Users and projects
In this article:
Users and projects#
General information#
The IAM service provides authorization and authentication of users when they access your company account in K2 Cloud. It allows you to grant a user the privileges required to work with specific cloud resources depending on their tasks and functions. For example, you can allow a specific user to work with all infrastructure resources (instances, volumes, network interfaces, etc.), restrict their access to object storage only, and so on.
Authentication verifies the user’s identity. Each IAM user receives their own login and password to sign in to K2 Cloud. If necessary, they can also be issued their own access key to manage cloud resources via the API. For the user to work with specific services, they must be granted the corresponding privileges. Authorization checks whether the user has the privileges required to work with resources (for details, see IAM policies and groups).
In the IAM context, there are two types of cloud services: global and project-specific. The former include billing and IAM itself, while resources of all other services belong to a particular project. Using projects as high-level containers for resources allows you to provision dedicated cloud infrastructure for a separate company division or specific task.
Note
Resources within projects can be located in different regions, while the project privileges granted to users apply to all regions.
Billing#
The IAM service is free of charge.
Available quotas#
The following default quotas are allocated to the IAM service:
5 projects;
100 users.
If necessary, you can increase quotas. To do this, contact the support service via the support portal or by email support@k2.cloud.
Users#
In the Users subsection, you can create new users and manage existing ones.
Note
To perform service functions, system user is created, along with the account.
Create a user and configure privileges#
When creating a user, you can configure project and global privileges. The same set of project privileges can be granted to the user in multiple projects at once using privilege sets.
Important
Global privileges for the Billing and IAM services allow you to manage permissions for actions with cloud resources and view sensitive information about tariffs and charges, so we recommend granting them with caution only to trusted persons.
To do this:
In the web interface, expand the side menu by clicking the icon.
Go to IAM Users. To find the section quickly, you can use the menu search.
Click Create.
In the window that opens fill the required fields:
ID (user login). The identifier has the form: <username>@<customer>, where customer is the company name specified at cloud registration. Only Latin letters, digits, and the
.,_, and-characters are allowed in the identifier.Name. Both Roman and Cyrillic letters, as well as various characters, may be used.
email. User’s email. It is strongly recommended to always specify user’s email, since notifications of updates, maintenance works, backup errors and other events will be sent to this address.
The Require two-factor authentication (2FA) checkbox. When creating a user, you can require them to use mandatory two-factor authentication. In this case, when the user logs in to the cloud for the first time, a requirement to enable 2FA and relevant instructions are displayed.
Password. You can automatically generate a password or set your own. When setting a password, consider the password strength requirements.
Tags. (Optional) If you need to assign tags, click Add tag. Specify the tag key and its value. To assign more than one tag, click Add tag again.
To set privileges, click Next to go to the next step.
You can skip this step and set privileges later.
To set a privilege set for actions with project services, click Add in the Project privileges block. In the Projects field, select the projects to which this privilege set will apply.
To grant project privileges, you can add the user to one or more IAM groups or add the required project policies:
To add the user to IAM groups, expand the list of available groups and select the required ones.
Hint
You can view which policies are included in an IAM group by clicking .
To attach policies to the user, expand the list of available policies and select the required policies.
Hint
You can view which permissions a particular policy grants by clicking to the right of the policy name (the icon appears when you hover the cursor over the policy name).
To set a different privilege set for other projects, click Add.
To set global privileges, click Add global privileges in the Global privileges block.
To grant global privileges, you can add the user to one or more IAM groups or add the required global policies.
To add the user to IAM groups, expand the list of available groups and select the required ones.
To attach policies to the user, expand the list of available policies and select the required policies.
Hint
You can view which permissions a particular policy grants by clicking to the right of the policy name (the icon appears when you hover the cursor over the policy name).
After setting all required privileges, click Create. If necessary, you can change the granted privileges after the user is created.
Configure global grants#
To grant or change global privileges for actions with billing and IAM services:
In the web interface, expand the side menu by clicking the icon.
Go to IAM Users. To find the section quickly, you can use the menu search.
Find the required user in the list and click their ID to go to the user page.
Open the Privileges tab and click in the upper-right corner of the Global privileges block. To add a policy or IAM group, select next to the required policy or group. To remove a policy or IAM group, clear next to the unnecessary group or policy, or click next to them in the list of selected groups and policies on the right.
After making the changes, click Save.
Configure project privileges#
Important
Privileges for actions with Activity Log allow you to control events in all company projects, regardless of which project they were added in.
Add user to project#
When adding a user to a project, you can immediately set the required privileges in the project. Privileges can be granted by adding the user to the corresponding group or by attaching a policy.
Note
When adding a user to a project, select at least one group or policy.
In the web interface, expand the side menu by clicking the icon.
Go to IAM Users. To find the section quickly, you can use the menu search.
Find the required user in the list and click their ID to go to the user page.
Open the Privileges tab and click Add to project. If the button is not displayed, open the additional actions menu by clicking .
To grant privileges in the project, you can add the user to one or more IAM groups or attach the required project policies:
To add the user to IAM groups, expand the list of available groups and select the required ones.
Hint
You can view which policies are included in an IAM group by clicking .
To attach policies to the user, expand the list of available policies and select the required policies.
Hint
You can view which permissions a particular policy grants by clicking to the right of the policy name (the icon appears when you hover the cursor over the policy name).
After granting all required privileges, click Add.
Change project privileges#
If the user has been granted project privileges in a project, to modify them:
In the web interface, expand the side menu by clicking the icon.
Go to IAM Users. To find the section quickly, you can use the menu search.
Find the required user in the list and click their ID to go to the user page.
Open the Privileges tab, find the block with privileges for the project, and click in the upper-right corner of the block.
To add a policy or IAM group, select next to the required policy or group. To remove a policy or IAM group, clear next to the unnecessary policy or group, or click next to them in the list of selected groups and policies on the right.
After making the changes, click Save.
Revoke all privileges in the project#
To remove all user privileges in a specific project:
In the web interface, expand the side menu by clicking the icon.
Go to IAM Users. To find the section quickly, you can use the menu search.
Find the required user in the list and click their ID to go to the user page.
Open the Privileges tab, find the block with privileges for the project, and click in the upper-right corner of the block.
Set up user profile#
Change user data#
To change user personal data:
In the web interface, expand the side menu by clicking the icon.
Go to IAM Users. To find the section quickly, you can use the menu search.
Find the required user in the list and click their ID to go to the user page.
On the Information tab, click the edit icon next to the corresponding field:
name;
email;
phone number.
After editing the corresponding field, click to save the changes.
Change user password#
In the web interface, expand the side menu by clicking the icon.
Go to IAM Users. To find the section quickly, you can use the menu search.
Find the required user in the list and click their ID to go to the user page.
Click Change password. You can automatically generate a new password or set your own.
To save the password, click Save.
Configure the two-factor authentication enforcement#
In the web interface, expand the side menu by clicking the icon.
Go to IAM Users. To find the section quickly, you can use the menu search.
Find the required user in the list and click their ID to go to the user page.
On the Information tab, set the Require two-factor authentication (2FA) switch to the required position.
Disable optional two-factor authentication#
A user can enable two-factor authentication on their own. If necessary, you can disable it.
In the web interface, expand the side menu by clicking the icon.
Go to IAM Users. To find the section quickly, you can use the menu search.
Find the required user in the list and click their ID to go to the user page.
Click Disable 2FA. The button is available only if the user has enabled two-factor authentication.
In the dialog window, confirm the action.
Configure notifications#
In the web interface, expand the side menu by clicking the icon.
Go to IAM Users. To find the section quickly, you can use the menu search.
Find the required user in the list and click their ID to go to the user page.
Open the Notifications tab and configure the notifications that the user should receive. To do this, move the switch next to the corresponding notification type to the desired position.
Note
The user can change the selection of notifications they want to receive in their profile.
Lock a user#
You can temporarily inactivate a user, for example, when the corresponding position becomes vacant.
In the web interface, expand the side menu by clicking the icon.
Go to IAM Users. To find the section quickly, you can use the menu search.
Find the required user in the list and click their ID to go to the user page.
In the Information tab, set the Status switch to the disabled position. To unlock a user, return the switch to the Active position.
Delete user#
In the web interface, expand the side menu by clicking the icon.
Go to IAM Users. To find the section quickly, you can use the menu search.
Select a user in the list and click Delete on the pop-up action bar. You can select multiple users for deletion at once.
In the dialog window, confirm the action.
You can also delete a user on their page on the Information tab. If the button is not displayed, open the additional actions menu by clicking .
Projects#
You can create projects and manage users in this subsection.
Create a project#
Note
When creating a project, the system user is granted necessary project privileges to perform service functions.
To add a new project:
In the web interface, expand the side menu by clicking the icon.
Go to IAM Projects. To find the section quickly, you can use the menu search.
Click Create.
In the window that opens, specify the project ID and name. The project ID is used when working with IAM API. The project name is displayed in the web interface when selecting a project in the top menu. Character constraints are the same as the user ID constraints.
Click Create again.
Add user to project#
When adding a user to a project, you can immediately set the required privileges in the project. Privileges can be granted by assigning a policy or adding the user to the corresponding IAM group.
Note
When adding a user to a project, you must select at least one policy or IAM group.
In the web interface, expand the side menu by clicking the icon.
Go to IAM Projects. To find the section quickly, you can use the menu search.
Find the project in the resource table and click its ID to go to the project page.
Open the Users tab and click Add users.
In the Users selector, select the users who should be granted the same privileges in the project.
To grant project privileges, you must add the selected users to one or more administrator groups or add project policies:
To add the user to IAM groups, expand the list of available groups and select the required ones.
Hint
You can view which policies are included in an IAM group by clicking .
To attach policies to the user, expand the list of available policies and select the required policies.
Hint
You can view which permissions a particular policy grants by clicking to the right of the policy name (the icon appears when you hover the cursor over the policy name).
To add users with a different privilege set, click Add.
After adding all users, click Add user.
Change user privileges in the project#
In the web interface, expand the side menu by clicking the icon.
Go to IAM Projects. To find the section quickly, you can use the menu search.
Select a project in the resource table and click its name to go to the project page.
Open the Users tab and select the user from the user table.
On the pop-up action bar, click Edit privileges.
To add a policy or IAM group, select next to the required policy or group. To remove a policy or IAM group, clear next to the unnecessary policy or group, or click next to them in the list of selected groups and policies on the right.
After making the changes, click Save.
Delete a user from a project#
In the web interface, expand the side menu by clicking the icon.
Go to IAM Projects. To find the section quickly, you can use the menu search.
Select a project in the resource table and click its name to go to the project page.
Open the Users tab and select a user in the users table. You can select multiple users for deletion at once.
On the pop-up action bar, click Delete to remove the user from the project.
In the dialog window, confirm the action.
Delete a project#
Attention
Deleting a project will permanently delete instances, VPCs, volumes, and other project resources. This action cannot be undone, so delete a project only when it is absolutely necessary.
Note
Users added to the project are not deleted — their privileges in this project are revoked.
In the web interface, expand the side menu by clicking the icon.
Go to IAM Projects. To find the section quickly, you can use the menu search.
In the resource table, select the project and click Delete on the pop-up action bar.
In the window that opens, the cloud will ask you to confirm project deletion. In the input field, enter the text Delete project <ID of the project to be deleted> if you are sure you want to delete it.
Click Delete project to complete the operation.
Alternatively, you can delete a project on its page in the Information tab.