Policies and groups
In this article:
Policies and groups#
A user must be explicitly granted permissions to work with a specific K2 Cloud service. Permissions — privileges in IAM terminology — are granted by assigning policies to the user that describe allowed actions (permissions). As a rule, a user is assigned several policies whose combination describes their privileges. Policy descriptions are stored as a JSON document.
To avoid granting privileges to each user individually, K2 Cloud uses a group mechanism. Like users, groups can be assigned their own policies. When added to a group, a user receives all privileges of that group. A user can be added to multiple groups. The resulting privileges are combined with the privileges granted to the user by individual policies.
Policies and groups are divided into global and project ones depending on which services they allow actions with. Global policies grant permissions for global services, and project policies grant permissions for project services. Different policy types cannot be assigned to the same group, i.e. a group can be either global or project. When attaching a project policy to a user or adding the user to a project group, you must specify the project in which the corresponding privileges are granted.
Attention
To manage user privileges, we recommend using groups instead of policies, because this simplifies granting privileges: you do not need to grant them to each user individually.
Policies#
Policies describe a set of permissions for actions that a user can perform on cloud resources. For example, a user may be allowed to start and stop instances, but not to delete them.
Policies can be global or project-specific depending on which services they authorize actions with. You cannot combine permissions for services of different types in a single policy. When assigning a project-specific policy to a user, it is necessary to specify a project in which the privileges are granted.
You can use predefined policies provided by K2 Cloud or define your own ones. The following policies are available in K2 Cloud by default:
Policy |
Description |
|---|---|
BillingFullAccess |
Full access to billing information |
IAMFullAccess |
Full set of permissions to administer users, projects, and groups under IAM |
Policy |
Description |
|---|---|
AutoScalingFullAccess |
Full set of permissions to work with instance groups and manage scaling policies |
BackupFullAccess |
Full set of permissions to manage backup operations |
BackupOperationsPolicy |
All actions with recovery points except for deletion |
CloudTrailFullAccess |
Full set of permissions to work with activity log |
CloudWatchFullAccess |
Full set of permissions to operate monitoring service |
CloudWatchReadOnlyAccess |
Full set of permissions to view the monitoring service |
EC2FullAccess |
Full set of permissions to manage infrastructure service |
EC2ReadOnlyAccess |
Full set of permissions to view the infrastructure service |
EFSFullAccess |
Full set of permissions to work with Elastic File System |
EKSClusterPolicy |
Required permissions for a service user to access all Kubernetes cluster providers |
EKSClusterAutoscalerPolicy |
Required permissions for a special user in the Cluster Autoscaler provider to scale node groups |
EKSCSIPolicy |
Required permissions for a special user in the EBS provider to manage volumes |
EKSNLBPolicy |
Required permissions for a special user in the ELB provider to manage load balancers |
EKSFullAccess |
Full set of permissions to manage Kubernetes clusters |
ELBFullAccess |
Full set of permissions to manage load balancers |
PaaSBackupPolicy |
Required permissions for a PaaS service to make backup copies |
PaaSFullAccess |
Full set of permissions to manage all PaaS services |
RCFullAccess |
Full set of permissions to access the remote console via the Web |
RCReadOnlyAccess |
Set of permissions to access the remote console via the Web in view-only mode |
RGTFullAccess |
Full set of permissions to manage resource tags |
Route53FullAccess |
Full set of permissions to manage the DNS service |
S3FullAccess |
Full set of permissions to work with object storage |
SQSFullAccess |
Full set of permissions to manage SQS |
Important
CloudTrail administrator policy allows users to control events in all projects of the company, regardless of which project they have been added to.
Create a policy#
In the web interface, expand the side menu by clicking the icon.
Go to IAM Policies. To find the section quickly, you can use the menu search.
Click Create.
On the page that opens, specify the policy name, policy type (global or project-specific), and, optionally, a description.
To add permissions to a policy:
In the Permission settings block, open the Form tab and select a service from the drop-down list.
In the nested Permissions configuration block, select the allowed actions. If you want to allow all actions with the service, select the Available permissions checkbox.
To allow actions with another service, click Add and specify the next set of permissions.
Note
The policy creation wizard lets you specify and edit a policy directly in JSON format. To do this, switch to the JSON editor tab.
After adding all required permissions, click Create.
Edit permissions#
When you add permissions, all users assigned this policy receive the corresponding privileges. For example, if you added a permission to terminate instances, they will be able to terminate instances. However, when you remove permissions from a policy, some users may still retain the corresponding privileges if they are granted by other policies attached to them or by groups they belong to.
Important
Predefined policies cannot be modified.
To modify permissions granted by a policy:
In the web interface, expand the side menu by clicking the icon.
Go to IAM Policies. To find the section quickly, you can use the menu search.
Select a policy in the resource list. To quickly find a policy, you can search by name and description.
Click Edit policy on the pop-up action bar.
On the page that opens, you can change the policy description and the permissions granted for services.
To add permissions for a service that is not included in the policy:
In the Permission settings block, on the Form tab, click Add.
Select a service from the drop-down list in the block that appears.
In the nested Permissions configuration block, select the allowed actions. If you want to allow all actions with the service, select the Available permissions checkbox.
To change permissions for a service that is included in the policy:
On the Form tab, find the block with permissions for the service.
Select or clear the checkbox next to the action that you want to add to or exclude from the allowed actions.
To remove permissions for all actions with a service:
On the Form tab, find the block with permissions for the service.
Clear the checkboxes next to all allowed actions if not all actions are allowed. Clear the checkbox next to the service name if all actions are allowed.
Note
You can change permissions in the JSON editor. To do this, switch to the JSON editor tab.
Once you have made all the required modifications, click Save.
You can also change permissions on the policy page on the Information tab.
Duplicate a policy#
You can create a policy based on an existing one.
In the web interface, expand the side menu by clicking the icon.
Go to IAM Policies. To find the section quickly, you can use the menu search.
Select a policy in the resource list. To quickly find a policy, you can search by name and description.
Click Duplicate policy on the pop-up action bar.
On the page that opens, specify a name for the new policy. You can also change the policy description and configure the permissions granted for services:
To add permissions for a service that is not included in the policy:
In the Permission settings block, on the Form tab, click Add.
Select a service from the drop-down list in the block that appears.
In the nested Permissions configuration block, select the allowed actions. If you want to allow all actions with the service, select the Available permissions checkbox.
To change permissions for a service that is included in the policy:
On the Form tab, find the block with permissions for the service.
Select or clear the checkbox next to the action that you want to add to or exclude from the allowed actions.
Note
You can configure permissions in the JSON editor. To do this, switch to the JSON editor tab.
After making all required changes, click Create.
View a policy in JSON format#
In the web interface, expand the side menu by clicking the icon.
Go to IAM Policies. To find the section quickly, you can use the menu search.
Select a policy in the resource list. To quickly find a policy, you can search by name and description.
Click Show JSON on the pop-up action bar.
After viewing the policy, click to close the window.
You can also view the policy description in JSON format on the policy page. To do this, on the Information tab, in the Policy permissions block, switch to the JSON format tab.
Delete a policy#
Before deleting a policy, first delete it from all users to whom it is assigned and from all groups to which it is added.
Note
Predefined policies cannot be deleted.
In the web interface, expand the side menu by clicking the icon.
Go to IAM Policies. To find the section quickly, you can use the menu search.
Select a policy in the resource list. To quickly find a policy, you can search by name and description.
Click Delete on the pop-up action bar.
In the dialog window, confirm the action.
Alternatively, you can delete a policy on its page in the Information tab.
Groups#
Using groups lets you grant the same privileges to all group members at once instead of assigning them to each user individually. When added to a group, a user receives all privileges granted by that group. When group permissions change, the privileges of all users in the group change automatically.
Group’s privileges are determined by policies that are assigned to it. Depending on the type (global or project-specific) groups can only be assigned policies of the appropriate type. When you include users in a project group, specify the project in which they will be granted group privileges.
You can use predefined groups provided by K2 Cloud or create your own ones. The following groups are available in K2 Cloud by default:
Group |
Type |
Description |
Applicable policies |
|---|---|---|---|
ActivityLogAdministrators |
Project |
Full set of permissions to work with the Activity Log service |
CloudTrailFullAccess |
AutoScalingAdministrators |
Project |
Full set of permissions to work with the Auto Scaling service |
AutoScalingFullAccess |
BackupAdministrators |
Project |
Full set of permissions to manage backup operations |
BackupFullAccess |
BackupOperators |
Project |
All actions with recovery points except for deletion |
BackupOperationsPolicy |
BillingAdministrators |
Global |
Full access to billing information |
BillingFullAccess |
CloudAdministrators |
Project |
Full set of permissions to work with all project resources, except access to the Activity Log service and deletion of backups |
AutoScalingFullAccess |
ELBAdministrators |
Project |
Full set of permissions to work with load balancers |
ELBFullAccess |
IAMAdministrators |
Global |
Full set of permissions to administer users and projects within IAM |
IAMFullAccess |
InstanceAdministrators |
Project |
Full set of privileges to work with instances |
CloudWatchFullAccess |
InstanceViewers |
Project |
Required privileges to view instances |
CloudWatchReadOnlyAccess |
ObjectStorageAdministrators (object storage administrators) |
Project |
Full set of permissions to work with object storage |
S3FullAccess |
Route53Administrators (DNS service administrators) |
Project |
Full set of permissions to work with the DNS service |
Route53FullAccess |
Create a group#
In the web interface, expand the side menu by clicking the icon.
Go to IAM Groups. To find the section quickly, you can use the menu search.
Click Create.
On the page that opens, specify a name for the group and select the group type (global or project).
In the Policies block, select the policies to add to the group. To quickly find a policy, you can search by its name.
After adding all required policies, click Create.
Modify assigned policies#
You can assign other policies to a group after it has been created. This will change the corresponding privileges of the users who are members of the group.
Important
You cannot change the policies assigned to predefined groups.
To change the policies assigned to a group:
In the web interface, expand the side menu by clicking the icon.
Go to IAM Groups. To find the section quickly, you can use the menu search.
Find the group in the resource list. To find a group quickly, you can search by its name. Click the group name to go to its page.
In the Policy list block, click to change the list of policies.
Find the required policies in the policy tree. To quickly find a policy, you can search by its name. Policies included in the group are displayed in the pane to the right of the policy tree.
To add a policy to the group, select it (select next to the policy). To remove a policy from the group, clear next to the policy name, or click next to the policy name in the pane to the right of the policy tree.
Click Save.
You can also change the attached policies on the Information and policies tab on the group page.
Change the group members#
Add users to a group#
When adding users to a project group, it is necessary to specify a project in which they will be granted the privileges of the group.
In the web interface, expand the side menu by clicking the icon.
Go to IAM Groups. To find the section quickly, you can use the menu search.
Find the group in the resource list. To find a group quickly, you can search by its name. Click the group name to go to its page.
Open the Users tab and click Add users.
For a project group, select the project that users will be granted permissions to work with. For a global group, the Project field is not displayed.
In the Users field, select the users to add from the drop-down list.
To complete the operation, click Add.
Delete users from a group#
In a project group, the same user can have privileges in several projects. Therefore, to remove a user from the group, select all projects where the user has privileges.
In the web interface, expand the side menu by clicking the icon.
Go to IAM Groups. To find the section quickly, you can use the menu search.
Find the group in the resource list. To find a group quickly, you can search by its name. Click the group name to go to its page.
Open the Users tab. For a project group, select All projects in the project selector.
In the resource table, select the user or users you want to delete from the group. To quickly find a particular user, you can search by name. For a project group, you must select all occurrences of the user.
Click Delete on the pop-up action bar.
In the window that opens, confirm the deletion.
Revoke group privileges in a project#
To revoke a user’s privileges in a specific project in the case of a project group:
In the web interface, expand the side menu by clicking the icon.
Go to IAM Groups. To find the section quickly, you can use the menu search.
Find the group in the resource list. To find a group quickly, you can search by its name. Click the group name to go to its page.
Open the Users tab and select the desired project in the project selector.
In the resource table, select the user or users from whom you want to revoke group privileges in the selected project. To quickly find a particular user, you can search by name.
Click Delete on the pop-up action bar.
In the dialog window, confirm the action.
Delete a group#
Note
Before deleting a group, you must remove all users from it.
In the web interface, expand the side menu by clicking the icon.
Go to IAM Groups. To find the section quickly, you can use the menu search.
Select a group in the resource list. To quickly find a group, you can search by its name.
Click Delete on the pop-up action bar.
In the dialog window, confirm the action.
You can also delete a group on its page.