Access control to specific resources
When you need to assign specific permissions on each resource, you need to create a Policy and specify the Resource correctly. In this tutorial, we will guide you to assign permissions on each server of vServer, for example when you have 2 servers: web1-server, db-server, and you want User: System1 to have full rights on all Resources of vServer. , but only full rights on Resource:server are web1-server, not allowing operations on the important server db-server . The model will look like below:
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252Fb6DTqNdnWe2LUfCCnJZY%25252Fiam-specific-resource.drawio.png%253Falt%253Dmedia%2526token%253D85fbe7d0-e189-4f25-a6b1-927aea64d9c9%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3De2e3c514%26sv%3D1&width=768&dpr=4&quality=100&sign=3c0fec02&sv=1)
To set up IAM according to the above model, we will have the following steps:
Step 1 : Create User: System1 if you do not have a User Account (note that if you already have User: System1, make sure User: System1 does not have any rights or does not have rights that overlap with the instructions)
Step 2 : Get the ID information of the server web1-server
Step 3 : Create a Policy with the name vServerFullAccessWebServers that allows access to all resources of vServer, but only full rights on web1-server
Step 4 : Attach Policy: vServerFullAccessWebServers to User: System1
Step 5 : Log in and check the rights of User: System1
Detailed steps are as follows
Step 1: Create User: System1 if you do not have a User Account (note that if you already have User: System1, make sure User: System1 does not have any rights or does not have rights that overlap with the instructions)
Create a User Account by accessing the User Account tab on the IAM management page here , clicking Create a User Account, filling in Username and Password information, then clicking Create User Account
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252Fh99DI1M7zd14TH4fddYZ%25252Fimage2023-7-12_15-18-33.png%253Falt%253Dmedia%2526token%253Ddd0d78fd-d46d-4dab-bca3-504a1399e838%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3D8d4f9bb2%26sv%3D1&width=768&dpr=4&quality=100&sign=1d388b7d&sv=1)
After successfully creating a User Account, it will be listed on the User Account page as below
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252FtT7hVLY2ITRVPFTHooqq%25252Fimage2023-7-12_15-19-37.png%253Falt%253Dmedia%2526token%253D864c508a-f984-4114-8c9b-27bf6b0f5164%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3Dfaf9ba40%26sv%3D1&width=768&dpr=4&quality=100&sign=7e18a5db&sv=1)
Step 2: Get the ID information of the server web1-server
Visit the server management page here to get server ID information, click Copy ID at server web1-server to get the ID, save it for use in the next steps.
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252FsrOvIubGZoxv2aqpbCil%25252Fimage2023-7-12_16-25-13.png%253Falt%253Dmedia%2526token%253Db3097754-146d-4f28-82b7-e152f05cfde3%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3D1dfdf3d8%26sv%3D1&width=768&dpr=4&quality=100&sign=141e187e&sv=1)
Step 3: Create a Policy with the name vServerFullAccessWebServers that allows access to all resources of vServer, but only full rights on web1-server
To create a Policy, go to the Policy tab on the IAM page here , click Create a Policy , name the Policy: vServerFullAccessWebServers and click Next step
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252FmPCGK6iLohYVYnSXodMK%25252Fimage2023-7-12_15-22-45.png%253Falt%253Dmedia%2526token%253Dfd3f5c6d-7d56-4e49-9883-57f5df69b232%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3Def5e8a05%26sv%3D1&width=768&dpr=4&quality=100&sign=8033299c&sv=1)
Select Product : vserver and Actions : All vserver actions to select all vServer actions
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252Fo00qtZOf2HaqczBNhVgo%25252Fimage2023-7-12_15-24-23.png%253Falt%253Dmedia%2526token%253Def775eee-f5e9-4100-8e03-596d9a682fa6%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3D1f6391c1%26sv%3D1&width=768&dpr=4&quality=100&sign=8cf94faf&sv=1)
Then in the Resource section, click on the Resource arrow to select Resource information, select Any for other Resource types, and Resource: server , click Add a server to add specific servers that are allowed to operate.
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252F0lmSdWdFm6dfuL87tpQz%25252Fimage2023-7-12_15-36-37.png%253Falt%253Dmedia%2526token%253D84f6f34c-ac9f-43e9-8e38-b0dee11dd998%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3D31ff0f14%26sv%3D1&width=768&dpr=4&quality=100&sign=ea7ab63d&sv=1)
The popup displays you fill in the server ID information of web1-server , click Add to add.
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252FIKKKPIlUDn3PUKsuzbpU%25252Fimage2023-7-12_15-37-46.png%253Falt%253Dmedia%2526token%253Dae9aef31-d4e6-4d37-bf6d-db60a7d9b7a6%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3Da04ff287%26sv%3D1&width=768&dpr=4&quality=100&sign=ae208ed1&sv=1)
At this point you will see Resouce information: the server already has the server ID of web1-server. If you want to add more server IDs, continue clicking Add a server to add. Then click Create Policy to create the Policy
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252FuCLHmPqziHkmd3NP7ZxX%25252Fimage2023-7-12_15-39-6.png%253Falt%253Dmedia%2526token%253Dd687b8fb-a1af-4051-b019-c85e2963bcf1%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3Dadad6ec2%26sv%3D1&width=768&dpr=4&quality=100&sign=59ab2b6e&sv=1)
Step 4: Attach Policy: vServerFullAccessWebServers to User: System1
After successfully creating Policy: vServerFullAccessWebServers, you proceed to attach this Policy to User: System1, you can do it in User Account or Policy, here we will guide in Policy, click on the name of the Policy to go to the details page. Policy details:
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252F18cygYbXDvuCdNh8g1M1%25252Fimage2023-7-12_15-46-16.png%253Falt%253Dmedia%2526token%253D1c58ca61-1496-46d2-8aad-13dc74ac5c8f%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3Dad7a0b0%26sv%3D1&width=768&dpr=4&quality=100&sign=33c3e0f9&sv=1)
Select the Policy usage tab and click Attach to add User: System1
Select User: System1 and click Add
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252FaNUhrPxOO3bkWKRbNUXe%25252Fimage2023-7-12_15-48-3.png%253Falt%253Dmedia%2526token%253D67f20fee-8b52-43f5-9d75-255abd286b5a%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3D9f42b123%26sv%3D1&width=768&dpr=4&quality=100&sign=8a25b5d2&sv=1)
After adding User: System1 to Policy: vServerFullAccessWebServer, you will see information like below
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252FdcmNQSWExCFNaul2PVAP%25252Fimage2023-7-12_15-49-17.png%253Falt%253Dmedia%2526token%253D5a205a08-7ccd-4418-ba85-7a5d3a9af776%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3Dc0d0690c%26sv%3D1&width=768&dpr=4&quality=100&sign=af2fabfd&sv=1)
Step 5 : Log in and check the rights of User: System1
Now you can log in to User: System1 to check permissions
Access vServer here , without logging into any account you will be redirected to the sign-in page, select " Sign-in With IAM User Account "
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252FRQCKLmbVTKw01hNW2oBa%25252Fimage2023-7-12_13-48-49.png%253Falt%253Dmedia%2526token%253Db0388752-d3c2-4dab-ada2-3aec720d8387%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3Dbd5f0942%26sv%3D1&width=768&dpr=4&quality=100&sign=c6b72250&sv=1)
Fill in the root user email account information that User: System1 was previously created, IAM username and password information of User: System1, click Sign-in with IAM User Account
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252F0VMJCy7OahicDX416x61%25252Fimage2023-7-12_15-56-13.png%253Falt%253Dmedia%2526token%253D8463d9d7-bd9d-4f62-bb9a-789cc25743dc%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3D7b5bb285%26sv%3D1&width=768&dpr=4&quality=100&sign=9d12cbac&sv=1)
You will now see that User: System1 will have full rights on server web1-server and other resources of vServer.
Accessed web1-server's detail page successfully
![](https://docs.vngcloud.vn/~gitbook/image?url=https%3A%2F%2Fdocs.vngcloud.vn%2F%7Egitbook%2Fimage%3Furl%3Dhttps%253A%252F%252F3672463924-files.gitbook.io%252F%257E%252Ffiles%252Fv0%252Fb%252Fgitbook-x-prod.appspot.com%252Fo%252Fspaces%25252FB0NrrrdJdpYOYzRkbWp5%25252Fuploads%25252FtFNBw1Uk4Bps2nCjOBFc%25252Fimage2023-7-12_15-58-35.png%253Falt%253Dmedia%2526token%253D176f890b-966c-4a41-9e25-13bfd90a77e3%26width%3D768%26dpr%3D4%26quality%3D100%26sign%3Da0b411f3%26sv%3D1&width=768&dpr=4&quality=100&sign=98f7ba25&sv=1)
Successfully shutdown web1-server:
Accessing db-server details page failed:
Failed to shutdown db-server:
So you have completed decentralizing User: System1 with full rights on all Resources of vServer, but only granting full rights on Resource: server: web1-server, not allowing operations on the important server, db. -server
Last updated