Docs

Volcengine Kubernetes Engine

IAM user permissions

Granting IAM permissions

Before you use IAM users to manage VKE resources, you need to attach policies to IAM users. You can attach system preset policies and user-defined policies to IAM identities, including IAM users, IAM user groups, and IAM roles.

This topic provides an example of how to grant permissions to IAM users. The permissions configuration methods for other IAM identities are similar.

Prerequisites

IAM users have been created. For detailed operations, see User management.

Attaching system-preset policies

IAM provides system-preset policies. You can directly attach system preset policies related to VKE to IAM users.

In the left navigation bar, click User management > User.

On the User page, find the name of the user to whom you want to grant permissions and click Authorize in the Actions column.

On the Add authorization page, select vke from the Service drop-down list in the Policy section. For the descriptions of the system preset policies related to VKE, see System preset policies.

You can select the checkboxes before the policy names based on your business requirements and then click Submit to attach permission policies for VKE resources to the IAM user.

Attaching user-defined policies

If the system preset policies related to VKE do not meet your authorization requirements, you can create custom policies and attach them to target users, user groups, or roles. For related operations, see Creating policies and IAM authorization best practices.

For the VKE resource actions that can be included in a custom policy, see Actions. For access permissions on cloud service resources required by VKE, see Introduction to the VKE service-linked role. For VKE-related conditions, see Service-specific condition keys and custom policies.

warning

Custom ‌IAM policies do not automatically update with product API changes. When the service adds, modifies, or deprecates APIs or Actions, you need to evaluate and update custom policies manually. Otherwise, the following issues may occur:

Feature unavailability (new Actions are not added to the policy, resulting in authorization failure)

Permission redundancy (deprecated Actions are not removed promptly, resulting in unnecessary permissions)

Last updated: 2026.08.13 20:46:30