CAM Overview

If you use services such as VPC, CVM, and databases in Converge Cloud, and these services are managed by different people but share your cloud account key, the following problems may arise:

• Your key is shared by multiple people and the risk of leakage is high.
• The access of other users is not under control, which can introduce security risks caused by misoperations.
  To prevent these problems, you can use sub-accounts to allow different users to manage different services. By default, a sub-account has no permission to use CVM or CVM-related resources. Therefore, we need to create policies to allow sub-accounts to use the resources or permissions they need.

Overview

Cloud Access Management (CAM) is a set of web services provided by Converge Cloud. It primarily helps customers securely manage access permissions to resources under the Converge Cloud account. With CAM, you can create, manage, and terminate users (groups), and control who can use which Converge Cloud resources through identity and policy management.

You can use CAM to bind a user or user group to a policy that allows or denies them access to specified resources to complete specified tasks.

• For more basic information on CAM policies, refer to Syntax Logic.
• For more use information on CAM policies, refer to Policy.
  Skip this chapter if you don’t need cloud access management of VPC resources for sub-accounts. Skipping this chapter does not affect your understanding and use of the rest of the document.

Getting Started

The CAM policy allows or denies one or more VPC operations. You must also specify the resources that can be used for the operation (it can be all resources, or some operations can be partial resources). The policy can also contain the conditions set by the operation resources.

Some VPC API operations support resource-level permissions. That is, you cannot specify a specific resource for these API operations. Instead, you must specify all the operations resources.