CAM Overview

If you use CVM, CBS, VPC, database, and other services, which are managed by different users but share your cloud account tokens, the following problems will occur:

• The risk of your key being compromised is high since multiple users are sharing it.
• The access permission of other users is not under control. They can introduce security risks caused by misoperations.
  To prevent these problems, you can use sub-accounts to allow different users to manage different services. By default, a sub-account has no permission to use CVM or CVM-related resources. Therefore, we need to create policies to allow sub-accounts to use the resources or permissions they need.

Cloud Access Management (CAM) is a set of web services mainly used to help users securely manage access permissions to resources under their cloud platform accounts. With CAM, you can create, manage, and terminate users (groups), and control who can use which resources through identity and policy management.

You can use CAM to bind a user or user group to a policy that allows or denies them access to specified resources to complete specified tasks.

If you do not need to manage the cloud access to CLB-related resources for your sub-account, you can skip this section. Skipping these sections does not affect your understanding and use of the rest of the documentation.

Getting Started

The CAM policy must authorize or deny one or more CBS-related operations. You must also specify the resources that can be used for the operation (it can be all resources, or some operations can be partial resources). The policy can also contain the conditions set by the operation resources.