Security, Management, and Operations Services
Identity and protection
IAM manages users, groups, policies, roles, and agencies. Apply least privilege: grant actions on specific resources rather than broad admin rights. DEW provides KMS keys and secrets management. WAF filters HTTP/HTTPS attacks, HSS protects hosts, Anti-DDoS mitigates volumetric attacks, and SCM manages certificates.
Operations services
CES (Cloud Eye) collects metrics and triggers alarms. CTS records API audit trails for compliance and troubleshooting. LTS collects and queries logs. SMN sends notifications. CBR provides backup and restore for ECS, EVS, and other resources. TMS organizes resources with tags.
Worked example
An application needs read-only access to one OBS bucket. Create an IAM user group, attach a custom policy allowing obs:object:GetObject and obs:bucket:ListBucket on that bucket ARN only, and add the application user to the group. Do not grant OBS administrator rights. Reasoning: the policy scopes both the action and the resource, so a compromised credential cannot read other buckets or delete objects. This demonstrates least privilege and makes the permission auditable.
Traps
Granting admin policies for convenience; confusing CTS API audit records with LTS application logs; expecting CES to store raw log text; and forgetting that IAM policies can be scoped by project and resource.