Why does a new policy version appear in the preset policy?
Preset policies are created and managed by Tencent Cloud, encompassing a collection of commonly used permissions that are frequently accessed by users.
Preset policies are closely related to the functionality of cloud services. If a cloud service undergoes an upgrade or adjustment, Tencent Cloud may correspondingly upgrade or adjust the preset policies. In such cases, a new policy version is added to ensure coverage of the new functional permissions. The preset policies that may be adjusted include general preset policies and those associated with service roles.
How do I grant a sub-account specific operation permissions of specific products?
You can create a custom policy using the Policy Generator, selecting the products and operations you require, and then associate it with the user through Policy Association. Once the association is successful, your sub-account will manage the resources under the main account within the scope of the permissions you have set.
Why do I get a prompt saying that "The account is not on the allowlist" when creating a policy?
Currently, several products are in the beta phase, and some of them do not yet support CAM management. You can check the Products Supported by CAM to determine whether and to what extent you can manage product service permissions in CAM.
Why can’t a sub-account access certain Tencent Cloud products after it has been authorized with the read-only policy (ReadOnlyAccess)?
The cloud product read-only policy (ReadOnlyAccess) only includes read interfaces for cloud products authorized at the operation level or resource level. If you access service-level cloud products or write interfaces for operation-level/resource-level cloud products, you will receive a no permission prompt. For the authorization granularity of cloud products, please refer to Products Supported by CAM.
Please check whether the sub-account's custom policies (user permission policies, permission policies of the user group joined) have set
"effect": "deny" for the read-only policy (ReadOnlyAccess). For details, please refer to Scenarios where the "deny" permission policy does not take effect.What permissions does a sub-account have?
The permissions of a sub-account depend on the policies you bind to it. For more details, refer to the Permissions and Policies documentation.
What permissions are required for a sub-account to purchase cloud products?
To purchase pay-as-you-go cloud products, it is generally sufficient to assign the sub-account the permission to create instances or resources for that cloud product.
To purchase annual or monthly cloud products, you need to grant the sub-account additional permissions to pay for orders. This can be done by associating it with the
QCloudResourceFullAccess policy (a preset policy that allows you to manage all cloud service assets within the account), or by associating it with the QCloudFinanceFullAccess policy (a preset policy that allows you to manage finance-related content within the account, such as payments and invoicing) and the permissions to create instances or resources for each cloud product.When purchasing certain cloud products, it may be necessary to use or create various other resources. In such cases, the sub-account needs to have the appropriate read or create permissions for these resources.
How do I set payment permissions for a sub-account?
1. Log in to the Cloud Access Management Console with the main account, navigate to Users > User List , select the corresponding sub-account, and click Authorize in the operation column.
2. In the pop-up policy association window, select QCloudResourceFullAccess (a preset policy that allows you to manage all cloud service assets within the account) and click OK to complete the payment authorization for the sub-account.
How do I set permissions for a sub-account to view bills?
Sub-accounts do not have standalone permissions to view bills. If needed, you can assign the
QCloudFinanceFullAccess policy to the user (this policy allows you to manage financial-related content within the account, such as payments and invoicing). For more details, please refer to Authorization Management.Is it possible to create an account that can only use the ticketing function?
Indeed, you can create a sub-account without granting any permissions.
Note
The tickets submitted by a sub-account are not visible to the main account; they can only be viewed by logging into that specific sub-account.
Is it possible to set read-only permissions for all products?
Yes, you can do so by granting the ReadOnlyAccess policy.
How should I grant permissions to allow a sub-account to only view part of my resources?
The following example illustrates how to grant a sub-account permission to view a limited list of resources. For more details:
The enterprise account
CompanyExample (ownerUin: 12345678) has a sub-account Developer. CompanyExample wants to allow the sub-account to view only part of its resources in the console.For example, to allow the sub-account to view in the Console two CVM instances whose ID is
ins-xxx1 and ins-xxx2 in the gz region:1. Create the following policy by using policy syntax:
{"version": "2.0","statement": [{"action": ["cvm:DescribeInstances"],"resource": ["qcs::cvm:gz::instance/ins-xxx1","qcs::cvm:gz::instance/ins-xxx2"],"effect": "allow"}]}
You can also set higher permissions as needed, such as full read/write permissions. If you need full read/write permissions for all cloud server instances in the Guangzhou region, you can write the policy syntax as follows:
{"version": "2.0","statement": [{"action": ["cvm:*"],"resource": "qcs::cvm:gz::*","effect": "allow"}]}
2. Authorize this policy for the sub-account. For the method of authorization, please refer to Authorization Management.
Currently, the products that support read-only operation for resource granularity permission control include: Cloud Virtual Machine (CVM), TencentDB for MySQL, and Tencent Kubernetes Engine (TKE).
For other products, it is not currently possible to authorize read-only permissions for specific resources. You can only grant the sub-account permission to view all resources, or not view any resources at all.
Why does the "deny" authorization statement in the permission policy not take effect?
When a permission policy contains both "allow" and "deny" authorization statements, it is necessary to determine whether "deny" is effective based on the specific scenario. For details, please refer to Scenarios where permission policy deny is ineffective.
How can I restrict the access permissions of the APPID service?
Currently, in the policies of Access Management, only the resource owners of Object Storage COS and Archive Storage CAS services can be described using the UID method (i.e., APPID), while the resource owners of other services can only be described using the UIN method. For specific usage, please refer to Resource Description Method.
For COS authorization, please refer to Granting a Sub-account All Permissions to a Specific Directory.
Is IP access restriction supported?
Indeed, you can restrict the sub-account's access IP through a custom policy. For specific operations, please refer to IP Access Restrictions.
What should I do if I cannot find the permissions for a specific service?
Possible Cause | Solution |
The service requiring permission settings has not been integrated with CAM. | |
The service or permission name searched is incorrect. | Based on the product name in Business Interfaces Supported by CAM, search for the corresponding policy permissions on the Cloud Access Management Console > Policies page. |