks rf:stack:getStackMetadata rf:stack:listExecutionPlans	Delete an execution plan
rf:stack:getExecutionPlan	Grant permissions to get execution plan	rf:stack:listStacks rf:stack:getStackMetadata rf:stack:listExecutionPlans rf:stack:getExecutionPlanMetadata	Get an execution plan which provides a preview of stack changes such as operations to be performed on resources
rf:stack:getExecutionPlanMetadata	Grant permissions to get execution plan metadata	rf:stack:listStacks rf:stack:getStackMetadata rf:stack:listExecutionPlans	Get execution plan properties such as execution plan name, ID and description
rf:stack:listExecutionPlans	Grant permissions to list execution plans	rf:stack:listStacks rf:stack:getStackMetadata	List execution plans
rf:stack:createStack	Grant permissions to create stack	Required for creating stack from a private template rf:privateTemplate:list rf:privateTemplate:listVersions rf:privateTemplate:showVersionContent Required for configuring template variables rf:template:parseTemplateVariables Required for template resource encryption kms:cmk:list kms:dek:create Required for configuring agency iam:agencies:listAgencies Required for stack creation using direct deployment rf:stack:deployStack Required for stack creation using execution plan rf:stack:createExecutionPlan	Create a stack
rf:stack:deleteStack	Grant permissions to delete stack	rf:stack:listStacks	Delete a stack
rf:stack:deployStack	Grant permissions to deploy stack	Required to locate the desired stack rf:stack:listStacks Required for directly deploy a private template rf:privateTemplate:list rf:privateTemplate:listVersions rf:privateTemplate:showVersionContent Required for configuring template variables rf:template:parseTemplateVariables Required for template resource encryption kms:cmk:list kms:dek:create	Deploy stack directly
rf:stack:continueDeployStack	Grant permissions to continue to deploy stack	rf:stack:listStacks Required for template resource encryption kms:dek:crypto	Retry failed stack deployment
rf:stack:continueRollbackStack	Grant permissions to continue to rollback stack. Currently this functionality is only available at the API level.	None	Retry failed stack rollback
rf:stack:getStackMetadata	Grant permissions to get stack metadata	rf:stack:listStacks	Get stack properties such as stack ID, name and description
rf:stack:getStackTemplate	Grant permissions to get stack template	rf:stack:listStacks rf:stack:getStackMetadata	Get stack template
rf:stack:listStackEvents	Grant permissions to list stack events	rf:stack:listStacks rf:stack:getStackMetadata	List stack events
rf:stack:listStackOutputs	Grant permissions to list stack outputs	rf:stack:listStacks rf:stack:getStackMetadata	List stack outputs
rf:stack:listStackResources	Grant permissions to list stack resources	rf:stack:listStacks rf:stack:getStackMetadata	List stack resources
rf:stack:listStacks	Grant permissions to list stacks	None	List stacks
rf:stack:updateStack	Grant permissions to update stack	rf:stack:listStacks rf:stack:getStackMetadata Required for configuring agency iam:agencies:listAgencies	Update stack properties such as description, auto-rollback and deletion protection

Note

• If an agency is configured for the stack, make sure that all necessary permissions are configured for the agency, which are required for stack deployment.
• If there is no configured agency for the stack, make sure that all necessary permissions are assigned to the user, which are required for stack deployment.

These permissions can be:

• Different cloud service specific permissions depending on the resources and the operations described in the terraform template.
• If the resource encryption is enabled in the terraform template, the kms:dek:crypto permission must be granted.

Related Documents

To learn about the IAM service, see What Is IAM?.

For details about how to create a user or a user group and how to grant RFS permissions, see Creating a User and Granting Permissions <en-us_topic_0000002158796408>.