Identity and Access Management

Identity and Access Management (IAM) is Tuya’s permission management service dedicated for OpenAPI resources to empower your cloud development. This service enables secure and precision management of access to actions and resources in cloud services.

Functional description

IAM supports user access and permission assignment. You can use these features to create IAM users that grant staff or applications access to required permissions. Example:

• Grant a maintenance technician access to specified devices and allow them to perform actions, such as checking and sending commands to these devices.
• Grant a facility manager access to actions in a space. For example, create a subspace, add a device, and create linkage scenes.

Advantages

IAM enables precision control of resources in cloud projects:

• Easy and convenient access with IAM users
• Precision permission management based on actions.
• Precision permission management based on resources.
• User permission management in bulk based on roles.

How it works

IAM allows you to access and manage IAM permissions through REST APIs. To check the scope of available API capabilities, you can make an API request to GET /v2.0/cloud/iam/policy/action and get a list of actions. You can also refer to the list of actions in this topic.

The following diagram shows how IAM works.

Concepts

The following diagram shows the relationship between the preceding concepts.

Use IAM

IAM is designed to consist of two steps: manage authorization and authenticate access.

Manage authorization

Currently, permission management is available to developers only. Therefore, a developer account must be used to design, manage, and grant permissions.

Make a token API request to get a developer token before permission management APIs are available.

To manage permissions, perform the following steps:

• Create a role based on real-life scenarios, for example, a facility manager or a maintenance technician.
• Create a policy that entails actions required by the role.
• Bind the role with the action policy and resources.
• Assign the role to the user to be authorized, so the user can have access to the specified actions and resources.

Authenticate access

To control access to user actions and resources, the system authenticates the IAM user who makes a request. In light of this rule, you must get a user token before a user can make a request. Different from the request to get a developer token, a user unique identifier specified by targetUid is required in the request to get a user token. This identifier must be the same as the value of user_id that is used to assign roles to the user. Otherwise, the user will not have any permissions.

Rules of policy authentication

When an IAM user requests access to resources, the system queries information about all permissions granted to the roles of the user, and determines all respective actions and effect settings. This way, the user permissions are authenticated. The following authentication rules are applied:

1. An IAM user requests access to certain resources.
2. The system queries all policies that are bound with the request and processes the actions of Deny type. If this type of action is found from the policy, a Deny decision is returned.
3. Otherwise, the system continues to search for actions of Allow type. If it is found, an Allow decision is returned.
4. If it is not found, the system returns a Deny decision and terminates the authentication process.

Limits

For a single cloud project, IAM has the following limits:

IAM management API

List of actions

The following table lists available actions. For other available actions not mentioned in this table, you can make an API request to GET /v2.0/cloud/iam/policy/action and get a list of all available actions. You can choose to use these actions as needed. For more information about how to make API requests to these actions, see Cloud Services API Reference.

Best practice

For more information, see IAM Practice.