Distributed Messaging Service (Kafka) is associated with eSurfing Cloud Identity and Access Management (IAM) and can control user access and operations through dimensions like console buttons, menus, and OpenAPIs, so as to achieve fine-grained management of user permissions and ensure access security.
Introduction to IAM
Identity and Access Management (IAM) is a basic service that supports user permission management and can help you securely control access and operation permissions of your cloud services and resources. Currently, eSurfing Cloud provides dedicated CTIAM services, which can be used for free after application. You only need to pay for the cloud services and resources in your account. For more information about IAM, see Identity and Access Management.
Main Concepts in IAM
l Master user: This is the account automatically created upon registration on eSurfing Cloud. The user has full access to the resources under the account, and can reset the user password as well as grant user permissions. If multiple people want to use the same eSurfing Cloud resources, it is recommended that you use sub-users for daily management to ensure account security.
l Sub-user: This is the account created in the User Center with IAM permissions granted. The username and password of a sub-user are controlled by the user that grant IAM permissions. Sub-users can also log in to the eSurfing Cloud console. The login portal is the same as that of the master user. But the resources they have access to are subject to their permissions granted.
l User group: A user group is a collection of users. IAM uses user groups to control user permissions. You must add an IAM user to a specific user group for the IAM user to be granted with permissions. Otherwise, the IAM user cannot access any resources or cloud services in your account.
l System Policy: Maintained by the product team. This involves common permissions preset in the system, mainly for read-only permissions or administrator permissions of multiple cloud services, such as read-only permissions or administrator permissions of ECS. System policies can only be used for authorization in the IAM console and cannot be edited or modified.
l Custom Policy: Permission sets that are created and managed by yourself in the IAM console. These permissions can be customized as an extension and supplement to system policies.
l Enterprise Project: The foundation for implementing fine-grained permission control over an enterprise organization. Cloud resources and enterprise members are managed by enterprise projects. User groups with authorization are bound with cloud resources through enterprise projects. Users' permissions to use cloud resources in the enterprise projects are subject to the permissions of the user groups.
System Policy
By default, Kafka provides three system policies for users to choose from, covering only permissions of features in the management console. Permissions of features out of the management console, such as order placement, must be configured separately. The three default policies are administrator policy (admin), user policy (user), and reviewer policy (reviewer). The permission models of the three policies are as follows:
Function Module | Permission Name | IAM Role | ||
admin | user | reviewer | ||
Instance Management | Expand Disk | Y | ||
Instance Management | Node Expansion | Y | ||
Instance Management | Specification Expansion | Y | ||
Instance Management | Instance List | Y | Y | Y |
Instance Management | Topic Management | Y | Y | Y |
Instance Management | Add Consumer Permission | Y | Y | |
Instance Management | Add Producer Permission | Y | Y | |
Instance Management | Add Topic | Y | Y | |
Instance Management | Application User Management | Y | Y | Y |
Instance Management | Batch Create Consumer Groups | Y | Y | |
Instance Management | Bulk Creation | Y | Y | |
Instance Management | Bulk Create Users | Y | Y | |
Instance Management | Bulk Subscription | Y | Y | |
Instance Management | Bulk Modify Permissions | Y | Y | |
Instance Management | Cluster Information | Y | Y | Y |
Instance Management | Consumer Group Management | Y | Y | Y |
Instance Management | Consumption Dialing Test | Y | Y | |
Instance Management | New Consumer Group | Y | Y | |
Instance Management | Create Topic | Y | Y | |
Instance Management | New User | Y | Y | |
Instance Management | Delete Consumer Group | Y | Y | |
Instance Management | Delete Topic | Y | Y | |
Instance Management | Delete User | Y | Y | |
Instance Management | Modify | Y | Y | |
Instance Management | Instance Details | Y | Y | Y |
Instance Management | Operational Auditing | Y | Y | Y |
Instance Management | Monitoring Information | Y | Y | Y |
Instance Management | Delete Message | Y | Y | |
Instance Management | Partition Status | Y | Y | Y |
Instance Management | Production Dialing Test | Y | Y | |
Instance Management | Offset Query | Y | Y | Y |
Instance Management | Timestamp Query | Y | Y | Y |
Instance Management | Reset Offset | Y | Y | |
Instance Management | Modify User | Y | Y | |
Instance Management | Manage Namespace | Y | Y | Y |
Instance Management | Obtain User Tokens | Y | Y | Y |
Instance Management | Create Namespace | Y | Y | |
Instance Management | Partition Migration | Y | Y | |
Instance Management | Modify Namespace | Y | Y | |
Instance Management | Create Instance | Y | ||
Instance Management | Modify Instance Name | Y | Y | |
Instance Management | Renew | Y | ||
Instance Management | Unsubscribe | Y | ||
Instance Management | Broker Details | Y | Y | Y |