Docs

Application Performance Management Plus

Permission management

Managing Server-side IAM permissions

Server-side Monitoring uses Identity and Access Management (IAM) to control access permissions of different identities.

Background

The Volcano Engine IAM service provides fine-grained access control capabilities for resources. You can log in as a Volcano Engine root user to create IAM users and assign them permission policies to enable multi-user collaboration or secure access in various scenarios. For example, you can assign maintenance engineers permissions to manage all resources and assign operations specialists permissions to view specific resources. For more information about IAM, see IAM.

Prerequisites

An IAM user has been created. For detailed instructions, see Managing users.

Scenario 1: Grant permissions using preset policies

Preset policies

Server-side Monitoring provides the following preset policies, which are directly available for IAM user authorization.

Policy	Description
APMPlusServerFullAccess	Grants full management permissions for Server-side Monitoring.
APMPlusServerReadOnlyAccess	Grants read-only access to Server-side Monitoring.

Grant permissions to the IAM user

In the left navigation pane, select User management > User. Find the target user and then click the username.

On the Policy tab of the user details page, click Authorize.

On the Add authorization page, search for preset policies of the apmplus_server service, select the desired policies, and click Submit.

tip

To enable fine-grained permission control at the project level, select the target project.

Scenario 2: Grant permissions using custom policies

If the preset policies do not meet your permission granularity requirements in your actual scenario, you can create custom policies and assign them to IAM users. For example, you may allow or prohibit access to a specific API.

The content of custom policies follows the policy syntax, with key elements including Action and Resource. The Action element indicates a list of actions. The Resource element indicates the resources to which the actions apply. For the syntax details of custom policies, see Custom policies.

Create a custom policy

Click Permission policy in the left navigation pane and click Create Policy.

Set the policy name and policy content, and click Submit.

For this example, the policy name is APMPlus-server-NotifyGroupManagement.

The JSON content is as follows. You can add or remove specific actions and resources as needed.

{
"Statement": [
{
"Effect": "Allow",
"Action": [
"apmplus_server:NotifyGroupCreate",
"apmplus_server:NotifyGroupDelete",
"apmplus_server:NotifyGroupUpdate",
"apmplus_server:NotifyGroupDetail",
"apmplus_server:NotifyGroupList"
],
"Resource": [
"*"
]
}
]
}

Grant permissions to the IAM user

Go back to the Permission policy page, filter for the newly created custom policy, and then click Authorization to the right of the policy.

Select the IAM users to which you want to attach the policy and then click Submit.

tip

To enable fine-grained permission control at the project level, select the target project.

Validate results

After you authorize a user to access a specific API, you can test the calls to the API using Postman or other tools.

Last updated: 2026.09.20 10:55:52