Policies and groups

A user must be explicitly granted permissions to work with a specific K2 Cloud service. Permissions — privileges in IAM terminology — are granted by assigning policies to the user that describe allowed actions (permissions). As a rule, a user is assigned several policies whose combination describes their privileges. Policy descriptions are stored as a JSON document.

To avoid granting privileges to each user individually, K2 Cloud uses a group mechanism. Like users, groups can be assigned their own policies. When added to a group, a user receives all privileges of that group. A user can be added to multiple groups. The resulting privileges are combined with the privileges granted to the user by individual policies.

Policies and groups are divided into global and project ones depending on which services they allow actions with. Global policies grant permissions for global services, and project policies grant permissions for project services. Different policy types cannot be assigned to the same group, i.e. a group can be either global or project. When attaching a project policy to a user or adding the user to a project group, you must specify the project in which the corresponding privileges are granted.

Attention

To manage user privileges, we recommend using groups instead of policies, because this simplifies granting privileges: you do not need to grant them to each user individually.

Policies

Policies describe a set of permissions for actions that a user can perform on cloud resources. For example, a user may be allowed to start and stop instances, but not to delete them.

Policies can be global or project-specific depending on which services they authorize actions with. You cannot combine permissions for services of different types in a single policy. When assigning a project-specific policy to a user, it is necessary to specify a project in which the privileges are granted.

You can use predefined policies provided by K2 Cloud or define your own ones. The following policies are available in K2 Cloud by default:

Global policies

Policy	Description
BillingFullAccess	Full access to billing information
IAMFullAccess	Full set of permissions to administer users, projects, and groups under IAM

Project-specific policies

Policy	Description
AutoScalingFullAccess	Full set of permissions to work with instance groups and manage scaling policies
BackupFullAccess	Full set of permissions to manage backup operations
BackupOperationsPolicy	All actions with recovery points except for deletion
CloudTrailFullAccess	Full set of permissions to work with activity log
CloudWatchFullAccess	Full set of permissions to operate monitoring service
CloudWatchReadOnlyAccess	Full set of permissions to view the monitoring service
EC2FullAccess	Full set of permissions to manage infrastructure service
EC2ReadOnlyAccess	Full set of permissions to view the infrastructure service
EFSFullAccess	Full set of permissions to work with Elastic File System
EKSClusterPolicy	Required permissions for a service user to access all Kubernetes cluster providers
EKSClusterAutoscalerPolicy	Required permissions for a special user in the Cluster Autoscaler provider to scale node groups
EKSCSIPolicy	Required permissions for a special user in the EBS provider to manage volumes
EKSNLBPolicy	Required permissions for a special user in the ELB provider to manage load balancers
EKSFullAccess	Full set of permissions to manage Kubernetes clusters
ELBFullAccess	Full set of permissions to manage load balancers
PaaSBackupPolicy	Required permissions for a PaaS service to make backup copies
PaaSFullAccess	Full set of permissions to manage all PaaS services
RCFullAccess	Full set of permissions to access the remote console via the Web
RCReadOnlyAccess	Set of permissions to access the remote console via the Web in view-only mode
RGTFullAccess	Full set of permissions to manage resource tags
Route53FullAccess	Full set of permissions to manage the DNS service
S3FullAccess	Full set of permissions to work with object storage
SQSFullAccess	Full set of permissions to manage SQS

Important

CloudTrail administrator policy allows users to control events in all projects of the company, regardless of which project they have been added to.

Create a policy

1. Go to the section IAM Policies.

2. Click Create.

3. Specify the policy name and select its type (global or project-specific). You can also add a policy description (optional). Click Next to go the next step.

4. Select the service for which you want to add permissions. To select all possible actions, select *. Click Select to add actions to the selection list.

   If you want to add permissions to work with another service, repeat this step.

   Note

   The policy wizard provides the ability to set and edit a policy directly in JSON format. To do so, go to the next step by clicking Edit JSON.

5. Once you have selected all the allowed actions, click Create.

Edit permissions

When you add permissions, all users assigned this policy receive the corresponding privileges. For example, if you added a permission to terminate instances, they will be able to terminate instances. However, when you remove permissions from a policy, some users may still retain the corresponding privileges if they are granted by other policies attached to them or by groups they belong to.

Important

Predefined policies cannot be modified.

To modify permissions granted by a policy:

1. Go to the section IAM Policies.

2. Select a relevant policy in the resource table and click Modify permissions.

3. In the new window, select the service for which you want to modify permissions. To add permissions, select actions in available permissions and click Add. To delete permissions, select actions in the Selected permissions block and click Delete.

   If you want change permissions for actions with another service, repeat this step.

   Note

   The policy wizard provides the ability to set and edit a policy directly in JSON format. To do so, go to the next step by clicking Edit JSON.

4. Once you have selected all the allowed actions, click Create.

You can also modify permissions at the policy page in the Permissions tab.

View a policy in JSON format

1. Go to the section IAM Policies.

2. Select a policy you want to view in the resource table and click Show JSON.

3. You can modify the policy, if necessary. To do so, click Modify permissions to go to policy edit dialog.

4. Once you have viewed the policy, click Close.

Delete a policy

Before deleting a policy, first delete it from all users to whom it is assigned and from all groups to which it is added.

Note

Predefined policies cannot be deleted.

1. Go to the section IAM Policies.

2. Select a policy you want to delete and click Delete.

3. In the dialog window, confirm the action.

Alternatively, you can delete a policy on its page in the Information tab.

Groups

Using groups lets you grant the same privileges to all group members at once instead of assigning them to each user individually. When added to a group, a user receives all privileges granted by that group. When group permissions change, the privileges of all users in the group change automatically.

Group’s privileges are determined by policies that are assigned to it. Depending on the type (global or project-specific) groups can only be assigned policies of the appropriate type. When you include users in a project group, specify the project in which they will be granted group privileges.

You can use predefined groups provided by K2 Cloud or create your own ones. The following groups are available in K2 Cloud by default:

Group	Type	Description	Applicable policies
ActivityLogAdministrators (event log administrators)	Project	Full set of permissions to work with the Activity Log service	CloudTrailFullAccess S3FullAccess
AutoScalingAdministrators (Auto Scaling service administrators)	Project	Full set of permissions to work with the Auto Scaling service	AutoScalingFullAccess
BackupAdministrators (backup administrators)	Project	Full set of permissions to manage backup operations	BackupFullAccess
BackupOperators (backup users)	Project	All actions with recovery points except for deletion	BackupOperationsPolicy
BillingAdministrators (billing administrators)	Global	Full access to billing information	BillingFullAccess
CloudAdministrators (cloud administrators)	Project	Full set of permissions to work with all project resources, except access to the Activity Log service and deletion of backups	AutoScalingFullAccess BackupOperationsPolicy CloudWatchFullAccess EC2FullAccess EFSFullAccess EKSFullAccess ELBFullAccess PaaSFullAccess RCFullAccess RGTFullAccess Route53FullAccess S3FullAccess SQSFullAccess
ELBAdministrators (administrators of the Elastic Load Balancing service)	Project	Full set of permissions to work with load balancers	ELBFullAccess
IAMAdministrators (IAM administrators)	Global	Full set of permissions to administer users and projects within IAM	IAMFullAccess
InstanceAdministrators (instance administrators)	Project	Full set of privileges to work with instances	CloudWatchFullAccess EC2FullAccess RCFullAccess
InstanceViewers (instance users)	Project	Required privileges to view instances	CloudWatchReadOnlyAccess EC2ReadOnlyAccess RCReadOnlyAccess
ObjectStorageAdministrators (object storage administrators)	Project	Full set of permissions to work with object storage	S3FullAccess
Route53Administrators (DNS service administrators)	Project	Full set of permissions to work with the DNS service	Route53FullAccess

Create a group

1. Go to the section IAM Groups.

2. In the window that opens, specify the group name and select its type (global or project-specific). Click Next to go to the next step.

3. In the policies list, check the policies to assign to the group and click Select. To revert the selection, check the policies in the Selected policies block and click Remove.

4. Click Create to create the group.

Modify assigned policies

You can assign other policies to a group after it has been created. This will change the corresponding privileges of the users who are members of the group.

Important

You cannot change the policies assigned to predefined groups.

Add policies to a group

1. Go to the section IAM Groups.

2. Find the group in the resource table and click the group name to go to its page.

3. Open the Policies tab and click Add.

4. In the window that opens, check the policies to be added and click Select.

5. Click Add to save the changes.

Delete policies from a group

1. Go to the section IAM Groups.

2. Find the group in the resource table and click the group name to go to its page.

3. Open the Policies tab.

4. In the resource list, select the policies to be deleted and click Delete.

5. In the dialog window, confirm the action.

Change the group members

Add users to a group

When adding users to a project group, it is necessary to specify a project in which they will be granted the privileges of the group.

1. Go to the section IAM Groups.

2. Find the group in the resource table and click the group name to go to its page.

3. Open the Users tab and click Create.

4. For a project group, select the project to which users will be added and click Next. This step is not available for a global group.

5. Check the users to be granted privileges and click Select.

6. To add a user to the group click :bdg-primary: Add.

Delete users from a group

In a project group, the same user can have privileges in several projects. Therefore, to remove a user from the group, select all projects where the user has privileges.

1. Go to the section IAM Groups.

2. Find the group in the resource table and click the group name to go to its page.

3. Open the Users tab.

4. Select users you want to delete from the group in the resource table and click Delete.

5. In the dialog window, confirm the action.

Revoke group privileges in a project

To revoke a user’s privileges in a specific project in the case of a project group:

1. Go to the section IAM Groups.

2. Find the group in the resource table and click the group name to go to its page.

3. Open the Users tab and select the desired project in the project selector.

4. Select the user or users whose group privileges you want to revoke and click Delete.

5. In the dialog window, confirm the action.

Delete a group

Note

Before deleting a group, you must remove all users from it.

1. Go to the section IAM Groups.

2. In the resource table, select the group to be deleted and click Delete.

3. In the dialog window, confirm the action.

You can also delete a group on its page.