Scenarios
This document describes how to create a sub-user and set permissions for it, allowing it to manage resources under the root account within the granted permission scope.
Operation Guide
Creating Sub-users via Console
You can log in to the cloud console to create a sub-user and set permissions for it.
Log in to the CAM console, and in the left sidebar, choose User Management > User to enter the User page.
On the User page, click Create User. In the displayed Select User Type dialog box, select Sub-user and enter the Create Sub-user page.
On the page for entering user information, under Set User Information, enter the username (required), nickname, mobile phone number, and email address.
Note: Up to 10 users can be created at a time by clicking Add User. - Usernames of sub-users cannot be modified once they are set since they are used for login.
Under Access Type, set the sub-user's access method.
- Programmatic access: Enable SecretId and SecretKey for the sub-user to manage root account resources within its permission scope using cloud APIs, SDKs, and other development tools.
- Cloud platform management console access: Enable password, and sub-users will manage root account resources within their permission scope by logging into the cloud console.
Note: For account security, it is advised to enable login protection and operation protection.
Set Console Password, Password Reset Required, Login Protection, and Operation Protection.
Click Create to create a sub-user. After successful creation, the system will automatically enter the Set Permissions page.
In Set Permissions, you can choose:
- Adding to an existing user group: Create a user group and add the sub-user to it, or join an existing user group.
- Copying existing user permissions: Copy permissions from an existing user to the current user.
- Granting permissions based on the policy list: Select a policy and grant the corresponding policy permissions to the current sub-user.
Click Next: Complete to enter the User Permission Setting page.
On the User Permission Settings page, you can choose different methods to set permissions for the new sub-user as needed. After associating with the policy, the sub-user will obtain the permissions described in the policy.
- Adding to an existing user group: It is the best practice for managing user permissions by job function to add the sub-user to a group. In this way, you can obtain permissions. By adding the sub-user to an existing user group or creating a user group, the sub-user can be associated with the policies attached to that group.
- Copying existing user permissions: Associate a sub-user with policies by copying the permissions of an existing user. Click Copy Existing User Permissions, select the user whose permissions need to be copied, and the sub-user can be associated with the policies attached to the copied user.
- Granting permissions based on the policy list: Click Authorize from the Policy List, and select the policies to be associated.
Click Next: Complete.
On the Completion page, click Complete to complete the creation of a sub-user. A page indicates that the new sub-user has been successfully created is displayed.
On this page, you can obtain the sub-user information through the following method.
- Click Download Security Credentials to save some information to a local Excel file.
Creating Sub-users via APIs
You can use access keys to call the AddUser API to add a sub-user and set permissions for it.