Best Practices

When creating a role, you can choose the root account as the role carrier and bind authorization policies to the role. The root account acting as the carrier can grant permissions to its CAM sub-account to assume the role by creating permission policies. Subsequently, the CAM sub-account can log in to the corresponding root account console via role switching to perform operations within the authorized scope, or initiate cross-account requests through the cloud API.

Scenarios

Scenario assumption: There are two root accounts, A and B, in an enterprise. The security administrator m has a CAM sub-user a under account A, and m wants to use this sub-account to maintain the security information under account B. In this case, we can perform the following steps:

1. Create a security Ops role (role) under account B and specify the role carrier as root account A.
2. Create a permission policy under account A, defining the operations required for security Ops, and associate the policy with the security Ops role (role).
3. The administrator of account A logs in to the platform and authorizes m to assume role in the role list of CAM.
4. Employee m logs in as CAM sub-user a.
5. Employee m chooses Switch role in the console and logs in to the console using the security role (role).
6. Perform security Ops-related operations.
7. If employee m needs to perform security Ops-related operations on multiple root accounts at the same time, the above steps can be followed to grant employee m the corresponding security Ops permissions for the respective root accounts.