Managing Virtual Private Cloud (VPC) permissions
- Print
- PDF
Managing Virtual Private Cloud (VPC) permissions
- Print
- PDF
Article Summary
Share feedback
Thanks for sharing your feedback!
Available in VPC
By using Sub Account, NAVER Cloud Platform's account management service, you can set various access permissions for VPCs. Sub Account provides System Managed policies and User Created policies for setting management and administration permissions.
Note
Sub Account is a free service provided upon subscription request without additional charge. For more information about Sub Account, see Services > Management & Governance > Sub Account in NAVER Cloud Platform portal, as well as the Sub Account user guide.
System-managed policies
System-managed policies are role-based policies defined by NAVER Cloud Platform for user convenience. Once System Managed policies are granted to a sub account created in Sub Account, that sub account can use VPCs. The following is a brief description about System Managed policies of VPCs.
| Policy name | Policy description |
|---|---|
| NCP_VPC_MANAGER | Permission to use all functions within the Virtual Private Cloud (VPC) |
| NCP_INFRA_MANAGER | Permission to use all services in NAVER Cloud Platform and access My Page > Manage notifications in the portal |
User-defined policies
User-defined policies are policies that users may create. Once the user-defined policies are granted to a sub account created in Sub Account, that sub account can only use the user-assigned action combinations. The following is a brief description about use-defined policies of VPCs:
| Classification | Action name | Related action(s) | Resource type | Group by resource type | Action description |
|---|---|---|---|---|---|
| View | View/getNATGatewayDetail | View/getNATGatewayList | NATGateway | NATGateway | Views NAT Gateway details |
| View | View/getNATGatewayList | - | - | NATGateway | Views NAT Gateway list |
| View | View/getNetworkACLDenyAllowGroupDetail | View/getNetworkACLDenyAllowGroupList | NetworkACLDenyAllowGroup | NetworkACLDenyAllowGroup | Views NACL Deny-Allow group details |
| View | View/getNetworkACLDenyAllowGroupList | - | - | NetworkACLDenyAllowGroup | Views NACL Deny-Allow group list |
| View | View/getNetworkACLDetail | View/getNetworkACLList | NetworkACL | NetworkACL | Views Network ACL details |
| View | View/getNetworkACLList | - | - | NetworkACL | Views Network ACL list |
| View | View/getOnPremiseGatewayDetail | View/getOnPremiseGatewayList | OnPremiseGateway | OnPremiseGateway | Views on-premise gateway details |
| View | View/getOnPremiseGatewayList | - | - | OnPremiseGateway | Views on-premise gateway list |
| View | View/getRouteTableDetail | View/getRouteTableList | RouteTable | RouteTable | Views route table details |
| View | View/getRouteTableList | - | - | RouteTable | Views rote table list |
| View | View/getSubnetDetail | View/getSubnetList | Subnet | Subnet | Views accessible subnets for service |
| View | View/getSubnetList | - | - | Subnet | Views subnet list |
| View | View/getVPCDetail | View/getVPCList | VPC | VPC | Views accessible VPCs for service |
| View | View/getVPCList | - | - | VPC | Views VPC list |
| View | View/getVPCPeeringDetail | View/getVPCPeeringList | VPCPeering | VPCPeering | Views VPC peering details |
| View | View/getVPCPeeringList | - | - | VPCPeering | Views VPC peering list |
| View | View/getVirtualPrivateGatewayDetail | View/getVirtualPrivateGatewayList | VirtualPrivateGateway | VirtualPrivateGateway | Views virtual private gateway group details |
| View | View/getVirtualPrivateGatewayGroupDetail | View/getVirtualPrivateGatewayGroupList | VirtualPrivateGatewayGroup | VirtualPrivateGatewayGroup | View virtual private gateway group list |
| View | View/getVirtualPrivateGatewayGroupList | - | - | VirtualPrivateGatewayGroup | View virtual private gateway group list |
| View | View/getVirtualPrivateGatewayList | - | - | VirtualPrivateGateway | Views virtual private gateway list |
| View | View/getEndpointRouteTableList | - | - | EndpointRouteTable | Views Endpoint Route Table list |
| View | View/getEndpointRouteTableDetail | View/getEndpointRouteTableList | EndpointRouteTable | EndpointRouteTable | Views Endpoint Route Table details |
| View | View/getServiceFunctionChainList | - | - | ServiceFunctionChain | Views Server Function Chain list |
| View | View/getServiceFunctionChainDetail | View/getServiceFunctionChainList | ServiceFunctionChain | ServiceFunctionChain | Views Server Function Chain details |
| View | View/getTransitVpcConnectList | - | - | TransitVpcConnect | Views transit VPC connect list |
| View | View/getTransitVpcConnectDetail | View/getServiceFunctionChainList | TransitVpcConnect | TransitVpcConnect | Views transit VPC connect details |
| Change | Change/changeNetworkACLDenyAllowGroupIP | View/getNetworkACLDenyAllowGroupList View/getNetworkACLDenyAllowGroupDetail | NetworkACLDenyAllowGroup | NetworkACLDenyAllowGroup | Sets NACL Deny-Allow group's IP |
| Change | Change/createNATGateway | View/getNATGatewayList View/getVPCDetail View/getVPCList | - | NATGateway | Create NAT Gateway |
| Change | Change/createNetworkACL | View/getNetworkACLList View/getVPCDetail View/getVPCList | - | NetworkACL | Creates network ACL |
| Change | Change/createNetworkACLDenyAllowGroup | View/getNetworkACLDenyAllowGroupList View/getVPCDetail View/getVPCList | - | NetworkACLDenyAllowGroup | Creates NACL Deny-Allow group |
| Change | Change/createOnPremiseGateway | View/getVPCDetail View/getOnPremiseGatewayList View/getVPCList | - | OnPremiseGateway | Creates on-premise gateway |
| Change | Change/createRouteTable | View/getRouteTableList View/getVPCDetail View/getVPCList | - | RouteTable | Creates route table |
| Change | Change/createSubnet | View/getSubnetList View/getNetworkACLList View/getVPCDetail View/getNetworkACLDetail View/getVPCList | - | Subnet | Create subnet |
| Change | Change/createVPC | View/getVPCList | - | VPC | Create VPC |
| Change | Change/createVPCPeering | View/getVPCPeeringList View/getVPCDetail View/getVPCList | - | VPCPeering | Creates VPC peering |
| Change | Change/createVirtualPrivateGateway | View/getVirtualPrivateGatewayList View/getVPCDetail View/getVPCList | - | VirtualPrivateGateway | Creates virtual private gateway |
| Change | Change/createVirtualPrivateGatewayGroup | View/getVirtualPrivateGatewayDetail View/getVirtualPrivateGatewayGroupDetail View/getVirtualPrivateGatewayGroupList | - | VirtualPrivateGatewayGroup | Create virtual private gateway group |
| Change | Change/createVirtualPrivateGatewayGroupAssociationProposal | View/getVirtualPrivateGatewayDetail View/getVirtualPrivateGatewayList | VirtualPrivateGateway | VirtualPrivateGatewayGroup | Requests to be added to another account's virtual private gateway group |
| Change | Change/deleteNATGateway | View/getNATGatewayDetail View/getNATGatewayList | NATGateway | NATGateway | Delete NAT Gateway |
| Change | Change/deleteNetworkACL | View/getNetworkACLList View/getNetworkACLDetail | NetworkACL | NetworkACL | Delete network ACL |
| Change | Change/deleteNetworkACLDenyAllowGroup | View/getNetworkACLDenyAllowGroupList View/getNetworkACLDenyAllowGroupDetail | NetworkACLDenyAllowGroup | NetworkACLDenyAllowGroup | Delete NACL Deny-Allow group |
| Change | Change/deleteOnPremiseGateway | View/getOnPremiseGatewayDetail View/getOnPremiseGatewayList | OnPremiseGateway | OnPremiseGateway | Delete on-premise gateway |
| Change | Change/deleteRouteTable | View/getRouteTableList View/getRouteTableDetail | RouteTable | RouteTable | Delete route table |
| Change | Change/deleteSubnet | View/getSubnetList View/getSubnetDetail | Subnet | Subnet | Delete subnet |
| Change | Change/deleteVPC | View/getVPCDetail View/getVPCList | VPC | VPC | Delete VPC |
| Change | Change/deleteVPCPeering | View/getVPCPeeringDetail View/getVPCPeeringList | VPCPeering | VPCPeering | Delete VPC peering |
| Change | Change/deleteVirtualPrivateGateway | View/getVirtualPrivateGatewayDetail View/getVirtualPrivateGatewayList | VirtualPrivateGateway | VirtualPrivateGateway | Delete virtual private gateway |
| Change | Change/deleteVirtualPrivateGatewayGroup | View/getVirtualPrivateGatewayGroupDetail View/getVirtualPrivateGatewayGroupList | VirtualPrivateGatewayGroup | VirtualPrivateGatewayGroup | Delete virtual private gateway group |
| Change | Change/manageVPCPeeringRequest | View/getVPCPeeringList View/getVPCDetail Change/deleteVPCPeering | VPC | VPCPeering | Manages VPC peering request |
| Change | Change/setNATGatewayMemo | View/getNATGatewayDetail View/getNATGatewayList | NATGateway | NATGateway | Edits NAT Gateway memo |
| Change | Change/setNetworkACLDenyAllowGroupMemo | View/getNetworkACLDenyAllowGroupList View/getNetworkACLDenyAllowGroupDetail | NetworkACLDenyAllowGroup | NetworkACLDenyAllowGroup | Edits NACL Deny-Allow group memo |
| Change | Change/setNetworkACLMemo | View/getNetworkACLList View/getNetworkACLDetail | NetworkACL | NetworkACL | Edits network ACL memo |
| Change | Change/setRouteTableMemo | View/getRouteTableList View/getRouteTableDetail | RouteTable | RouteTable | Edits route table memo |
| Change | Change/setSubnetNetworkACL | View/getSubnetList View/getSubnetDetail View/getNetworkACLList View/getNetworkACLDetail | Subnet | Subnet | Changes subnet's network ACL |
| Change | Change/setVPCPeeringMemo | View/getVPCPeeringDetail View/getVPCPeeringList | VPCPeering | VPCPeering | Edits VPC peering memo |
| Change | Change/setVirtualPrivateGatewayMemo | View/getVirtualPrivateGatewayDetail View/getVirtualPrivateGatewayList | VirtualPrivateGateway | VirtualPrivateGateway | Edits virtual private gateway memo |
| Change | Change/updateNetworkACLRule | View/getNetworkACLDenyAllowGroupList View/getNetworkACLDenyAllowGroupDetail View/getNetworkACLList View/getNetworkACLDetail | NetworkACL | NetworkACL | Sets network ACL rules |
| Change | Change/updateOnPremiseGatewayRoute | View/getOnPremiseGatewayDetail View/getOnPremiseGatewayList | OnPremiseGateway | OnPremiseGateway | Sets on-premise gateway's route table rules |
| Change | Change/updateRouteTableRule | View/getRouteTableList View/getRouteTableDetail | RouteTable | RouteTable | Sets route table rules |
| Change | Change/updateRouteTableSubnet | View/getSubnetList View/getRouteTableList View/getRouteTableDetail View/getSubnetDetail | RouteTable | RouteTable | Set route table's related subnet |
| Change | Change/updateVirtualPrivateGatewayDescrtiption | View/getVirtualPrivateGatewayDetail View/getVirtualPrivateGatewayList | VirtualPrivateGateway | VirtualPrivateGateway | Edits virtual private gateway memo |
| Change | Change/updateVirtualPrivateGatewayGroup | View/getVirtualPrivateGatewayDetail View/getVirtualPrivateGatewayGroupDetail View/getVirtualPrivateGatewayGroupList | VirtualPrivateGatewayGroup | VirtualPrivateGatewayGroup | Edits virtual private gateway group settings |
| Change/createEndpointRouteTable | View/getVPCList View/getVPCDetail | - | EndpointRouteTable | Creates Endpoint Route Table | |
| Change/deleteEndpointRouteTable | View/getEndpointRouteTableList View/getEndpointRouteTableDetail | EndpointRouteTable | EndpointRouteTable | Delete Endpoint Route Table | |
| Change/updateEndpointRouteTableRule | - | EndpointRouteTable | EndpointRouteTable | Edits Endpoint Route Table's route settings | |
| Change/updateEndpointRouteTableEndpoint | - | EndpointRouteTable | EndpointRouteTable | Edits Endpoint Route Table's related endpoint settings | |
| Change/updateEndpointRouteTableDescription | View/getEndpointRouteTableList View/getEndpointRouteTableDetail | EndpointRouteTable | EndpointRouteTable | Edits Endpoint Route Table memo | |
| Change/createServiceFunctionChain | View/getVPCList View/getVPCDetail View/getServerInstanceList View/getServerInstanceDetail View/getLoadBalancerInstanceList View/getLoadBalancerInstanceDetail View/getTransitVpcConnectList View/getTransitVpcConnectDetail View/getVirtualPrivateGatewayList View/getVirtualPrivateGatewayDetail View/getNetworkInterfaceList View/getNetworkInterfaceDetail | - | ServiceFunctionChain | Creates Service Function Chain | |
| Change/deleteServiceFunctionChain | View/getServiceFunctionChainList View/getServiceFunctionChainDetail | ServiceFunctionChain | ServiceFunctionChain | Delete Service Function Chain | |
| Change/updateServiceFunctionChain | View/getVPCList View/getVPCDetail View/getServerInstanceList View/getServerInstanceDetail View/getLoadBalancerInstanceList View/getLoadBalancerInstanceDetail View/getTransitVpcConnectList View/getTransitVpcConnectDetail View/getVirtualPrivateGatewayList View/getVirtualPrivateGatewayDetail View/getNetworkInterfaceList View/getNetworkInterfaceDetail | ServiceFunctionChain | ServiceFunctionChain | Edits Service Function Chain | |
| Change/updateServiceFunctionChainDescription | View/getServiceFunctionChainList View/getServiceFunctionChainDetail | ServiceFunctionChain | ServiceFunctionChain | Edits Service Function Chain memo | |
| Change/createTransitVpcConnect | View/getVPCList View/getVPCDetail | TransitVpcConnect | Creates Transit VPC Connect | ||
| Change/deleteTransitVpcConnect | View/getTransitVpcConnectList View/getTransitVpcConnectDetail | TransitVpcConnect | TransitVpcConnect | Delete Transit VPC Connect | |
| Change/updateTransitVpcConnectDescription | View/getTransitVpcConnectList View/getTransitVpcConnectDetail | TransitVpcConnect | TransitVpcConnect | Edits Transit VPC Connect | |
| Change/updatePublicIPLink | View/getVPCList View/getVPCDetail View/getPublicIPInstanceList View/getPublicIPDetail | VPCServer:PublicIP | PublicIP | Edits public IP's transit VPC connection settings |
Caution
Even when you are granted permission for a specific action, you won't be able to perform the task properly unless you are also granted permission for the required related actions. To prevent such issues, Sub Account provides a feature that automatically grants permissions for related actions when granting action permissions. However, if you deselect related actions that are automatically granted, then the system determines that it was done intentionally by the main account user and won't forcibly include them. Use care when setting permissions.
Was this article helpful?