Users and projects
In this article:
Users and projects#
General information#
The IAM service provides authorization and authentication of users when they access your company account in K2 Cloud. It allows you to grant a user the privileges required to work with specific cloud resources depending on their tasks and functions. For example, you can allow a specific user to work with all infrastructure resources (instances, volumes, network interfaces, etc.), restrict their access to object storage only, and so on.
Authentication verifies the user’s identity. Each IAM user receives their own login and password to sign in to K2 Cloud. If necessary, they can also be issued their own access key to manage cloud resources via the API. For the user to work with specific services, they must be granted the corresponding privileges. Authorization checks whether the user has the privileges required to work with resources (for details, see IAM policies and groups).
In the IAM context, there are two types of cloud services: global and project-specific. The former include billing and IAM itself, while resources of all other services belong to a particular project. Using projects as high-level containers for resources allows you to provision dedicated cloud infrastructure for a separate company division or specific task.
Note
Resources within projects can be located in different regions, while the project privileges granted to users apply to all regions.
Billing#
The IAM service is free of charge.
Available quotas#
The following default quotas are allocated to the IAM service:
5 projects;
100 users.
If necessary, you can increase quotas. To do this, contact the support service via the support portal or by email support@k2.cloud.
Users#
In the Users subsection, you can create new users and manage existing ones.
Note
To perform service functions, system user is created, along with the account.
Create user#
To provide a user with access to K2 Cloud resources, do the following:
Go to the section IAM Users.
Click Create.
In the window that opens fill the required fields:
ID. User ID has the following format: <username>@<customer>, where customer is the company name specified at the registration in the cloud. User ID may only contain Roman letters, digits, and characters:
.,_and-.Name. Both Roman and Cyrillic letters, as well as various characters, may be used.
Email. The user’s email address. We strongly recommend always specifying it, because this address will receive notifications about updates, events, maintenance, backup errors, and other events.
The Require two-factor authentication (2FA) checkbox. When creating a user, you can require them to use mandatory two-factor authentication. In this case, when the user logs in to the cloud for the first time, a requirement to enable 2FA and relevant instructions are displayed.
Password. You can automatically generate a password or set your own. When setting a password, consider the password strength requirements.
(Optional) To assign tags to a user, click Add tags to proceed to the Tags step. Click Add tag and set the tag key and value. Repeat this step to set additional tags. Tags can also be assigned after the user is created.
Once all parameters are set, click Create to complete the user creation.
Configure global grants#
You can give the user global grants to the Billing and IAM services.
We recommend give global grants wisely. Users with global grants for the IAM service can manage all IAM service resources: users, projects, policies, etc. Meanwhile, global grants for the billing service enable viewing tariff information, generating charges reports, and configuring related notifications.
Add global grants#
To grant privileges, add a user to an administrator group or enable a necessary policy.
Go to the section IAM Users.
Find the user in the list and click the user ID to go to their page.
Open the Global grants tab and click Set up to go to the user’s global grants page.
Open the Groups or Policies tab depending on how you want to grant user privileges. Click Add.
Select the groups/policies you need and click Select to include them in the selection list.
To confirm the action, click Add again.
Revoke global grants#
Go to the section IAM Users.
Find the user in the list and click the user ID to go to their page.
Open the Global grants tab and click Set up to go to the user’s global grants page.
Open the Groups or Policies tab depending on how the user privileges were granted.
Select the privileges you want to revoke and click Delete.
In the dialog window, confirm the action.
Configure project privileges#
Important
Privileges for actions with Activity Log allow you to control events in all company projects, regardless of which project they were added in.
Add user to project#
When adding a user to a project, you can immediately set the required privileges in the project. Privileges can be granted by adding the user to the corresponding group or by attaching a policy.
Note
When adding a user to a project, select at least one group or policy.
Go to the section IAM Users.
Find the user in the list and click the user ID to go to their page.
Open the Projects tab and click Add.
Select the project to which you want to add a user and click Next to go to the next step.
Select the groups to which you want to add the user and click Select to include them in the Selected groups list. You can skip this step and click Next right away to select policies, though we recommend using groups to grant user privileges.
Select the policies you want to assign to the user and click Select to move them to the Selected policies list.
To add the user to the project, click Create.
Add project privileges#
Note
When adding a user to a project, select at least one group or policy.
Go to the section IAM Users.
Find the user in the list and click the user ID to go to their page.
Open the Projects tab.
To add permissions, click Configure next to the project where you want to change the user privileges.
When on the project privileges page, open the Groups or Policies tab depending on how you want to grant user privileges. Click Add.
Select the groups/policies you need and click Select to include them in the selection list.
To confirm the action, click Add again.
Revoke project privileges#
Go to the section IAM Users.
Find the user in the list and click the user ID to go to their page.
Open the Projects tab.
To revoke permissions, click Configure next to the project where you want to change the user privileges.
When on the project privileges page, open the Groups or Policies tab depending on how the user privileges were granted.
Select the privileges you want to revoke and click Delete.
In the dialog window, confirm the action.
To revoke all user privileges in a particular project, delete the user from the project.
Delete a user from a project#
Go to the section IAM Users.
Find the user in the list and click the user ID to go to their page.
Open the Projects tab.
Select the project from the list and click Delete.
Confirm the user deletion from the project in the dialog window.
If you want to suspend all user privileges for a while, then inactivate the user.
Set up user profile#
Change user data#
To change user personal data:
Go to the section IAM Users.
Find the user in the list and click the user ID to go to the user page.
To edit user data, go to the Information tab and click the edit icon next to the corresponding field:
name;
email;
phone number.
Enter the required value and click the icon to save changes.
Change user password#
Go to the section IAM Users.
Find the user in the list and click the user ID to go to their page.
Click Change password in the Information tab.
In the window that opens, enter or generate a new password.
To save the password, click Change.
Configure the two-factor authentication enforcement#
You can enable/disable the two-factor authentication enforcement for a user.
Go to the section IAM Users.
Find the user in the list and click the user ID to go to their page.
Enable or disable 2FA required in the Information tab.
Disable optional two-factor authentication#
A user can enable two-factor authentication on their own. If necessary, you can disable it.
Go to the section IAM Users.
Find the user in the list and click the user ID to go to their page.
Click Disable 2FA in Information tab.
In the dialog window, confirm the action.
Lock a user#
You can temporarily inactivate a user, for example, when the corresponding position becomes vacant.
Go to the section IAM Users.
Find the user in the list and click the user ID to go to their page.
In the Information tab, set the Status switch to the disabled position. To unlock a user, return the switch to the Active position.
Delete user#
Go to the section IAM Users.
Select the user from the list and click Delete. You can select several users at once for deletion.
In the dialog window, confirm the action.
You can also delete a user on their page on the Information tab. If the button is not displayed, open the additional actions menu by clicking .
Projects#
You can create projects and manage users in this subsection.
Create a project#
Note
When creating a project, the system user is granted necessary project privileges to perform service functions.
To add a new project:
Go to the section IAM Projects.
Click Create.
In the window that opens, specify a project ID and name. The project ID is used to work with the IAM API. The character constraints are the same as for the user ID.
Click Create again.
Add user to project#
When adding a user to a project, you can immediately set the required privileges in the project. Privileges can be granted by assigning a policy or adding the user to the corresponding IAM group.
Note
When adding a user to a project, you must select at least one policy or IAM group.
You can add multiple users at once, and they will be assigned the same privileges. If you want to set different privileges for users, add them separately.
Go to the section IAM Projects.
Find the project in the resource table and click the project ID to go to its page.
Open the Users tab and click Create.
Select the users which you want to add to a project and click Next to go to the next step.
Select the groups whose privileges you want to grant to the users in this project and click Select to include them in the Selected Users list. You can skip this step and click Next to select policies, though we recommend using groups to grant user privileges.
Select the policies you want to assign to the users and click Select to move them to the Selected policies list.
To add the users to the project, click :bdg-primary: Add.
Delete a user from a project#
Go to the section IAM Projects.
Find the project in the resource table and click the project ID to go to its page.
Open the Users tab and select the user from the user table.
To delete a user from the project, click Delete.
In the dialog window, confirm the action.
Delete a project#
Attention
Deleting a project will permanently delete instances, VPCs, volumes, and other project resources. This action cannot be undone, so delete a project only when it is absolutely necessary.
Note
Users added to the project are not deleted — their privileges in this project are revoked.
Go to the section IAM Projects.
Select the project in resource table.
Click Delete.
In the window that opens, the cloud will ask you to confirm project deletion. Enter the name of the project to be deleted if you are sure you want to delete it.
Click Yes, delete the project to complete the operation.
Alternatively, you can delete a project on its page in the Information tab.