Manage permission groups
In Apsara File Storage for HDFS, a permission group is an allowlist mechanism. You can create permission groups and rules to allow specified IP addresses or CIDR blocks to access file systems and grant different access permissions to these IP addresses or CIDR blocks.
Background
By default, a default permission group is automatically created for each Alibaba Cloud account. This permission group allows any IP address to access your file systems with the highest level of access permission. You cannot modify or delete the default permission group. If the default settings do not meet your business requirements, you can create custom permission groups and rules to grant different access permissions to different IP addresses or CIDR blocks for various access scenarios.
Create permission groups and rules
For maximum data security, add permission group rules with caution and authorize only required source addresses.
Log on to the Apsara File Storage HDFS console.
In the top navigation bar, select a region.
Create a permission group.
In the left-side navigation pane, click Permissions Group.
On the Permissions Group page, click Create permissions Group.
In the Create permissions Group panel, configure the following parameters.
Parameter
Description
Name
The name of the permission group. The name must meet the following requirements:
Must be globally unique.
Must be 6 to 64 characters long.
Can contain letters, digits, underscores (_), and hyphens (-).
Network Type
Only VPC is supported.
Click Determine.
Create a permission group rule.
Find the permission group that you just created and click Management Rules in the Actions column.
On the Permission group rule list page, click Create rules and configure the following parameters.
Parameter
Description
Authorized address
The source address to authorize.
Specify a single IP address, such as 10.1.1.123, or a CIDR block, such as 192.168.3.0/24.
Access type
Specifies the access permission to grant to the source address. Valid values: read-only and read/write.
Priority
If a source address matches multiple rules, the rule with a higher priority takes precedence. You can enter an integer from 1 to 100, where 1 is the highest priority.
NoteIf multiple rules with the same priority contain overlapping CIDR blocks but grant different access permissions, the first rule created takes precedence. To avoid ambiguity, do not configure overlapping rules.
Click Determine.
More operations
On the Permissions Group page, you can perform the following operations:
Actions | Description |
View a permission group and its details | View the permission groups created in the current region and their details, including type, number of rules, and the number of associated mount targets. |
Edit a permission group | Find the target permission group and click Edit to modify its name and description. |
Delete a permission group | Find the target permission group, and then click Delete. Note You cannot delete a permission group until it is disassociated from all mount targets. To do this, either assign a different permission group to the associated mount targets or delete them. |
View the rules of a permission group | Find the target permission group and click Management Rules. |
Edit a permission group rule | For the desired permission group, click Management Rules, then find the rule to modify and click Edit to change its access type and priority. |
Delete a permission group rule | For the desired permission group, click Management Rules, then find the rule to remove and click Delete. |