在主控台中指派對 Direct Link 的存取權

在控制台中指派存取權限的常見方法：

• 每個使用者的存取原則。 您可以從主控台中的 管理 > 存取權 (IAM) > 使用者 頁面管理每個使用者的存取原則。 如需指派 IAM 存取權之步驟的相關資訊，請參閱 管理資源的存取權。
• 存取群組。 存取群組可用來簡化存取管理，方法是將存取權指派給群組一次，然後您可以視需要在群組中新增或移除使用者，以控制其存取權。 您可以從主控台中的 管理 > 存取權 (IAM) > 存取群組 頁面管理存取群組及其存取權。 如需相關資訊，請參閱 在主控台中指派群組的存取權。

使用 API 來指派對 Direct Link 的存取權

有關指派、刪除和審查存取權限的逐步說明，請參閱 使用 API 指派對資源的存取權限 或者 建立政策 API 文件。 下表中的角色雲端資源名稱 (CRN) 用來使用 API 指派存取權。

使用 directlink 取得服務名稱，並參閱角色 ID 值表以確保您使用的 CRN 值正確。

下列原則會將使用者「撰寫者」角色指派給帳戶中的所有 serviceName=directlink 資源。

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json' -d '{
  "type": "access",
  "description": "Writer role for Direct Link",
  "subjects": [
   {
    "attributes": [{
        "name": "iam_id",
        "value": "IBMid-123453user"
    }]
  }],
  "roles": [{
    "roles_id": "crn:v1:bluemix:public:directlink::::serviceRole:Writer"
   }],
  "resources": [{
    "attributes": [
    {
        "name": "accountId",
        "value": "1234567890987654321"
    },
    {
        "name": "serviceName",
        "value": "directlink"
    }]
}]

SubjectAttribute subjectAttribute = new SubjectAttribute.Builder()
      .name("iam_id")
      .value("IBMid-123453user")
      .build();
PolicySubject policySubjects = new PolicySubject.Builder()
      .addAttributes(subjectAttribute)
      .build();
PolicyRole policyRoles = new PolicyRole.Builder()
      .roleId("crn:v1:bluemix:public:directlink::::serviceRole:Writer")
      .build();
ResourceAttribute accountIdResourceAttribute = new ResourceAttribute.Builder()
      .name("accountId")
      .value("ACCOUNT_ID")
      .operator("stringEquals")
      .build();
ResourceAttribute serviceNameResourceAttribute = new ResourceAttribute.Builder()
      .name("serviceName")
      .value("directlink")
      .operator("stringEquals")
      .build();
PolicyResource policyResources = new PolicyResource.Builder()
      .addAttributes(accountIdResourceAttribute)
      .addAttributes(serviceNameResourceAttribute)
      .build();
CreatePolicyOptions options = new CreatePolicyOptions.Builder()
      .type("access")
      .subjects(Arrays.asList(policySubjects))
      .roles(Arrays.asList(policyRoles))
      .resources(Arrays.asList(policyResources))
      .build();
Response<Policy> response = service.createPolicy(options).execute();
Policy policy = response.getResult();
System.out.println(policy);

policy_subjects = PolicySubject(
  attributes=[SubjectAttribute(name='iam_id', value='IBMid-123453user')])
policy_roles = PolicyRole(
  role_id='crn:v1:bluemix:public:directlink::::serviceRole:Writer')
account_id_resource_attribute = ResourceAttribute(
  name='accountId', value='ACCOUNT_ID')
service_name_resource_attribute = ResourceAttribute(
  name='serviceName', value='directlink')
policy_resources = PolicyResource(
  attributes=[account_id_resource_attribute,
        service_name_resource_attribute])
policy = iam_policy_management_service.create_policy(
  type='access',
  subjects=[policy_subjects],
  roles=[policy_roles],
  resources=[policy_resources]
).get_result()
print(json.dumps(policy, indent=2))

subjectAttribute := &iampolicymanagementv1.SubjectAttribute{
  Name:  core.StringPtr("iam_id"),
  Value: core.StringPtr("IBMid-123453user"),
}
policySubjects := &iampolicymanagementv1.PolicySubject{
  Attributes: []iampolicymanagementv1.SubjectAttribute{*subjectAttribute},
}
policyRoles := &iampolicymanagementv1.PolicyRole{
  RoleID: core.StringPtr("crn:v1:bluemix:public:directlink::::serviceRole:Writer"),
}
accountIDResourceAttribute := &iampolicymanagementv1.ResourceAttribute{
  Name:     core.StringPtr("accountId"),
  Value:    core.StringPtr("ACCOUNT_ID"),
  Operator: core.StringPtr("stringEquals"),
}
serviceNameResourceAttribute := &iampolicymanagementv1.ResourceAttribute{
  Name:     core.StringPtr("serviceName"),
  Value:    core.StringPtr("directlink"),
  Operator: core.StringPtr("stringEquals"),
}
policyResources := &iampolicymanagementv1.PolicyResource{
  Attributes: []iampolicymanagementv1.ResourceAttribute{
    *accountIDResourceAttribute, *serviceNameResourceAttribute}
}
options := iamPolicyManagementService.NewCreatePolicyOptions(
  "access",
  []iampolicymanagementv1.PolicySubject{*policySubjects},
  []iampolicymanagementv1.PolicyRole{*policyRoles},
  []iampolicymanagementv1.PolicyResource{*policyResources},
)
policy, response, err := iamPolicyManagementService.CreatePolicy(options)
if err != nil {
  panic(err)
}
b, _ := json.MarshalIndent(policy, "", "  ")
fmt.Println(string(b))

const policySubjects = [
  {
    attributes: [
      {
        name: 'iam_id',
        value: 'IBMid-123453user',
      },
    ],
  },
];
const policyRoles = [
  {
    role_id: 'crn:v1:bluemix:public:directlink::::serviceRole:Writer',
  },
];
const accountIdResourceAttribute = {
  name: 'accountId',
  value: 'ACCOUNT_ID',
  operator: 'stringEquals',
};
const serviceNameResourceAttribute = {
  name: 'serviceName',
  value: 'directlink',
  operator: 'stringEquals',
};
const policyResources = [
  {
    attributes: [accountIdResourceAttribute, serviceNameResourceAttribute]
  },
];
const params = {
  type: 'access',
  subjects: policySubjects,
  roles: policyRoles,
  resources: policyResources,
};
iamPolicyManagementService.createPolicy(params)
  .then(res => {
    examplePolicyId = res.result.id;
    console.log(JSON.stringify(res.result, null, 2));
  })
  .catch(err => {
    console.warn(err)
  });

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json' -d '{
  "type": "access",
  "description": "Writer role for Direct Link Dedicated",
  "subjects": [
  {
    "attributes": [{
        "name": "iam_id",
        "value": "IBMid-123453user"
  }]
}],
"roles": [{
    "roles_id": "crn:v1:bluemix:public:directlink::::serviceRole:Writer"
}],
"resources": [{
    "attributes": [
    {
        "name": "accountId",
        "value": "1234567890987654321"
    },
    {
        "name": "serviceName",
        "value": "directlink"
    },
    {
        "name": "dedicatedId",
        "value": "*"
    }]
}]

使用 Terraform 指派對 directlink 的存取權

下列範例是針對 directlink 指派 Editor 角色:

使用 directlink 作為服務名稱。

resource "ibm_iam_user_policy" "policy" {
  ibm_id = "test@example.com"
  roles  = ["Editor"]
  resources {
    service = "directlink"
  }
}

如需相關資訊，請參閱 ibm_iam_user_policy。