Evaluation Logic

CAM determines whether to allow or deny a cloud platform user's access to cloud resources based on the following evaluation logic.

1. By default, all requests are denied.
2. CAM checks all policies associated with the current user.
3. It checks whether there is a match with any policy. If yes, it proceeds to the next evaluation step; otherwise, it makes a final decision to deny access to cloud resources.
4. It checks whether there is a matching deny policy. If yes, it makes a final decision to deny access to cloud resources; otherwise, it proceeds to the next evaluation step.
5. It checks whether there is a matching allow policy. If yes, it makes a final decision to allow access to cloud resources; otherwise, it makes a final decision to deny access to cloud resources.
   • Root accounts are granted access to all resources under their name by default.
   • Certain general policies are associated with all CAM users by default. For details, see the general policy table below.
   • All other policies should be explicitly specified, including allow and deny policies.
   • The workload supporting cross-account resource access involves permission transmission scenarios where root account A grants permissions to root account B's sub-account to access root account A's resources. In this case, CAM verifies whether A grants B the permission and whether B grants its sub-account the permission. Under the premise that both conditions are met, the sub-account of B can access A's resources.
     The table of the currently supported general policies is as follows: