Overview

If you use CLB, CVM, database and other services that are managed by different people with your cloud account key, the following issues may occur:

• The risk of your key being compromised is high since multiple users are sharing it.
• The access permission of other users is not under control. They can introduce security risks caused by misoperations.
  CAM (CAM) is used to manage resource access permissions under cloud accounts. With CAM, you can control the operational permissions of sub-accounts through identity management and policy management.

For example, your account has multiple CLB instances deployed in different projects. To strengthen permission control and authorize resources, you can bind an authorization policy to the administrator of project A. The policy stipulates that only the administrator can operate the CLB resources under project A.

If you do not need to manage the access to CLB-related resources for your sub-accounts, you can skip this section. Skipping these sections does not affect your understanding and use of the rest of the documentation.

Basic Concepts of CAM

The root account authorizes sub-accounts by binding policies. The policy settings can be precise to the API, Resource, User/User Group, Allow/Deny, and Condition dimensionality.

1. Account
   • Root account: The basic entity for cloud resource ownership, resource usage metering and billing. You can log in to the Converge Cloud service.
   • Sub-account: An account created by the root account, has a certain identity ID and identity credentials, and can log in to the Converge Cloud console. The root account can create multiple sub-accounts (users). Sub-accounts do not own resources by default and must be authorized by their root account.
   • Identity Credentials
     Including log-in credentials and access certificates. Log-in Credentials refer to a user's log-in name and password. Access Certificates refer to Cloud API keys (SecretId and SecretKey).
2. Resource and Permission
   • Resource: It is an object that is operated in cloud services, such as a CVM instance, a COS bucket, or a VPC instance.
   • Permission: It is an authorization that allows or forbids users to perform certain operations. By default, a root account has full access to all resources under it, while a sub-account does not have access to any resources under its root account.
   • Policy: It is a syntax rule that defines and describes one or more permissions. The root account performs authorization by associating policies with users/user groups.

For more information, see the CAM Overview.

Documentation