Docs

Application Performance Management Plus

Permission management

Workspace-level IAM permission control

Workspaces are a data isolation method provided by Server-side Monitoring. Each workspace has independent data reporting credentials. Workspaces not only support centralized management of traces, logs, and metric data but also allow fine-grained control over IAM user permissions based on workspaces. This topic describes how to perform workspace-level IAM permission control.

Background

The Volcano Engine IAM service provides fine-grained access control capabilities for resources. You can log in as a Volcano Engine root user to create IAM users and assign them permission policies to enable multi-user collaboration or secure access in various scenarios. For example, O&M personnel have permissions to manage all resources and view specific resources. For details about IAM, see IAM.

Server-side Monitoring uses the IAM service of Volcano Engine for permission management. A permission policy consists of two key elements:

Action: The operations that an IAM user can perform. They are in the format of apmplus_server:{ActionName}, such as apmplus_server:GetWorkspace and apmplus_server:ListWorkspaces.

Resource: The resource scope on which the operations are performed, which is described by the Top Resource Name (TRN). The TRN for workspace resources is in the format of trn:apmplus_server:{region}:{accountID}:workspace/{workspaceName}.

Prerequisites

An IAM user has been created. For detailed instructions, see Managing users.

The key information required for workspace resource TRN configuration has been obtained.

Key information	Obtaining method
{region}	The region IDs supported by Server-side Monitoring. For supported regions and their IDs, see Available regions.
{accountID}	Account ID. You can obtain it from the personal information in the upper‑right corner of the console.
{workspaceName}	Workspace name. You can obtain it on the Workspace Management page. For details, see Managing workspaces.

(Optional) If you need to configure TLS permissions for corresponding resources, make sure that the key information for the TLS resource TRN configuration has been obtained.

Key information	Obtaining method
{region}	The region IDs supported by TLS. For supported regions and their IDs, see Service addresses.
{accountID}	Account ID. You can obtain it from the personal information in the upper‑right corner of the console.
{projectID}	The ID of the log project. You can obtain it on the log project management page in the TLS console. For details, see Log projects.
{topicID}	The ID of the log topic. You can obtain it on the log topic management page in the TLS console. For details, see Log topics.

Procedure

Step 1: Configure a custom workspace-level policy

Click Permission policy in the left navigation pane and click Create Policy.

Set the policy name and policy content, and click Submit.

To control the workspace scope that IAM users can view or operate in Server-side Monitoring, pay attention to the following configurations:

When you configure a custom policy with edit permissions, we recommend disabling Actions related to workspace creation, deletion, and modification, including CreateWorkspace, DeleteWorkspace, and UpdateWorkspace.

... ...
{
"Effect":"Deny",
"Action":[
"apmplus_server:CreateWorkspace",
"apmplus_server:DeleteWorkspace",
"apmplus_server:UpdateWorkspace"
],
"Resource": [
"*"
]
}
... ...

Use trn:apmplus_server:{region}:{accountID}:workspace/{workspaceName} to restrict Actions to the target workspace resource TRN.

... ...
{
"Effect": "Allow",
"Action": [
"apmplus_server:Get*",
"apmplus_server:List*"
],
"Resource": [
"trn:apmplus_server:*:210xxxx:workspace/friday",
"trn:apmplus_server:*:210xxxx:workspace/today"
]
}
... ...

Common examples of workspace-level custom policies are as follows:

tip

In practice, replace the region, account ID, and workspace name in the workspace resource TRN with actual values.

By default, AI‑related metrics are stored in the default workspace. If AI applications are involved, we recommend granting permissions on the default workspace when you configure custom policies.

Full permission

Read-only permission

Example of a custom policy that grants full permissions on Server-side Monitoring to a specified workspace:

Step 2: (Optional) Configure TLS permissions for the corresponding resources

The trace and log data of a workspace are stored in TLS. By default, users only have access permissions to the trace and log data. If you need to strictly prohibit IAM users from accessing certain TLS resources, you can manually configure custom policies. For more information about TLS resource configuration, see Configuring TLS permissions.

TLS resources are in the TRN format of trn:tls:{region}:{accountID}:project/{projectID}/topic/{topicID}. A sample custom policy is as follows:

Step 3: Use the custom policy to grant permissions to IAM users

Return to the Permission policy page, search for the custom policy created in Step 1, and click Authorize in the Actions column.

Select the IAM users to be authorized and then click Submit.

tip

To enable fine-grained permission control at the project level, select the target project.

FAQ

Why am I still unable to view the workspace after authorization?

Check whether the following configurations are valid:

Check whether apmplus_server:GetWorkspace is included in the custom policy.

Check whether {region}, {accountID}, and {workspaceName} in the TRN are valid.

In a multi‑region deployment scenario, you need to configure a separate Resource for the workspace in each region, or use the * wildcard in the region configuration.

Why does the Server-side Monitoring console display that I do not have permissions during a login?

This indicates that the current account already has workspaces, but the logged‑in user lacks workspace permissions. Contact the root user to grant the necessary permissions.

How do I batch‑configure permissions when multiple workspaces exist under the root user?

Use the * wildcard based on naming conventions, such as workspace/payment-*.

Last updated: 2026.09.20 10:55:53