Granting Role Assumption Policy to Sub-Accounts

The root account acting as the role carrier can allow its sub-accounts to assume roles. Here, we provide an example to illustrate how to create and grant role assumption policies to sub-accounts.
Scenario assumption: Company A has an Ops engineer position and wants to outsource this position to Company B. This position requires the operation of all CVM resources in Company A's region.
You can follow the steps below:

1. Create a new policy named DevOpsPolicy under Company A's account, and associate it with APIs for Ops operations.
2. Create a role with roleName being DevOpsRole under Company A's account CompanyExampleA, set the role carrier to Company B, and associate the role with the policy DevOpsPolicy.
3. The administrator of Company B can log in to the console and authorize a sub-user user01 to assume the DevOpsRole role to access Company A. The specific operations are as follows: Under the role authorization menu, click Authorize Assuming and select the sub-user user01.
4. After logging into the console, the sub-user user01 of Company B can click the Switch Role button in the upper right corner, select the role DevOpsRole, and log into Company A's tenant by assuming the role.