CAM Practices

Overview

Cloud Access Management (CAM) is an identity authentication and authorization service provided by the cloud platform. It helps customers manage the access permissions to resources under cloud platform accounts. When permissions are granted, it manages authorized objects, resources, and operations and sets policy limits.

Features

Authorizing Permissions to Root Account Resources

You can grant the access to resources under a root account to other users, including sub-accounts and other root accounts, without sharing the identity credentials of the root account.

Refined Permission Management

Different access permissions for different resources can be granted to different users. For example, some sub-accounts can be granted the read permission to a COS bucket, and some other sub-accounts or root accounts can be granted the write permission to a COS object. Such resources, access permissions, and users can be managed in batch.

Use Cases

Enterprise Sub-Account Permission Management

Employees in different positions in an enterprise need to have minimized access permissions to the enterprise's cloud resources.

Scenario: An enterprise owns many cloud resources, including CVM, VPC instances, CDN instances, COS buckets, and objects, and has many employees, including developers, testers, and Ops engineers.
Developers and testers need the read and write permissions of project-specific cloud resources on development servers and test servers, respectively, and Ops engineers are responsible for the purchase and routine operations of such servers. If the duty or project of an employee changes, the corresponding permissions should be terminated.

Cross-Enterprise Permission Management

There are cases where enterprises may need to share their cloud resources.

Scenario: Enterprise A has many cloud resources and wants to focus on product R&D, so it outsources the Ops of its cloud resources to enterprise B, and it needs to revoke all the granted permissions as soon as the outsourcing service contract is terminated.

Policy Syntax

A CAM policy consists of several elements and is used to describe specific information on authorization. Core elements include principal, action, resource, condition, and effect.

Policy Syntax Description

• There is no particular sequence in the description of policy syntax. However, note that the elements are case-sensitive.
• If there are no particular conditions required, the condition element is optional.
• You can define the principal element only through policy management APIs or policy syntax parameters but not in the console.

Version

Specifies the version of the policy syntax. Valid value: 2.0. This element is required.

Principal

Describes the entity to be authorized by the policy, including users (developers, sub-accounts, anonymous users) and user groups. This element can be used only in policy management APIs and policy syntax parameters.

Statement

Describes the detailed information of one or more permissions. This element includes permissions or permission sets of other elements, such as action, resource, condition, and effect. A policy has one and only one statement element. This element is mandatory.

Action

Describes the action to be allowed or denied. Operations can be APIs (described with a name prefix) or feature sets (a specific set of APIs described with a permid prefix). This element is required.

Resource

Describes the specific data authorized. Resources are described in six segments. The details of resource definitions for each product may vary. For information on specifying resources, see the product documentation corresponding to the resource statement you are writing. This element is mandatory.

Condition

Describes the conditions under which the policy takes effect. Conditions consist of operators, keys, and values. Condition values can include information such as time and IP addresses. Some services allow you to specify additional values in conditions. This element is optional.

Effect

Describes whether the statement result is allow or deny. This element is mandatory.

Policy Limits