Fine-Grained Fee Visibility in AstraFlow: Using IAM Custom Policies

Scenarios

Internal collaboration : A central account purchases large‑model resources and allocates usage rights to development, product and operations teams. These teams need to view model call statistics, monitor token consumption and manage their own API keys. Fee‑related data such as settlement prices, commercial discounts, project cost summaries and historical bills are required only by administrators or finance staff.

Channel partners serving end customers : Partners embed AstraFlow capabilities into their products, create independent sub‑accounts for each downstream customer, and allow customers to see usage and call volume while hiding pricing and billing information.

Why system policies cannot isolate fees

UCloud IAM provides two policy types: system policies (role‑based bundles such as "AstraFlow read‑only") and custom policies (allow/deny at the individual API level). System policies bind "view usage" and "view fees" together, so granting a read‑only role also exposes billing data. To separate them, a custom policy is required.

Core solution: one Deny policy blocking 20 billing APIs

The custom policy uses Effect: Deny to prohibit a sub‑user from calling any of the following 20 billing‑related APIs, grouped into three categories:

Order APIs (9) : ListPaidOrders, ListUnpaidOrders, ListPaidOrderSummary, ListUnpaidOrderSummary, GetOrderAmount, CompleteUnpaidOrder, DownloadListPaidOrders, DownloadListUnpaidOrders, DownloadOrderSummary

Bill APIs (7) : ListPaidBills, ListUnpaidBills, ListTxPaidBills, DownloadBillSummary, DownloadListBills, DownloadListPaidBills, DownloadListUnpaidBills

Amount‑summary APIs (4) : GetMonthlyAmount, GetMonthlyPaidBill, GetCurrentMonthlyUnpaidBill, GetUserBillingByKey (plus GetFilterOptions to hide fee filters)

{
  "Version": "1",
  "Statement": [{
    "Effect": "Deny",
    "Action": [
      "uai_modelverse:CompleteUnpaidOrder",
      "uai_modelverse:DownloadBillSummary",
      "uai_modelverse:DownloadListBills",
      "uai_modelverse:DownloadListPaidBills",
      "uai_modelverse:DownloadListPaidOrders",
      "uai_modelverse:DownloadListUnpaidBills",
      "uai_modelverse:DownloadListUnpaidOrders",
      "uai_modelverse:DownloadOrderSummary",
      "uai_modelverse:GetCurrentMonthlyUnpaidBill",
      "uai_modelverse:GetFilterOptions",
      "uai_modelverse:GetMonthlyAmount",
      "uai_modelverse:GetMonthlyPaidBill",
      "uai_modelverse:GetOrderAmount",
      "uai_modelverse:GetUserBillingByKey",
      "uai_modelverse:ListPaidBills",
      "uai_modelverse:ListPaidOrderSummary",
      "uai_modelverse:ListPaidOrders",
      "uai_modelverse:ListUnpaidBills",
      "uai_modelverse:ListUnpaidOrderSummary",
      "uai_modelverse:ListUnpaidOrders",
      "uai_modelverse:ListTxPaidBills"
    ],
    "Resource": ["*"]
  }]
}

Configuration steps

Step 1: Create the policy

In the UCloud console go to Access Control → Policy Management → Create Custom Policy . Provide a name such as Deny-AstraFlow-Billing-API-Internal and a description like "Prohibit sub‑users from viewing any billing, order, or cost information". Switch to the script editor tab and paste the JSON above.

Step 2: Bind the policy to sub‑users

Open the target sub‑user’s detail page, choose Personal Permissions → Add Permission , search for the newly created policy, add it, and set the scope to "All Projects".

Step 3: Verify the effect

Log in with the restricted sub‑account and access the cost center. Expected results: fee‑related pages show no data or an "access denied" message, while the user can still browse models, manage API keys, and view token consumption.

Effect overview

Browse/Call models – allowed before and after

Manage API key – allowed before and after

View token consumption – allowed before and after

View billing details – blocked after

View order amount – blocked after

View original/discounted price – blocked after

Download bills/orders – blocked after

View monthly cost summary – blocked after

Organizational approaches

Internal teams : Developers, product staff bind the policy to their sub‑accounts; finance and management do not bind. Suggested name: Deny-AstraFlow-Billing-API-DevTeam.

Channel partners : Each downstream customer’s sub‑account binds the policy; the partner’s own operations account does not bind. Suggested name: Deny-AstraFlow-Billing-API-ClientA.

Advanced tip: when the number of sub‑users grows, create a user group (e.g., "Channel-Customer-Group") and attach the policy to the group. New sub‑accounts added to the group inherit the fee‑hiding policy automatically.

This guide is based on the current version of UCloud AstraFlow and its IAM system; refer to official documentation for updates.