Using IAM Policies with the OVHcloud Control Panel

Learn how to provide specific access rights to users of an OVHcloud account. This guide explains in detail how policies can be declared using the OVHcloud Control Panel and how to list the identities, resources, and actions available for them.

The access management of OVHcloud is based on a policy management system. It is possible to write different policies that give users access to specific features on the products linked to an OVHcloud account.

In detail, a policy contains:

• One or more identities targeted by this policy.
  • It can be account IDs, users, or user groups (like the ones used in Federation - other SSO guides are available).
• One or more resources impacted by this policy.
  • A resource is an OVHcloud product that will be impacted by this policy (a domain name, a Nutanix server, a Load Balancer, etc.).
• One or more actions allowed or excepted by this policy.
  • Actions are the specific rights this policy affects (reboot a server, create an email account, cancel a subscription, etc.).

For example, we can create a policy to give to a user called John for a VPS, with access to the action "reboot".

Topics

• Accessing the IAM menu
• Managing policies
• Managing identities
• Managing resource groups

Requirements

• An OVHcloud account
• Know how to manage account users
• One or more OVHcloud products linked to this OVHcloud account (Load Balancer, VPS, etc.)

Instructions

Accessing the IAM menu

From the OVHcloud Control Panel, click your name in the top-right corner, then click the icon with your initials.

You can access the IAM menu via the My Account page.

If you are accessing this menu for the first time, the following page appears. Click Create a policy or Create users, depending on the action you want to perform.

If you have already created policies or users, the menu displays a list of all the current policies created on your OVHcloud account.

Each policy is displayed with its name, the number of identities linked to it, and the number of actions it contains.

Managing policies

Creating a policy

Click the Create a policy button.

The following options will be displayed:

Policy name (mandatory): This is the name that will appear in the interfaces. The name should be unique and must not contain any spaces.

Identities: Select the identities affected by this policy. It is possible to target more than one identity type.

Product types: Select the type of product to define the scope of the policy. One or more product types can be included in the same policy.

Resources: Add resources or resource groups to be covered by the policy. The resources available are filtered by the product type selected beforehand.

There are four different ways to add Actions:

1. Activating the Authorise all actions option: When activating this option, you allow all actions related to the selected products. This includes all existing actions as well as actions added in the future for these product types.

   

2. Selecting a group of managed permissions

   We provide permission groups that are preconfigured and managed by OVHcloud. You can select one or more groups by selecting them from the available list.

   Details of the content of the managed permission groups are available in the associated documentation.

   Managed action groups can be used in addition to unit actions.

   

3. Adding actions manually: If you know the action name, you can add it manually. You can use a wildcard at the beginning or the end of the action name with *. For example, adding vps:apiovh:ips/* will grant the following rights:
   • vps:apiovh:ips/edit
   • vps:apiovh:ips/delete
   • vps:apiovh:ips/get

   

4. Selecting actions from the list: The available actions depend on the resource type and belong to one of five categories. A search field is available to help identify a specific action on the list.
   • Create: Action that allows to create something on a product (ex.: Create a support ticket).
   • Delete: Action that allows to delete something on a product (ex.: Delete a Public Cloud instance).
   • Edit: Action to change something existing on a product (ex.: Edit TCP route of a Load Balancer).
   • Operate: Apply changes to the infrastructure related to the product (ex.: Reboot a dedicated server).
   • Read: List products and show information about a product (ex.: List a VPS IP).

   

When you have made your selections, click the Create policy button.

Editing or deleting a policy

To edit an existing policy, click the more options ... button to the right of the policy and click Modify policy. Then, you can change the scope of the policy.

To delete an existing policy, click the more options ... button to the right of the policy and click Delete policy. A pop-up window will ask you to confirm the deletion.

Managing identities

The identities available for policies are managed in your OVHcloud Control Panel account under the Identities tab.

Details about user management are available in the dedicated documentation.

Managing resource groups

Policies can target resource groups instead of resources. These resource groups can assemble resources from different products, for example, to set up a test environment.

Creating a resource group

To create a resource group, access the dedicated tab of the IAM menu. Click on Create a resource group.

• Resource group name: This is the name that will appear in the interfaces. The name should be unique and must not contain any spaces.
• Product types: The list of product types concerned by this resource group.
• Resources: The list of resources the group will contain.

When you have made your selections, click Create resource Group.

Editing a resource group

To edit a resource group, click on its name in the list or click the more options ... button to the right of the group and click Edit resource group.

Deleting a resource group

To delete an existing resource group, click the more options ... button to the right of the group and click Delete resource group. A pop-up window will ask you to confirm the deletion.

Go further

For more information and tutorials, please see our other Manage & Operate support guides or explore the guides for other OVHcloud products and services.