Docs

Load Balancer

User management

Using an IAM user to access ALB

This topic describes how to create an Identity and Access Management (IAM) user via IAM, how to authorize the IAM user access Application Load Balancer (ALB), and how to use the IAM user to access ALB.

Create an IAM user and authorize it

You can review the IAM documentation's User management and Create a user and authorize it to complete the creation and authorization for the IAM user. After completing the creation, you can view all IAM users in the user list.

ALB policies

New IAM users, user groups, and roles have no permissions by default. IAM users, groups, and roles gain permissions to call OpenAPIs and perform console actions on certain cloud resources only after its root account attaches policies to them. IAM supports two types of policies: System default policy and Custom policy.

System default policy: The IAM console is configured with default ALB policies. If you want to grant permissions to IAM users, user groups, or roles, associate the IAM users, user groups, or roles with related default policies.

Policy name	Description	Supported actions
ALBFullAccess	Full management permissions for ALB.	Full permissions for managing ALBs. You can create, view, or delete related resources and perform other actions.
ALBReadOnlyAccess	Read-only access permissions for ALB.	Read-only permission for ALBs. You can only view related resources.

Custom policy: If the default policies configured on the IAM console cannot meet your business needs, you can create custom policies as needed. The ALB custom policy is expressed in a JSON-formatted PolicyDocument, consisting of the following elements:

Element	Description
Statement	The statement of this policy. A policy statement can consist of either a single statement or an array of multiple statements. A single statement must be enclosed in curly brackets { }. An array of multiple statements must be enclosed in square brackets [ ].
Effect	The effect of this policy's statement. The effect is Allow or Deny. Allow Deny
Action	The specific action of this policy. A policy action consists of the cloud service's name and action, both described in English. Format: {service}:{action}. The service for ALB is alb, and the action is the OpenAPI name. For details, see API overview. Action can be one or more specific actions expressed as an array, supporting both the "*" and "?" wildcards. E.g.: "Action":["alb:DescribeZones","iam:ListRoles"]
Resource	The resources to which specific actions apply. Resources are configured in a TRN format as: trn: {service}:{region}:{account}: {resourceType}/{id}. trn: The fixed prefix {service}: The English name of the cloud service. For ALB, the service is alb. {region}: The region where the resource is located. For global resources that do not distinguish regions, leave this parameter blank. {account}: The ID of the account that owns the resource. {resourceType}: The resource type. ALB resource types: loadbalancer: The instance. listener servergroup: The server group. customizedcfg: The custom configuration. certificate acl: Access control. {id}: The resource ID.
Condition	Condition is an optional element that defines when the statement takes effect. A single policy can contain multiple conditions. Each condition consists of three parts: Operator, Condition key, and Condition value. Example: { "Condition": { "StringEquals": { "alb:LoadBalancerType":[ "public" ] } } } In this example, StringEquals is the operator, alb:LoadBalancerType is the condition key, and public is the condition value.

tip

For syntax examples of ALB custom policies, see Configuration examples of ALB custom policies.

For more about custom policy syntax description, see IAM Policy Grammar.

Grant an ALB policy

In the IAM console, you can select the policy scope. Options:

Global: Applies to all resources under this service.

Project: Applies only to resources included in the specified project.

tip

A project is a feature provided by VolcanoEngine to group and manage resources under separate products. You can create a project via the Project page under Resource Project, and add resources within the ALB to the project for group management. For more information, see Managing ALB resources by project.