Skip to main content

Creating an IAM policy to allow users access to the OVHcloud Control Panel

Stephanie R.
Updated

Learn how to provide a user with the minimum rights to allow them to log in to the OVHcloud Control Panel.

 

Requirements

 

Instructions

To be able to log in to the OVHcloud Control Panel, a user should have at least this set of rights on the account resource:

  • account:apiovh:me/get
  • account:apiovh:me/certificates/get
  • account:apiovh:me/tag/get

With these rights, a user will be able to log in to the OVHcloud Control Panel. To be able to perform any actions inside the Control Panel, additional rights have to be assigned through IAM.

 

Using the OVHcloud Control Panel

From the OVHcloud Control Panel, navigate to the Policies section via the Identity, Security & Operations menu and click Create a policy.

policies_myPoliciesTab.png

Set up a policy with the following configuration:

  • Provide a Policy name.

    policies_tutorial_controlPanelAccess-1.png

  • Choose OVHcloud customer account as the Product type.

  • Select your account (i.e., xx1111-ovh) as the Resource.

    policies_tutorial_controlPanelAccess-2.png

  • Add each of the following three rights as an Action.

    • account:apiovh:me/get
    • account:apiovh:me/certificates/get
    • account:apiovh:me/tag/get

    policies_tutorial_controlPanelAccess-3.png

You can now link your users to this policy to give them the right to log in to the OVHcloud Control Panel.

If you plan to use additional policies, it is not necessary to give any additional permissions.

WARNING: Any user with an "ADMIN" role has complete control over your account and services, including:

  • Creating services for which you will be charged,
  • Deleting services, which is sometimes irreversible,
  • Adding or deleting other users with an ADMIN role, and
  • Changing the account's contact, billing, and payment information.

 

Using API

Using the API, you can set up a policy according to the following example:

{
  "name": "manager_ro",
  "description": "manager_ro",
  "identities": [
    .... 
  ],
  "resources": [ 
     {
         "urn": "urn:v1:us:resource:account:xx1111-ovh" 
     }],
  "permissions": {
    "allow": [
      {
        "action": "account:apiovh:me/get"
      },
      {
        "action": "account:apiovh:me/certificates/get"
      },
      {
        "action": "account:apiovh:me/tag/get"
      }
    ]
  }
}

 

Go further

For more information and tutorials, please see our other Manage & Operate support guides or explore the guides for other OVHcloud products and services.

Related articles