Role

2025-11-03 08:22:40

Roles represent the initial coarse-grained authorization mechanism provided by IAM, defining permissions based on users' job functions. This mechanism operates at the service level, offering a limited set of service-related roles for authorization.

Due to business dependencies between eSurfing Cloud services, when assigning a role to a user group, any dependent roles must also be granted to ensure proper permission enforcement. For details, refer to User Groups & Authorization > Authorization Method for Dependent Roles.

Role Content

When selecting a role for a user group, click the icon in front of the role to view its details. Taking the DAS Administrator as an example, the content of role-based permissions is explained.

Parameter Description

Table Parameter Description

Parameters		Definition	Value
Version		Role Version	1.0: Role-Based Access Control. 1.1: Policy-Based Access Control.
Statement: Role Authorization Statement	Action: Authorization Item	Operation Permissions	The format is: Service name: Resource type: Operation "DAS:DAS:": Indicates all operations on the DAS resource type in the DAS service. "DAS" is the service name.* "DAS" is the resource type. "" is a wildcard, representing all possible operations on the DAS resource type.
Statement: Role Authorization Statement	Effect:	Determine whether the operation permissions in the Action are allowed to be executed.	Allow Deny Description When the same Action has both Allow and Deny in its Effect, the Deny rule takes precedence.
Depends: Role dependencies	catalog	Service of the dependent role	Service name. For example, BASE, VPC.
Depends: Role dependencies	display_name	Dependent role name	Role Name Description When granting the example role "DAS Administrator" to a user group, you must also select its dependent roles—"Tenant Guest" and "DNS Administrator"—for it to take effect.

Identity and Access Management (Class II Node)

Role