Overview

Cloud Access Management (CAM) is used to manage the access permissions for resources under Converge Cloud accounts. Through CAM, you can control which sub-accounts have access to which resources using identity management and policy management.

For example, multiple VPC DNS resources are under your account and deployed in different projects. In that case, you can bind an authorization policy to the administrator of project A to strengthen permission control and authorize resources. This policy specifies that only this administrator can manage the VPC DNS resources under project A.

If you do not need to manage CAM related to VPCDNS resources for sub-accounts, you can skip this section. Skipping these parts will not affect your understanding and use of the rest of the document.

Basic Concepts of CAM

The root account authorizes sub-accounts by binding policies. The policy settings can be precise to the API, Resource, User/User Group, Allow/Deny, and Condition dimensionality.

1. Account

• Root Account
  The fundamental entity for cloud resource ownership and pay-as-you-go resource usage. It is capable of logging in to Converge Cloud services.
• Sub-account
  Created by the root account, with a specific identity ID and credential, and able to log in to the Converge Cloud console. A root account can create multiple sub-accounts (users). A sub-account, by default, does not own resources and must be authorized by its associated root account.
• Identity Credential
  Includes logging in credentials and access certificates. Logging in Credentials refers to a user's login name and password. Access Certificates refer to Cloud API keys (SecretId and SecretKey).

2. Resource and Permission

• Resource
  An object operated within cloud services, such as a cloud server instance, COS bucket, and VPC instance.
• Permission
  Refers to allowing or denying certain users' execution of certain actions. By default, the root account has access permissions to all resources under its name, while sub-accounts do not have access to any resources under the root account.
• Policy
  A syntax rule that defines and describes one or more permissions. The root account performs authorization by associating policies with users/user groups.

For more information, see the CAM Overview.

Documentation