Before using roles, you need to learn some basic terms, including role, service role, custom role, and permission policy.
Role
A virtual identity with a set of permissions, used to grant access to services, operations, and resources in the Converge Cloud to role carriers. These permissions are attached to a role, not to a specific user or user group.
CAM supports the following two types of roles:
- Service (preset) roles: roles predefined by services. After service roles obtain user authorization, services can access user resources by assuming service roles.
- Custom roles: roles defined by users. Users can freely determine role carriers and role permissions.
Roles can be used by the following users: - Root accounts that can act as roles.
- Sub-users and collaborators that can act as roles.
Service Role
Service roles, a unique type of CAM preset roles, are directly provided by various product services. The associated permissions of service roles are predefined by relevant product services. After you grant a service role to a relevant product service, the service gains full authority to act on your behalf and call other product services within the scope of the role's permissions. Service roles allow you to use services more easily because you do not need to add permissions during the role granting process manually, and you only need to decide whether to grant the service the permissions associated with the role.
In the process of granting service roles to relevant product services, the relevant permissions and role carriers for service roles have been defined. Unless otherwise defined, only the service can assume the role. The predefined elements of a service role include the role name, role carrier, and permission policy.
Cloud Account Role
Cloud account roles are CAM roles customized by users. The role name, role carrier, and role permissions of a custom role are all determined by the user. Custom roles allow you to assign access permissions to your cloud resources more freely and flexibly, with the role carrier being the root account of another tenant.
The object to which you grant a role only obtains the relevant permissions when the role is used, avoiding potential security issues associated with persistent keys.
Permission Policy
Permission documentation in JSON format. In a permission policy, you can define the operations and resources that a role can use. This documentation's rules rely on the CAM policy language rules.
Trust Policy
Permission documentation in JSON format. In a trust policy, you can define the objects that can assume roles and the prerequisites for assuming roles. This documentation's rules rely on the CAM policy language rules.