Using IAM Policies with the OVHcloud Control Panel

Learn how to provide specific access rights to users of an OVHcloud account.

The access management of OVHcloud is based on a policy management system. It is possible to write different policies that give users access to specific features on the products linked to an OVHcloud account.

In detail, a policy contains:

• One or more identities targeted by this policy.
  • It can be account IDs, users, or user groups (like the ones used in Federation- other SSO guides are available).
• One or more resources impacted by this policy.
  • A resource is an OVHcloud product that will be impacted by this policy (a domain name, a Nutanix server, a Load Balancer, etc.).
• One or more actions allowed or excepted by this policy.
  • Actions are the specific rights affected by this policy (reboot a server, create an email account, cancel a subscription, etc.).

For example, we can create a policy to give to a user called John, for a VPS, access to the action "reboot".

This guide explains in detail how these policies can be declared using the OVHcloud Control Panel, and how to list the identities, resources, and actions available for them.

Topics

• Accessing the IAM menu
• Managing policies
• Linking an identity to a policy
• Managing identities
• Managing resource groups

Requirements

• an OVHcloud account
• knowing how to manage account users
• one or more OVHcloud products linked to this OVHcloud account (Load Balancer, VPS, etc.)

Instructions

Accessing the IAM menu

From the OVHcloud Control Panel click your account name in the top-right corner, then click the icon with your initials.

You can access the IAM menu via the My Account page.

The menu will give you the list of all the current policies created on your account.

Each policy is displayed with its name, the number of identities linked to it, and the number of actions it contains.

Managing policies

Creating a policy

The appearance of the next screen depends on whether you have existing policies. In either case, click the Create a policy button.

Selecting the Advanced Mode button will show you a list of all the OVHcloud Managed policies.

The following form will be displayed:

• Policy name (mandatory): This is the name that will appear in the interfaces. The name should be unique and must not contain any spaces.
• Identities: Select the identities affected by this policy. It is possible to target more than one identity type.
• Product types: Select the type of product to define the scope of the policy. One or more product types can be included in the same policy.
• Resources: Add resources or resource groups to be covered by the policy. The resources available are filtered by the product type selected beforehand.

There are four different ways to add Actions:

1. Activating the Authorize all actions option: When activating this option, you allow all actions related to the selected products. This includes all existing actions as well as actions added in the future for these product types.

   

2. Selecting a group of managed permissions

   We provide permission groups that are preconfigured and managed by OVHcloud. You can select one or more groups by selecting them from the available list.

   Details of the content of the managed permission groups are available in the associated documentation.

   Managed action groups can be used in addition to unit actions.

   

3. Adding actions manually: If you know the action name, you can add it manually. You can use a wildcard at the beginning or at the end of the action name with *. For example, adding vps:apiovh:ips/* will grant the following rights:
   • vps:apiovh:ips/edit
   • vps:apiovh:ips/delete
   • vps:apiovh:ips/get

   

4. Selecting actions from the list: The available actions depend on the resource type and belong to one of five categories. A search field is available to help identify a specific action on the list.
   • Read: List products and show information about a product (ex.: List a VPS IP).
   • Create: Action that allows to create something on a product (ex.: Create a support ticket).
   • Delete: Action that allows to delete something on a product (ex.: Delete a Public Cloud instance).
   • Edit: Action to change something existing on a product (ex.: Edit TCP route of a Load Balancer).
   • Operate: Apply changes to the infrastructure related to the product (ex.: Reboot a dedicated server).
   Actions related to IP and vRack products, as well as actions related to ordering and billing, are not yet available in through OVHcloud IAM.

   When you have made your selections, click the Create policy button.

   

Editing or deleting a policy

To edit an existing policy, click the ... button to the right of the policy and click Modify policy. Then you can change the scope of the policy.

To delete an existing policy, click the ... button to the right of the policy and click Delete policy. A popup window will ask you to confirm the deletion.

Linking an identity to a policy

To link an identity to a policy, click the ... button to the right of the policy and click Manage linked identities.

This will allow you to add and delete the users or the groups to whom the policy should apply.

Managing identities

The identities available for policies are managed in your OVHcloud Control Panel account under the User management tab.

The Identities tab on the IAM menu will redirect you to that menu.

Details about user management are available in the dedicated documentation.

Managing resource groups

Policies can target resource groups instead of resources. These resource groups can assemble resources from different products, for example, to set up a test environment.

Creating a resource group

To create a resource group, access the dedicated tab of the IAM menu. Click on Create resource group.

• Name of the resource group: This is the name that will appear in the interfaces. The name should be unique and must not contain any spaces.
• Product types: The list of product types concerned by this resource group.
• Resources: The list of resources the group will contain.

When you have made your selections, click Create resource Group.

Editing a resource group

To edit a resource group, click on its name in the list.

Deleting a resource group

To delete an existing resource group, click the ... button to the right of the group and click Delete resource group. A popup window will ask you to confirm the deletion.

Go further

For more information and tutorials, please see our other IAM or Manage and Operate guides, or explore the guides for other OVHcloud products and services.