Volcano Engine Function as a Service
Volcano Engine Function as a Service
Document
- Documentation
Volcano Engine Function as a ServiceBest PracticesAuthorizationBest practices on IAM authorization
Copy page
Download PDFAuthorization
Best practices on IAM authorization
Copy pageDownload PDFBest practices on IAM authorization
This topic introduces the best practices for granting permissions to IAM users for veFaaS.
Prerequisites
Scenario 1: Use global preset policies and grant permissions
Scenario introduction
veFaaS provides the following system preset policies that can be directly used to grant permissions to IAM users
Procedure
- Log in to the IAM console using a Volcano Engine account or an IAM account with the required permissions.
- In the left navigation pane, select User management > User.
- In the user list, find the username that requires permissions. Click Manage in the Actions column.
- On the User details page, select Permissions > Global permissions tab, and click Add permission.
- In the search box of the Add permission panel, enter veFaaS to search for system preset policies.
- Select a policy as needed. Click Confirm to add the veFaaS permission policy to the IAM user.
Scenario 2: Create and grant custom permissions effective within a project
Scenario introduction
Some Actions and Resources in veFaaS are organized by projects, which enables project-level permission control. IAM users need to obtain the permissions for such Actions and Resources via project authorization.
tip
The Actions included in project authorization are:
- CreateFunction
- UpdateFunction
Procedure
- Log in to the IAM console using a Volcano Engine account or an IAM account with the required permissions.
- Create a custom policy.
- In the left navigation pane, select Policy management. On the Policy management page, click Create custom policy.
- On the create custom policy page, enter the policy name and policy content, then click Submit.
- Assume the policy name is vefaas-create-project, and the JSON content is as follows. You can add or remove specific Actions or Resources as needed.
-
- Add project authorization to the created vefaas-create-project policy.
- Click the policy name vefaas-create-project to go to the policy details page.
- On the Authorization > Project authorization tab, click Add authorization.
- Select the user to authorize and the related project.
- Click Confirm to complete project authorization.
- Create a custom policy for Actions and Resources that cannot be organized by projects, and apply it to the target IAM user to grant a global permission.
tip
Some Actions and Resources in veFaaS cannot be organized by projects. Therefore, you need to make them accessible to the target IAM user by offering a global permission, in addition to implementing project authorization for that user. Otherwise, the IAM user may not access the veFaaS resources.
- Create a custom policy.
- Assume the name is vefaas-read-global. The JSON content of the policy is shown below. Please add or remove specific Actions or Resources as needed.
-
- Add global authorization to the created vefaas-read-global policy.
- On the vefaas-read-global policy details page, select the Authorization > Global authorization tab, and click Add authorization. Select the user to authorize, and click Confirm to complete global authorization.
Validating results
When an IAM user attempts to create a function in a non-default project, a permission denied message is displayed.
Scenario 3: Create and grant tag-based custom permissions
Scenario introduction
Some Actions and Resources in veFaaS are attached with tags, enabling permission control by tag.
tip
Actions attached with tags are:
- CreateFunction
- UpdateFunction
Procedure
- Log in to the IAM console using a Volcano Engine account or an IAM account with the required permissions.
- Create a custom policy.
- In the left navigation pane, select Policy management. On the Policy management page, click Create custom policy.
- On the create custom policy page, enter the policy name and policy content, then click Submit.
- Assume the name is vefaas-function-operation-by-tag, indicating that CreateFunction and UpdateFunction are only accepted by the tag team:ai-prompt, and denied by other tags.
-
- Add global authorization to the created vefaas-function-operation-by-tag policy.
- Click the policy name vefaas-function-operation-by-tag to go to the policy details page.
- On the Authorization > Global authorization tab, click Add authorization.
- Select the user to authorize.
- Click Confirm to complete project authorization.
- Create a custom policy for Actions and Resources that cannot be authorized by tag, and apply it to the target IAM user to grant a global permission.
tip
Some Actions and Resources in veFaaS cannot be authorized by tags. Therefore, you need to make them accessible to the target IAM user by offering a global permission, in addition to implementing tag-based authorization for that user. Otherwise, the IAM user may not access the veFaaS resources.
- Create a custom policy.
- Assume the name is vefaas-other-generate-operation. The JSON content of the policy is shown below. Please add or remove specific Actions or Resources as needed.
-
- Add global authorization to the created vefaas-other-generate-operation policy.
- On the vefaas-other-generate-operation details page, select the Authorization > Global authorization tab, and click Add authorization. Select the user to authorize, and click Confirm to complete global authorization.
Validating results
- The IAM user successfully creates a function tagged as team:ai-prompt or a function containing this tag.
- If the IAM user creates a function with no tags or with a tag rather than team:ai-prompt, a message indicating insufficient permissions is displayed.
Last updated: 2026.08.19 14:06:07
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
