CAM Practices

Last updated: 2023-09-20 11:04:14

Overview

Cloud Access Management (CAM) is a Tencent Cloud authentication and authorization service, which helps you manage the access to your Tencent Cloud resources. You can manage authorized objects, resources, and operations, and set policies to control access when granting permissions.

SDK

Granting access to resources under the root account

You can grant the access to the resources under your root account to other users, including sub-accounts and other root accounts, without sharing the identity credentials of your root account.

Granular permission management

Different access permissions of different resources can be granted to different users. For example, some sub-accounts can be granted the read access to a COS bucket, while some other sub-accounts or root accounts can be granted the write access to a COS object. Such resources, access permissions, and users can all be managed in batch.

Data integrity

CAM currently supports data synchronization across Tencent Cloud regions by copying policies. CAM policies can be modified timely, but it may take some time for those policies synced across regions to take effect. Additionally, CAM uses cache (currently valid for one minute) to improve performance, and any policy update does not take effect until cache expires.

Scenarios

Enterprise sub-account access permission management
Employees in different positions within an organization need to have the least privilege access to the company's cloud resources. For example, a company may have numerous cloud resources, including CVM, VPC instances, CDN instances, COS buckets, and objects. The company has various employees, such as developers, testers, and operations staff. Some developers require read/write access to the development machine cloud resources related to their projects, while testers need read/write access to the test machine cloud resources for their projects. Operations staff are responsible for purchasing machines and managing daily operations. When an employee's role or project involvement changes, the corresponding permissions will be revoked.
Cross-enterprise access permission management
There are cases where enterprises may need to share their cloud resources. For example, a company which has many cloud resources wants to focus on product R&D and outsource the operation of its cloud resources to another company. It also need to revoke all permissions that have been granted as soon as the outsourcing service contracts are terminated.

Policy Syntax

A CAM policy consists of several elements and is used to describe specific information about authorization. Core elements include principal, action, resource, condition, and effect. For more information, please see Access Policy Language Overview.
Note
There is no particular sequence in the description of policy syntax. However, please note that the action element is case-sensitive.
If there are no particular conditions required, the condition element is optional.
You cannot define the principal element in the console, but only through the policy management APIs or policy syntax parameters.

Core elements

Core elements
Description
Required
version
Specifies the version of the policy syntax. Valid value: 2.0.
Required
principal
Describes the entity to be authorized by the policy, including users (developers, sub-accounts, anonymous users), and user groups.
This element can only be used in policy management APIs and policy syntax-related parameters
statement
Describes the details on a permission or a permission set defined by other elements including effect, action, resource, and condition. One policy has only one statement.
Required
action
Describes the action to be allowed or denied. It can be an API operation or a set of API operations. This element is case-sensitive, e.g. name/cos:GetService.
Required
resource
Describes the resource to which the permission applies. A resource is described in a six-segment format. Detailed resource definitions vary by product. For more information on how to specify a resource, see the documentation for the product whose resources you are writing a statement for.
Required
condition
Describes the condition for the policy to take effect. A condition consists of operator, action key, and action value. A condition value may be time, IP address, etc. Some services allow you to specify additional values in a condition.
Not required
effect
Describes whether the statement result is "allow" or "deny".
Required

Policy limits

Limit
Limit Value
The number of user groups within a primary account
300
The number of sub-accounts within a root account
1000
The number of roles within a primary account
1000
The number of user groups a sub-account can join
10
The number of root accounts a collaborator can work with
10
The number of sub-accounts within a user group
100
Number of custom policies that can be created under a root account
1500
Number of policies that can be directly associated with a user, user group, or role
200
Maximum character count for a policy syntax
4096

Policy Example

The following policy example allows a sub-account with ID 100000000011 under the root account with ID 100000000001 (APPID 1250000000) to have upload and download permissions for the object "exampleobject" in the "examplebucket-bj" bucket in the Beijing region and the "examplebucket-gz" bucket in the Guangzhou region when accessing from the IP range 10.*.*.10/24.
{
"version": "2.0",
"principal": {
"qcs": ["qcs::cam::uin/100000000001:uin/100000000011"]
},
"statement": [{
"effect": "allow",
"action": ["name/cos:PutObject", "name/cos:GetObject"],
"resource": ["qcs::cos:ap-beijing:uid/1250000000:examplebucket-bj-1250000000/*",
"qcs::cos:ap-guangzhou:uid/1250000000:examplebucket-gz-1250000000/exampleobject"
],
"condition": {
"ip_equal": {
"qcs:ip": "10.*.*.10/24"
}
}
}]
}