Identity and Access Management (IAM) is a basic permission management service provided by Huawei Cloud...

All four statements represent Huawei Cloud IAM capabilities. An agency establishes a trust relationship through which one account can delegate another account to manage specified resources according to assigned permissions. Huawei explicitly documents account delegation as an IAM function.

An IAM project corresponds to a region. Huawei defines default projects as mechanisms that group and physically isolate compute, storage, and network resources across regions. Users granted permissions in a default project can access resources covered by those permissions in the associated region. This qualification is important: IAM users do not automatically receive unrestricted access merely by existing; the project's assigned permissions determine their effective access.

A user group is explicitly defined as a collection of IAM users. Assigning permissions to groups simplifies authorization because users added to a group inherit its permissions.

Finally, Huawei's identity federation functionality allows an enterprise Identity Provider (IdP) to establish trust with Huawei Cloud so employees can use existing enterprise identities for SSO access instead of maintaining separate cloud credentials.

Reference topics: IAM Agencies; Project Management; User Groups; Identity Federation; Identity Providers.

===============