forked from laiweijian4/doc-exports
Zheng, Xiu
5b5876528a
Reviewed-by: Pruthi, Vineet <vineet.pruthi@t-systems.com> Co-authored-by: Zheng, Xiu <zhengxiu@huawei.com> Co-committed-by: Zheng, Xiu <zhengxiu@huawei.com>
83 lines
4.9 KiB
HTML
83 lines
4.9 KiB
HTML
<a name="css_01_0086"></a><a name="css_01_0086"></a>
|
|
|
|
<h1 class="topictitle1">CSS Custom Policies</h1>
|
|
<div id="body0000001334739173"><p id="css_01_0086__p8060118">Custom policies can be created to supplement the system-defined policies of CSS. For the actions supported for custom policies, see Permissions Policies and Supported Actions.</p>
|
|
<p id="css_01_0086__p18119246101411">You can create custom policies in either of the following ways:</p>
|
|
<ul id="css_01_0086__ul611914619143"><li id="css_01_0086__li51194467143">Visual editor: Select cloud services, actions, resources, and request conditions. You do not need to have knowledge of the policy syntax.</li><li id="css_01_0086__li1012004631418">JSON: Create a JSON policy or edit based on an existing policy.</li></ul>
|
|
<p id="css_01_0086__p1761612181719">For details about how to create custom policies, see <a href="https://docs.otc.t-systems.com/usermanual/iam/en-us_topic_0274187246.html" target="_blank" rel="noopener noreferrer">Creating a Custom Policy</a>. The following section contains examples of common CSS custom policies.</p>
|
|
<div class="note" id="css_01_0086__note185014141059"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="css_01_0086__p05121415516">IAM permissions and data plane cluster permissions are managed separately. To enable the security capability of the data plane, you need to use the security mode.</p>
|
|
</div></div>
|
|
<div class="section" id="css_01_0086__section11742221141718"><h4 class="sectiontitle">Example Custom Policies</h4><div class="p" id="css_01_0086__p1432933191710">Example 1: Allowing users to create a CSS cluster<pre class="screen" id="css_01_0086__screen152401381336">{
|
|
"Version": "1.1",
|
|
"Statement": [
|
|
{
|
|
"Action": [
|
|
"css:cluster:create",
|
|
"vpc:securityGroups:get",
|
|
"vpc:securityGroups:create",
|
|
"vpc:securityGroups:delete",
|
|
"vpc:securityGroupRules:get",
|
|
"vpc:securityGroupRules:create",
|
|
"vpc:securityGroupRules:delete",
|
|
"vpc:vpcs:list",
|
|
"vpc:privateIps:list",
|
|
"vpc:ports:get",
|
|
"vpc:ports:create",
|
|
"vpc:ports:update",
|
|
"vpc:ports:delete",
|
|
"vpc:quotas:list",
|
|
"vpc:subnets:get",
|
|
"ecs:cloudServerFlavors:get",
|
|
"ecs:serverInterfaces:use",
|
|
"ecs:cloudServers:addNics",
|
|
"ecs:quotas:get",
|
|
"evs:types:get",
|
|
"evs:quotas:get"
|
|
],
|
|
"Effect": "Allow"
|
|
}
|
|
]
|
|
}</pre>
|
|
</div>
|
|
</div>
|
|
<p id="css_01_0086__p621012411612">Example 2: Denying cluster deletion</p>
|
|
<p id="css_01_0086__p330217517918">A policy with only <strong id="css_01_0086__b280663672512">Deny</strong> permissions must be used in conjunction with other policies for it to take effect. If the permissions assigned to a user contain both <strong id="css_01_0086__b10916207112917">Allow</strong> and <strong id="css_01_0086__b18462108298">Deny</strong>, the <strong id="css_01_0086__b136841411142913">Deny</strong> permissions take precedence over the <strong id="css_01_0086__b449222772919">Allow</strong> permissions.</p>
|
|
<p id="css_01_0086__p153024511596">The following method can be used if you need to assign permissions of the <strong id="css_01_0086__b58500418547">CSS Admin</strong> policy to a user but you want to prevent the user from deleting clusters. Create a custom policy for denying cluster deletion, and attach both policies to the group to which the user belongs. Then, the user can perform all operations on CSS except deleting clusters. The following is an example of a deny policy:</p>
|
|
<pre class="screen" id="css_01_0086__screen16334701457">{
|
|
"Version": "1.1",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Deny",
|
|
"Action": [
|
|
"css:cluster:delete"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
</pre>
|
|
<p id="css_01_0086__p878717221976">Example 3: Defining permissions for multiple services in a policy</p>
|
|
<p id="css_01_0086__p3199162311713">A custom policy can contain the actions of multiple services that are of the global or project-level type. The following is an example policy containing actions of multiple services:</p>
|
|
<pre class="screen" id="css_01_0086__screen1481815563226">{
|
|
"Version": "1.1",
|
|
"Statement": [
|
|
{
|
|
"Action": [
|
|
"ecs:cloudServers:resize",
|
|
"ecs:cloudServers:delete",
|
|
"ecs:cloudServers:delete",
|
|
"css:cluster:restart",
|
|
"css:*:get*",
|
|
"css:*:list*"
|
|
],
|
|
"Effect": "Allow"
|
|
}
|
|
]
|
|
}</pre>
|
|
</div>
|
|
<div>
|
|
<div class="familylinks">
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="css_01_0070.html">Permissions Management</a></div>
|
|
</div>
|
|
</div>
|
|
|