If you use CVM, VPC, databases and other services in the cloud platform, and these services are managed by different people but share your cloud account key, the following problems will occur:
- The risk of your key being compromised is high since multiple users are sharing it.
- The access permission of other users is not under control. They can introduce security risks caused by misoperations.
In this case, you can use sub-accounts to allow different users to manage different services to prevent the problems above. By default, a sub-account has no permission to use CVM or CVM-related resources. Therefore, we need to create policies to allow sub-accounts to use the resources or permissions they need.
Cloud access management (CAM) is a set of web services provided by Converge Cloud. It primarily helps customers securely manage access permissions to resources under the cloud platform account. With CAM, you can create, manage, and terminate users (groups), and control who can use which resources through identity and policy management.
You can use CAM to bind a user or user group to a policy that allows or denies them access to specified resources to complete specified tasks. For more basic information about CAM policies, please see Policy Syntax.
If you do not need to manage the cloud access to CVM-related resources for your sub-account, you can skip this section. Skipping these sections does not affect your understanding and use of the rest of the documentation.
Getting Started
A CAM policy must authorize the use of one or more CVM operations, or it must deny the use of one or more CVM operations.
You must also specify the resources that can be used for the operation (it can be all resources, or some operations can be partial resources). The policy can also contain the conditions set by the operation resources.
Some API operations of CVM support resource-level permissions. That is, you cannot specify a specific resource for these API operations. Instead, you must specify all the resources for the operations.