在账户级别创建卷备份授权

要创建服务到服务授权策略，请遵循以下过程:

1. 在IBM Cloud控制台中，转到管理 > 访问 (IAM)。
2. 从侧面板中，选择 授权。
3. 在 “管理授权”页面上，单击 “创建”。
4. 在 源 部分中，选择 源帐户。 在帐户中设置“备份”服务的授权时，请选择 此帐户。 单击 下一步。
5. 对于源服务，从列表中选择 VPC 基础架构服务。 单击下一步。
   1. 通过单击 特定资源来选择作用域。
   2. 单击“选择一个属性”。
   3. 从列表中选择 资源类型。
   4. 在下一个字段中，选择 IBM Cloud Backup for VPC。
   5. 单击下一步。
6. 对于目标服务，从列表中选择 VPC 基础架构服务。 单击下一步。
   1. 通过单击 特定资源来选择作用域。
   2. 单击“选择一个属性”。
   3. 单击 资源类型。 请从以下服务中选择一项。 您需要为所有这些用户创建授权。

（可选）若要将授权范围限制在特定的虚拟服务器实例上，请单击“添加条件”，然后从属性列表中选择 “实例 ID”。 然后，从菜单中选择一个特定的实例。

将授权范围限制在特定实例上会导致连接到其他实例的卷备份失败。 如果为 Virtual Server for VPC 添加条件，则必须为每个需要备份卷的实例分别创建一个授权策略。 如需了解更多信息，请参阅 “授权范围问题的故障排除”。

1. 单击下一步。
2. 选择角色。 如需了解更多信息，请参阅相应角色的表格。
3. 单击 复审 并检查您的选择。
4. 单击授权。
5. 返回到“管理权限”页面时，请再次单击 创建，并遵循相同的步骤为其余服务设置权限。

在账户级别创建文件共享备份授权

要创建服务到服务授权策略，请遵循以下过程:

1. 在IBM Cloud控制台中，转到管理 > 访问 (IAM)。
2. 从侧面板中，选择 授权。
3. 在 “管理授权”页面上，单击 “创建”。
4. 在 源 部分中，选择 源帐户。 在帐户中设置“备份”服务的授权时，请选择 此帐户。 单击 下一步。
5. 对于源服务，从列表中选择 VPC 基础架构服务。 单击下一步。
   1. 通过单击 特定资源来选择作用域。
   2. 单击“选择一个属性”。
   3. 从列表中选择 资源类型。
   4. 在下一个字段中，选择 IBM Cloud Backup for VPC。
   5. 单击下一步。
6. 对于目标服务，从列表中选择 VPC 基础架构服务。 单击下一步。
   1. 通过单击 特定资源来选择作用域。
   2. 单击“选择一个属性”。
   3. 单击 资源类型。 选择 File Storage for VPC.
7. 单击下一步。
8. 选择角色：编辑、分享快照操作员。
9. 单击 复审 并检查您的选择。
10. 单击授权。

从子账户为企业账户管理的备份创建跨账户授权

为了让企业管理员能够集中管理备份，子账户必须授权企业账户的备份服务与其资源进行交互。 子账户管理员可以按照以下步骤在其账户中本地创建授权。

1. 在IBM Cloud控制台中，转到管理 > 访问 (IAM)。
2. 从侧面板中，选择 授权。
3. 在 “管理授权”页面上，单击 “创建”。
4. 在 源 部分中，选择 源帐户。 在为企业帐户的备份服务设置授权时，请选择 特定帐户，然后输入企业帐户的标识。 单击 下一步。
5. 对于源服务，从列表中选择 VPC 基础架构服务。 单击下一步。
   1. 通过单击 特定资源来选择作用域。
   2. 单击“选择一个属性”。
   3. 从列表中选择 资源类型。
   4. 在下一个字段中，选择 IBM Cloud Backup for VPC。
   5. 单击下一步。
6. 对于目标服务，从列表中选择 VPC 基础架构服务。
   1. 通过单击 特定资源来选择作用域。
   2. 单击“选择一个属性”。
   3. 单击 资源类型。 在表 2 中选择其中一个服务。

1. 单击下一步。
2. 选择角色。 如需了解更多信息，请参阅表 2 以了解相应的角色。
3. 单击 复审 并检查您的选择。
4. 单击授权。
5. 返回到“管理权限”页面时，请再次单击 创建，并遵循相同的步骤为其余服务设置权限。

为企业管理的备份创建跨账户授权模板

借助 授权模板，企业账户管理员可以创建授权策略，并将其分配给子账户。 随后，该授权将应用于这些账户，而无需管理员逐一登录每个子账户。

1. 在 IBM Cloud 控制台中，转到管理 > 访问 (IAM) > 企业 > 模板。
2. 选择“授权”，然后单击“创建”。
3. 输入授权模板的名称和描述，说明其对企业用户的用途。
4. 输入企业管理授权策略的描述，说明该策略对子账户用户的作用。
5. 单击创建。

接下来，完成以下步骤以建立授权规则：

1. 转到 授权 指定授权策略的详细信息。
2. 选择源服务请求访问另一服务的账户。 选择指定账户。 当您稍后将授权模板分配给子账户时，“源账户”字段会自动设置为与持有被访问资源的子账户相匹配。
3. 然后，选择源服务和资源。
   1. 从列表中选择 VPC 基础设施服务。 单击下一步。
   2. 通过单击 特定资源来选择作用域。
   3. 单击“选择一个属性”。
   4. 从列表中选择 资源类型。
   5. 在下一个字段中，选择 IBM Cloud Backup for VPC。
4. 对于目标服务，从列表中选择 VPC 基础架构服务。
   1. 通过单击 特定资源来选择作用域。
   2. 单击“选择一个属性”。
   3. 从列表中选择 资源类型。 从下表中选择一项服务。 您需要为所有这些用户创建授权。

1. 单击下一步。
2. 选择角色。 如需了解更多信息，请参阅相应角色的表格。
3. 单击 复审 并检查您的选择。 然后，单击保存。
4. 提交并为子账户分配该模板。 重复上述步骤，为所有服务创建授权模板。

在账户级别创建卷备份授权

若要在您的账户中使用“VPC 备份”来创建策略和计划，并为块存储卷运行备份任务，请创建以下服务间授权：

• backup-policy (源) 到具有 操作员 角色的 instance (目标)
• backup-policy (源) 到具有 操作员 角色的 volume (目标)
• backup-policy (源) 到具有 编辑者 角色的 snapshot (目标)
• backup-policy (源) 到具有 编辑者 角色的 snapshot-consistency-group (目标)

1. 使用以下信息为授权策略创建四个 JSON 文件。

请保留示例中的通配符值（"*" ）。 将通配符替换为具体的资源 ID 会限制授权范围，并导致备份失败。 如需了解更多信息，请参阅 “授权范围问题的故障排除”。

• 实例服务:

  {
    "type": "authorization",
    "subject": {
        "attributes": [
             {"name": "accountId", "value": "ACCOUNT_ID"},
             {"name": "serviceName", "value": "is"},
             {"name": "resourceType", "value": "backup-policy"}]},
    "roles": [
        {"role_id": "crn:v1:bluemix:public:iam::::role:Operator"}],
    "resources": [
        {"attributes": [
             {"name": "accountId", "value": "ACCOUNT_ID"},
             {"name": "serviceName", "operator": "stringEquals", "value": "is"},
             {"name": "instanceId", "operator": "stringEquals", "value": "*"}]}]
  }
  

• Block Storage 卷服务：

  {
    "type": "authorization",
    "subject": {
        "attributes": [
             {"name": "accountId", "value": "ACCOUNT_ID"},
             {"name": "serviceName", "value": "is"},
             {"name": "resourceType", "value": "backup-policy"}]},
    "roles": [
        {"role_id": "crn:v1:bluemix:public:iam::::role:Operator"}],
    "resources": [
        {"attributes": [
             {"name": "accountId", "value": "ACCOUNT_ID"},
             {"name": "serviceName", "operator": "stringEquals", "value": "is"},
             {"name": "volumeId", "operator": "stringEquals", "value": "*"}]}]
  }
  

• Block Storage 快照服务：

  {
    "type": "authorization",
    "subject": {
        "attributes": [
             {"name": "accountId", "value": "ACCOUNT_ID"},
             {"name": "serviceName", "value": "is"},
             {"name": "resourceType", "value": "backup-policy"}]},
    "roles": [
        {"role_id": "crn:v1:bluemix:public:iam::::role:Editor"}],
    "resources": [
        {"attributes": [
             {"name": "accountId", "value": "ACCOUNT_ID"},
             {"name": "serviceName", "operator": "stringEquals", "value": "is"},
             {"name": "snapshotId", "operator": "stringEquals", "value": "*"}]}]
  }
  

• 快照一致性组:

  {
   "type": "authorization",
   "subject": {
       "attributes": [
            {"name": "accountId", "value": "ACCOUNT_ID"},
            {"name": "serviceName", "value": "is"},
            {"name": "resourceType", "value": "backup-policy"}]},
   "roles": [
       {"role_id": "crn:v1:bluemix:public:iam::::role:Editor"}],
   "resources": [
       {"attributes": [
            {"name": "accountId", "value": "ACCOUNT_ID"},
            {"name": "serviceName", "operator": "stringEquals", "value": "is"},
            {"name": "snapshotConsistencyGroupId", "operator": "stringEquals", "value": "*"}]}]
  }
  

1. 然后，使用 JSON 文件来运行以下 CLI 命令。

   ibmcloud iam authorization-policy-create --file ~/Documents/policy.json
   

有关可用于此命令的所有参数的更多信息，请参阅 ibmcloud iam authorization-policy-create。

为企业管理的备份创建跨账户授权模板

企业账户管理员可以 创建授权策略模板并将其分配 给子账户，从而集中管理授权。 要创建一个授权策略模板，以便在企业下属的所有子账户中用于备份策略，请按照以下步骤操作。

1. 要获取企业根账户 ID，可以运行以下命令。

ibmcloud enterprise show

1. 创建 JSON 文件，提供授权策略模板的定义。 有关 JSON 文件中可使用的属性的更多信息，请参阅 IAM Policy Management API。

• 实例服务:

  {
   "name": "Centralized authorization for Backup service to work with Instances",
   "description": "Grant Operator Role for the Backup service to work with Instances",
   "account_id": "ENTERPRISE_ROOT_ACCOUNT_ID",
   "policy":{
     "type": "authorization",
     "description": "Grant Operator on VPC Instances",
     "control":{
         "grant":{
           "roles":[
             {"role_id": "crn:v1:bluemix:public:iam::::role:Operator"}]
           }},
     "subject":{
         "attributes":[
             {"key": "serviceName", "operator": "stringEquals", "value": "is"},
             {"key": "resourceType", "operator": "stringEquals", "value": "backup-policy"}
           ]},
     "resource":{
         "attributes":[
             {"key": "serviceName", "operator": "stringEquals", "value": "is"},
             {"key": "instanceId", "operator": "stringExists", "value": true}
           ]}}
  }
  

  • Block Storage 卷服务：

  {
       "name": "Centralized authorization for Backup service to work with Block Storage service",
       "description": "Grant Operator Role for the Backup service to work with Block Storage volumes",
       "account_id": "ENTERPRISE_ROOT_ACCOUNT_ID",
       "policy":{
         "type": "authorization",
         "description": "Grant Operator on Block Storage for VPC volumes",
         "control": {
             "grant": {
               "roles": [
                 {"role_id": "crn:v1:bluemix:public:iam::::role:Operator"}]
             }},
         "subject": {
           "attributes": [
             {"key": "serviceName", "value": "is"},
             {"key": "resourceType", "value": "backup-policy"}
             ]},
         "resource": {
           "attributes": [
              {"key": "serviceName", "operator": "stringEquals", "value": "is"},
              {"key": "volumeId", "operator": "stringExists", "value": "true"}
             ]}}
  }
  

  • Block Storage 快照服务：

  {
       "name": "Centralized authorization for Backup service to work with Block Storage snapshots",
       "description": "Grant Editor Role for the Backup service to work with Block Storage snapshots",
       "account_id": "ENTERPRISE_ROOT_ACCOUNT_ID",
       "policy": {
         "type": "authorization",
         "description": "Grant Editor on Block Storage for VPC snapshots",
         "control": {
             "grant": {
               "roles": [
                 {"role_id": "crn:v1:bluemix:public:iam::::role:Editor"}]
             }},
         "subject": {
           "attributes": [
             {"key": "serviceName", "value": "is"},
             {"key": "resourceType", "value": "backup-policy"}
             ]},
         "resource": {
           "attributes": [
             {"key": "serviceName", "operator": "stringEquals", "value": "is"},
             {"key": "snapshotId", "operator": "stringExists", "value": "true"}
             ]}}
  }
  

  • 快照一致性组:

   {
        "name": "Centralized authorization for Backup service to work with snapshot consistency groups",
        "description": "Grant Editor Role for the Backup service to work with snapshot consistency groups",
        "account_id": "ENTERPRISE_ROOT_ACCOUNT_ID",
        "policy": {
          "type": "authorization",
          "description": "Grant Editor on snapshot consistency groups",
          "control": {
              "grant": {
                "roles": [
                  {"role_id": "crn:v1:bluemix:public:iam::::role:Editor"}]
              }},
          "subject": {
            "attributes": [
              {"key": "serviceName", "value": "is"},
              {"key": "resourceType", "value": "backup-policy"}
              ]},
          "resource": {
            "attributes": [
              {"key": "serviceName", "operator": "stringEquals", "value": "is"},
              {"key": "snapshotConsistencyGroupId", "operator": "stringExists", "value": "true"}
              ]}}
   }
  

  • 文件共享：

    {
         "name": "Centralized authorization for Backup service to work with File shares",
         "description": "Grant Editor Role for the Backup service to work with File shares",
         "account_id": "ENTERPRISE_ROOT_ACCOUNT_ID",
         "policy": {
           "type": "authorization",
           "description": "Grant Editor, and Share Snapshot Operator roles on File shares",
           "control": {
               "grant": {
                 "roles": [
                   {"role_id": "crn:v1:bluemix:public:iam::::role:Editor"},{"role_id": "crn:v1:bluemix:public:iam::::role:ShareSnapshotOperator"}]
           },
           "subject": {
             "attributes": [
               {"key": "serviceName", "value": "is"},
               {"key": "resourceType", "value": "backup-policy"}]
           },
           "resource": {
             "attributes": [
               {"key": "serviceName", "operator": "stringEquals", "value": "is"},
               {"key": "shareId", "operator": "stringExists", "value": "true"}]
           }
         }
    }
  

1. 如以下请求示例所示，使用 JSON 文件运行 authorization-policy-template-create 命令：

   ibmcloud iam authorization-policy-template-create --file /path/to/vpc-share-authorization-template.json
   

2. 对所有 JSON 文件重复上述步骤。 完成后，模板就可以提交并分配给子账户了。

3. 运行以下命令提交模板版本并将模板分配给目标账户。

   ibmcloud iam authorization-policy-template-version-commit (TEMPLATE_ID | TEMPLATE_NAME) TEMPLATE_VERSION [-q, --quiet]
   

   ibmcloud iam authorization-policy-assignment-create (TEMPLATE_ID | TEMPLATE_NAME) TEMPLATE_VERSION --target-type TYPE --target TARGET [-q, --quiet] [-o, --output FORMAT]
   

有关此命令可用参数的更多信息，请参阅 ibmcloud iam authorization-policy-template-create。

在账户级别创建卷备份授权

若要在您的账户中使用“VPC 备份”来创建策略和计划，并为块存储卷运行备份任务，请创建以下服务间授权：

• is.backup-policy (源) 到具有 操作员 角色的 is.instance (目标)。
• is.backup-policy (源) 到具有 操作员 角色的 is.volume (目标)。
• is.backup-policy (源) 到具有 editor 角色的 is.snapshot (目标)。
• is.backup-policy (源) 到具有 editor 角色的 is.snapshot-consistency-group

向 IAM 策略管理 API 发出请求，类似于以下示例。

请保留示例中的通配符值（"*" ）。 将通配符替换为具体的资源 ID 会限制授权范围，并导致备份失败。 如需了解更多信息，请参阅 “授权范围问题的故障排除”。

curl -X POST 'https://iam.cloud.ibm.com/v1/policies'
-H 'Authorization: Bearer $TOKEN'
-H 'Content-Type: application/json'
-d '{
   "type": "access",
   "description": "Operator role for the Backup service to the Virtual Server service",
   "subjects": [
    {"attributes": [
       {"name": "serviceName", "value": "is"},
       {"name": "accountId", "value": "$ACCOUNT_ID"},
       {"name": "resourceType", "value": "backup-policy"}]
    }
   ],
  "roles":[
    {"role_id": "crn:v1:bluemix:public:iam::::role:Operator"}
   ],
   "resources":[
    {"attributes":[
      {"name": "accountId", "value": "$ACCOUNT_ID"},
      {"name": "serviceName", "operator": "stringEquals", "value": "is"},
      {"name": "instanceId", "operator": "stringEquals", "value": "*"}]
    }
  ]
}'

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' \
-H 'Authorization: Bearer $TOKEN' \
-H 'Content-Type: application/json' \
-d '{
   "type": "access",
   "description": "Operator role for the Backup service to the Cloud Block Storage",
   "subjects":[
    {"attributes":[
      {"name": "serviceName", "value": "is"},
      {"name": "accountId", "value": "$ACCOUNT_ID"},
      {"name": "resourceType", "value": "backup-policy"}]
    }],
   "roles":[
    {"role_id": "crn:v1:bluemix:public:iam::::role:Operator"}
    ],
   "resources":[
    {"attributes": [
      {"name": "accountId", "value": "$ACCOUNT_ID"},
      {"name": "serviceName", "operator": "stringEquals", "value": "is.volume"},
      {"name": "volumeId", "operator": "stringEquals", "value": "*"}
     ]
    }
   ]
}'

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' \
-H 'Authorization: Bearer $TOKEN' \
-H 'Content-Type: application/json' \
-d '{
   "type": "access",
   "description": "Editor role for the Backup service to Block Storage Snapshots",
   "subjects": [
    {"attributes": [
      {"name": "serviceName", "value": "is"},
      {"name": "accountId", "value": "$ACCOUNT_ID"},
      {"name": "resourceType", "value": "backup-policy"}]
    }
   ],
   "roles":[
    {"role_id": "crn:v1:bluemix:public:iam::::role:Editor"}
   ],
   "resources":[
    {"attributes": [
      {"name": "accountId", "value": "$ACCOUNT_ID"},
      {"name": "serviceName", "operator": "stringEquals", "value": "is"},
      {"name": "snapshotId", "operator": "stringEquals", "value": "*"}]
    }
   ]
}'

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' \
-H 'Authorization: Bearer $TOKEN' \
-H 'Content-Type: application/json' \
-d '{
   "type": "access",
   "description": "Editor role for the Backup service to the Snapshot consistency groups",
   "subjects": [
    {"attributes": [
       {"name": "serviceName", "value": "is"},
       {"name": "accountId", "value": "$ACCOUNT_ID"},
       {"name": "resourceType", "value": "backup-policy"}]
    }
   ],
  "roles":[
    {"role_id": "crn:v1:bluemix:public:iam::::role:Editor"}
   ],
   "resources":[
    {"attributes":[
      {"name": "accountId", "value": "$ACCOUNT_ID"},
      {"name": "serviceName", "operator": "stringEquals", "value": "is"},
      {"name": "snapshotConsistencyGroupId", "operator": "stringEquals", "value": "*"}]
    }
  ]
}'

有关更多信息，请参阅 IAM 策略管理 的 API 规范。

从子账户为企业管理的卷备份创建跨账户授权

要允许企业管理员集中管理备份，子帐户必须为企业帐户的备份服务提供授权，以便与子帐户的资源进行交互。

1. 向 企业管理 API 发出 API 请求，以获取父企业帐户的帐户标识。

   curl -X GET "https://enterprise.cloud.ibm.com/v1/enterprises"
   -H "Authorization: Bearer <IAM_Token>"
   -H 'Content-Type: application/json'
   

2. 然后，向 IAM 策略管理 API 发出请求，为企业帐户的 is.backup-policy 创建服务到服务授权，以与子帐户的 is.backup，is.snapshot，is.volume，is.snapshot-consistency-group 和 is.instance 服务进行交互。

   • 授权 is.backup-policy (源) 与具有 editor 角色的 is.backup-policy (目标) 进行交互。

   curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H
   'Authorization: Bearer $TOKEN' -H
   'Content-Type: application/json' -d
   '{
     "type": "access",
     "description": "Editor role for the Enterprise account's backup service to interact with this account's backup service.",
     "subjects": [
       {"attributes": [
          {"name": "serviceName", "value": "is"},
          {"name": "accountId", "value": "$ENTERPRISE_ACCOUNT_ID"},
          {"name": "resourceType", "value": "backup-policy"}]
        }
      ],
     "roles":[
       {"role_id": "crn:v1:bluemix:public:iam::::role:Editor"}
     ],
     "resources":[
       {"attributes":[
          {"name": "accountId", "value": "$SUB_ACCOUNT_ID", "operator": "stringEquals"},
          {"name": "serviceName", "operator": "stringEquals", "value": "is"},
          {"name": "backupPolicyId", "operator": "stringEquals", "value": "*"}]
       }
      ]
     }'
   

   • 授权 is.backup-policy (源) 与具有 操作员 角色的 is.volume (目标) 进行交互。

   curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H
   'Authorization: Bearer $TOKEN' -H
   'Content-Type: application/json' -d
   '{
     "type": "access",
     "description": "Operator role for the Enterprise account's backup service to interact with this account's volume service",
     "subjects": [
       {
        "attributes": [
          {"name": "serviceName", "value": "is"},
          {"name": "accountId", "value": "$ENTERPRISE_ACCOUNT_ID"},
          {"name": "resourceType", "value": "backup-policy"}]
        }
      ],
     "roles":[
       {"role_id" "crn:v1:bluemix:public:iam::::role:Operator"}
      ],
     "resources":[
       {"attributes": [
          {"name": "accountId", "value": "$SUB_ACCOUNT_ID"},
          {"name": "serviceName", "operator": "stringEquals", "value": "is.volume"},
          {"name": "volumeId", "operator": "stringEquals", "value": "*"}]
       }
      ]
   }'
   

   • 授权 is.backup-policy (源) 与具有 editor 角色的 is.snapshot (目标) 进行交互。

   curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H
   'Authorization: Bearer $TOKEN' -H
   'Content-Type: application/json' -d
    '{
      "type": "access",
      "description": "Editor role for the Enterprise account's backup service to interact with this account's snapshots",
      "subjects":[
       {
        "attributes":[
          {"name": "serviceName", "value": "is"},
          {"name": "accountId", "value": "$ENTERPRISE_ACCOUNT_ID"},
          {"name": "resourceType", "value": "backup-policy"}]
        }
       ],
      "roles":[
         {"role_id": "crn:v1:bluemix:public:iam::::role:Editor"}
       ],
      "resources":[
         {"attributes": [
          {"name": "accountId", "value": "$SUB_ACCOUNT_ID"},
          {"name": "serviceName", "operator": "stringEquals", "value": "is"},
          {"name": "snapshotId", "operator": "stringEquals", "value": "*"}]
       }
      ]
    }'
   

   • 授权 is.backup-policy (源) 与具有 操作员 角色的 is.instance (目标) 进行交互。

   curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H
   'Authorization: Bearer $TOKEN' -H
   'Content-Type: application/json' -d
   '{
     "type": "access",
     "description": "Operator role for the Enterprise account's backup service to interact with this account's virtual server instance service",
     "subjects": [
       {"attributes": [
          {"name": "serviceName", "value": "is"},
          {"name": "accountId", "value": "$ENTERPRISE_ACCOUNT_ID"},
          {"name": "resourceType", "value": "backup-policy"}]
        }
      ],
     "roles":[
       {"role_id" "crn:v1:bluemix:public:iam::::role:Operator"}
      ],
     "resources":[
       {"attributes": [
          {"name": "accountId", "value": "$SUB_ACCOUNT_ID"},
          {"name": "serviceName", "operator": "stringEquals", "value": "is.volume"},
          {"name": "instanceId", "operator": "stringEquals", "value": "*"}]
       }
      ]
   }'
   

有关更多信息，请参阅 IAM 策略管理 的 API 规范。

为企业管理的备份创建跨账户授权模板

企业账户管理员可以通过编程方式 创建授权策略模板，并将其分配 给子账户，从而集中管理授权。 要创建一个授权策略模板，以便在企业下属的所有子账户中用于备份策略，请按照以下步骤操作。

1. 向 企业管理 API 发出 API 请求，以获取父企业帐户的帐户标识。

   curl -X GET `https://enterprise.cloud.ibm.com/v1/enterprises`
   -H "Authorization: Bearer <IAM_Token>"
   -H 'Content-Type: application/json'
   

2. 然后，向 IAM 策略管理 API 提出请求，为 is.backup-policy 的企业账户创建服务对服务授权，以便与分配给子账户的 is.backup, is.snapshot, is.volume, is.snapshot-consistency-group 和 is.instance 服务进行交互。

   • 授权 is.backup-policy (源) 与具有 editor 角色的 is.backup-policy (目标) 进行交互。

   curl -X POST 'https://iam.cloud.ibm.com/v1/policy_templates'
   -H 'Authorization: Bearer $TOKEN'
   -H 'Content-Type: application/json'
   -d '{
      "name": "Centralized authorization for Backup service to work with Instances",
      "description": "Grant Operator Role for the Backup service to work with Instances",
      "account_id": "ENTERPRISE_ROOT_ACCOUNT_ID",
      "policy":{
        "type": "authorization",
        "description": "Grant Operator on VPC Instances",
        "control":{
            "grant":{
              "roles":[
                {"role_id": "crn:v1:bluemix:public:iam::::role:Operator"}]
              }},
        "subject":{
            "attributes":[
                {"key": "serviceName", "operator": "stringEquals", "value": "is"},
                {"key": "resourceType", "operator": "stringEquals", "value": "backup-policy"}
              ]},
        "resource":{
            "attributes":[
                {"key": "serviceName", "operator": "stringEquals", "value": "is"},
                {"key": "instanceId", "operator": "stringExists", "value": true}
              ]}}
     }
   

   • 授权 is.backup-policy (源) 与具有 操作员 角色的 is.volume (目标) 进行交互。

   curl -X POST 'https://iam.cloud.ibm.com/v1/policy_templates'
   -H 'Authorization: Bearer $TOKEN'
   -H 'Content-Type: application/json'
   -d '{
          "name": "Centralized authorization for Backup service to work with Block Storage service",
          "description": "Grant Operator Role for the Backup service to work with Block Storage volumes",
          "account_id": "ENTERPRISE_ROOT_ACCOUNT_ID",
          "policy":{
            "type": "authorization",
            "description": "Grant Operator on Block Storage for VPC volumes",
            "control": {
                "grant": {
                  "roles": [
                    {"role_id": "crn:v1:bluemix:public:iam::::role:Operator"}]
                }},
            "subject": {
              "attributes": [
                {"key": "serviceName", "value": "is"},
                {"key": "resourceType", "value": "backup-policy"}
                ]},
            "resource": {
              "attributes": [
                 {"key": "serviceName", "operator": "stringEquals", "value": "is"},
                 {"key": "volumeId", "operator": "stringExists", "value": "true"}
                ]}}
     }'
   

   • 授权 is.backup-policy (源) 与具有 editor 角色的 is.snapshot (目标) 进行交互。

   curl -X POST 'https://iam.cloud.ibm.com/v1/policy_templates'
   -H 'Authorization: Bearer $TOKEN'
   -H 'Content-Type: application/json'
   -d '{
          "name": "Centralized authorization for Backup service to work with Block Storage snapshots",
          "description": "Grant Editor Role for the Backup service to work with Block Storage snapshots",
          "account_id": "ENTERPRISE_ROOT_ACCOUNT_ID",
          "policy": {
            "type": "authorization",
            "description": "Grant Editor on Block Storage for VPC snapshots",
            "control": {
                "grant": {
                  "roles": [
                    {"role_id": "crn:v1:bluemix:public:iam::::role:Editor"}]
                }},
            "subject": {
              "attributes": [
                {"key": "serviceName", "value": "is"},
                {"key": "resourceType", "value": "backup-policy"}
                ]},
            "resource": {
              "attributes": [
                {"key": "serviceName", "operator": "stringEquals", "value": "is"},
                {"key": "snapshotId", "operator": "stringExists", "value": "true"}
                ]}}
     }'
   

   • 授权 is.backup-policy (源) 与具有 操作员 角色的 is.instance (目标) 进行交互。

   curl -X POST 'https://iam.cloud.ibm.com/v1/policy_templates'
   -H 'Authorization: Bearer $TOKEN'
   -H 'Content-Type: application/json'
   -d '{
      "name": "Centralized authorization for Backup service to work with Instances",
      "description": "Grant Operator Role for the Backup service to work with Instances",
      "account_id": "ENTERPRISE_ROOT_ACCOUNT_ID",
      "policy":{
        "type": "authorization",
        "description": "Grant Operator on VPC Instances",
        "control":{
            "grant":{
              "roles":[
                {"role_id": "crn:v1:bluemix:public:iam::::role:Operator"}]
              }},
        "subject":{
            "attributes":[
                {"key": "serviceName", "operator": "stringEquals", "value": "is"},
                {"key": "resourceType", "operator": "stringEquals", "value": "backup-policy"}
              ]},
        "resource":{
            "attributes":[
                {"key": "serviceName", "operator": "stringEquals", "value": "is"},
                {"key": "instanceId", "operator": "stringExists", "value": true}
              ]}}
     }`
   

   • 授权 is.backup-policy (源) 与具有 editor 角色的 is.snapshotConsistencyGroup (目标) 进行交互。

   curl -X POST 'https://iam.cloud.ibm.com/v1/policy_templates'
   -H 'Authorization: Bearer $TOKEN'
   -H 'Content-Type: application/json'
   -d '{
          "name": "Centralized authorization for Backup service to work with snapshot consistency groups",
          "description": "Grant Editor Role for the Backup service to work with snapshot consistency groups",
          "account_id": "ENTERPRISE_ROOT_ACCOUNT_ID",
          "policy": {
            "type": "authorization",
            "description": "Grant Editor on snapshot consistency groups",
            "control": {
                "grant": {
                  "roles": [
                    {"role_id": "crn:v1:bluemix:public:iam::::role:Editor"}]
                }},
            "subject": {
              "attributes": [
                {"key": "serviceName", "value": "is"},
                {"key": "resourceType", "value": "backup-policy"}
                ]},
            "resource": {
              "attributes": [
                {"key": "serviceName", "operator": "stringEquals", "value": "is"},
                {"key": "snapshotConsistencyGroupId", "operator": "stringExists", "value": "true"}
                ]}}
     }`
   

   • 授权 is.backup-policy （源）与 is.share （目标）进行交互，并_共享快照操作员_角色。

   curl -X POST 'https://iam.cloud.ibm.com/v1/policy_templates'
   -H 'Authorization: Bearer $TOKEN'
   -H 'Content-Type: application/json'
   -d '{
          "name": "Centralized authorization for Backup service to work with File shares",
          "description": "Grant Editor Role for the Backup service to work with File shares",
          "account_id": "ENTERPRISE_ROOT_ACCOUNT_ID",
          "policy": {
            "type": "authorization",
            "description": "Grant Editor, and Share Snapshot Operator roles on File shares",
            "control": {
                "grant": {
                  "roles": [
                    {"role_id": "crn:v1:bluemix:public:iam::::role:Editor"},
                    {"role_id": "crn:v1:bluemix:public:iam::::role:ShareSnapshotOperator"}]}
            },
            "subject": {
              "attributes": [
                {"key": "serviceName", "value": "is"},
                {"key": "resourceType", "value": "backup-policy"}]
            },
            "resource": {
              "attributes": [
                {"key": "serviceName", "operator": "stringEquals", "value": "is"},
                {"key": "shareId", "operator": "stringExists", "value": "true"}]
            }
          }
     }'
   

3. 创建授权模板后，必须将其 提交 并 分配 给账户。

有关更多信息，请参阅 IAM 策略管理 的 API 规范。

在账户级别创建卷备份授权

使用 main.tf 文件中的 ibm_iam_authorization_policy 资源参数在服务之间创建授权策略。

请将资源属性的 operator = "stringExists" 设置为 value = "true"。 若将 "stringEquals" 替换为包含特定资源ID的值，会限制授权范围，并导致备份失败。 如需了解更多信息，请参阅 “授权范围问题的故障排除”。

resource "ibm_iam_authorization_policy" "policy1" {
  subject_attributes {
    name  = "accountId"
    value = data.ibm_iam_account_settings.iam.account_id
  }
  subject_attributes {
    name  = "serviceName"
    value = "is"
  }
  subject_attributes {
    name  = "resourceType"
    value = "backup-policy"
  }
  resource_attributes {
    name  = "accountId"
    operator = "stringEquals"
    value = data.ibm_iam_account_settings.iam.account_id
  }
  resource_attributes {
    name  = "serviceName"
    operator = "stringEquals"
    value = "is"
  }
  resource_attributes {
    name  = "volumeId"
    operator = "stringExists"
    value = "true"
  }
  roles   = ["Operator"]
}
resource "ibm_iam_authorization_policy" "policy2" {
  subject_attributes {
    name  = "accountId"
    value = data.ibm_iam_account_settings.iam.account_id
  }
  subject_attributes {
    name  = "serviceName"
    value = "is"
  }
  subject_attributes {
    name  = "resourceType"
    value = "backup-policy"
  }
  resource_attributes {
    name  = "accountId"
    operator = "stringEquals"
    value = data.ibm_iam_account_settings.iam.account_id
  }
  resource_attributes {
    name  = "serviceName"
    operator = "stringEquals"
    value = "is"
  }
  resource_attributes {
    name  = "snapshotId"
    operator = "stringExists"
    value = "true"
  }
  roles   = ["Editor"]
}
resource "ibm_iam_authorization_policy" "policy3" {
  subject_attributes {
    name  = "accountId"
    value = data.ibm_iam_account_settings.iam.account_id
  }
  subject_attributes {
    name  = "serviceName"
    value = "is"
  }
  subject_attributes {
    name  = "resourceType"
    value = "backup-policy"
  }
  resource_attributes {
    name  = "accountId"
    operator = "stringEquals"
    value = data.ibm_iam_account_settings.iam.account_id
  }
  resource_attributes {
    name  = "serviceName"
    operator = "stringEquals"
    value = "is"
  }
  resource_attributes {
    name  = "snapshotConsistencyGroupId"
    operator = "stringExists"
    value = "true"
  }
  roles   = ["Editor"]
}
resource "ibm_iam_authorization_policy" "policy4" {
  subject_attributes {
    name  = "accountId"
    value = data.ibm_iam_account_settings.iam.account_id
  }
  subject_attributes {
    name  = "serviceName"
    value = "is"
  }
  subject_attributes {
    name  = "resourceType"
    value = "backup-policy"
  }
  resource_attributes {
    name  = "accountId"
    operator = "stringEquals"
    value = data.ibm_iam_account_settings.iam.account_id
  }
  resource_attributes {
    name  = "serviceName"
    operator = "stringEquals"
    value = "is"
  }
  resource_attributes {
    name  = "instanceId"
    operator = "stringExists"
    value = "true"
  }
  roles   = ["Operator"]
}

有关自变量和属性的更多信息，请参阅 授权资源的 Terraform 文档。

为文件共享备份创建授权

使用 main.tf 文件中的 ibm_iam_authorization_policy 资源参数在服务之间创建授权策略。

resource "ibm_iam_authorization_policy" "policy1" {
   source_service_name  = "is"
   source_resource_type = "backup-policy"
   target_service_name  = "is"
   target_resource_type = "share"
   roles                = ["ShareSnapshotOperator,Editor"]
}

有关自变量和属性的更多信息，请参阅 授权资源的 Terraform 文档。