Docs

Volcengine Managed Service for Prometheus

Permission management

Configuring project-level permissions

Project-level authorization grants access only to resources within the specified projects. This topic describes how to grant a user read-only or full access to Volcengine Managed Service for Prometheus (VMP) resources of specific projects.

Background

Currently, only certain resources in VMP support project-level access control. For a list of system policies related to VMP, see IAM overview. If you want to assign read-only or full access to a specific project, choose the corresponding policy and the project. Otherwise, you may get many permission errors, which can affect your experience with using this service.

Prerequisites

An IAM user has been created. For more details, see User management.

Operating instructions

When configuring project‑level permissions on VMP for a specific IAM user, you need to grant both the corresponding global common resource permissions and the specified project‑level permissions at the same time. This prevents frequent console errors caused by missing common permissions, affecting the user experience.

Configure permissions based on the permission requirements of the IAM user in the target project:

Read‑only access: Grant read‑only permissions on VMP to the IAM user. Use this policy only to view monitoring data and resource information. For details, see Scenario 1: read-only access to projects.

Full access: Grant full permissions on VMP to the IAM user. Use this policy when you need to create, modify, or delete related resources. For details, see Scenario 2: full access to projects.

Procedure

Scenario 1: read-only access to projects

In the left navigation pane, click User management > User.

In the user list, find the target IAM user and click Authorize in the Actions column.

Add VMPCommonReadonlyAccess as a global policy. Click Submit.

Limit VMPReadOnlyAccess to the desired projects. Click Submit.

Scenario 2: full access to projects

In the left navigation pane, click User management > User.

In the user list, find the target IAM user and click Authorize in the Actions column.

Add VMPCommonFullAccess as a global policy. Click Submit.

Limit VMPFullAccess to the desired projects. Click Submit.

Validate results

Log in to the VMP console by using the IAM user that you authorized. If you can access an authorized project and fail to access an unauthorized project with a permission error, the authorization is successful.

Last updated: 2026.09.09 14:42:48