The content of this page has been automatically translated by AI. If you encounter any problems while reading, you can view the corresponding content in Chinese.
Help & Documentation>TDMQ for Apache Pulsar>Operation Guide>Manage Permissions For Pulsar Instance>Grant Access Permission To Sub-Account

Grant Access Permission To Sub-Account

Last updated: 2025-02-06 10:29:09

On this page:

Basic Concepts Of CAM

The root account authorizes sub-accounts by associating policies. The policy setting can be specific to the level of [API, Resource, User/User Group, Allow/Deny, and Condition].

Account System

Root account: It owns all Tencent Cloud resources and can access any of its resources.
Sub-account: It includes sub-users and collaborators.
Sub-user: It is created and fully owned by a root account that created the sub-user.
Collaborator: Originally has the identity of a root account. After being added as a collaborator of the current root account, it becomes one of the sub-accounts, able to switch back to the root account identity.
Identity credentials: Include login credentials and access certificates. Login credentials refer to user login names and passwords. Access certificates refer to TencentCloud API keys (SecretId and SecretKey).

Resource and Permission

Resources: Objects operated within cloud services, such as a CVM instance, COS bucket, or VPC instance.
Permission: It is an authorization that allows or forbids users to perform certain operations. By default, a root account has access to all its resources, while a sub-account doesn't have access to any resources under the root account.
Policy: It is a syntax rule that defines and describes one or more permissions. The root account performs authorization by associating policies with users/user groups.

Using a Sub-Account With Pulsar

To ensure sub-accounts can use Pulsar smoothly, the root account needs to authorize the sub-accounts.
The root account logs in to the CAM console, locates the target sub-account in the sub-account list, and clicks Authorize in the action column.
Pulsar provides two preset policies for sub-accounts: QcloudTDMQReadOnlyAccess and QcloudTDMQFullAccess. The former can only view related information in the console, while the latter can perform read-write operations in the product console.



In addition to the above preset policies, for convenience, the root account also needs to grant appropriate permissions for other cloud products to the sub-accounts based on actual needs. The following cloud product APIs are involved in using Pulsar:
Cloud Product
API Name
API Functions
Function In Pulsar
Tencent Cloud Observability Platform (Monitor)
GetMonitorData
query metric monitoring data
View the corresponding monitoring metrics displayed on the console
Tencent Cloud Observability Platform (Monitor)
DescribeDashboardMetricData
query metric monitoring data
view the corresponding monitoring metrics displayed on the console
Resource tags (Tags)
DescribeResourceTagsByResourceIds
Querying resource tag
Querying cluster resource tags
To add the above permissions to the sub-accounts, the root account also needs to perform the Create Custom Policy operation on the Policy page in the CAM console. After clicking Create by Policy Syntax, select Blank Template and enter the following policy syntax:
   {
     "version": "2.0",
     "statement": [
       {
         "effect": "allow",
         "action": [
           "monitor:GetMonitorData",
           "monitor:DescribeDashboardMetricData",
           "tag:DescribeResourceTagsByResourceIds"
         ],
         "resource": [
           "*"
         ]
       }
     ]
   }



After creating the policy, associate the created policy with the sub-account in the action column, as shown below:




中国站 - English