Permissions describe that, under certain conditions, certain actions are allowed for or denied from accessing specific resources.
By default, the root account is the resource owner and has access permissions to all resources under its name; sub-accounts have no access permissions to any resources; resource creators do not automatically have access permissions to the resources they create and require authorization from the resource owner.
A policy is a syntax rule that defines and describes one or more permissions. CAM supports two types of policies: preset policies and custom policies. Preset policies, created and managed by the cloud platform, are collections of common permissions, such as super administrators and cloud resource administrators. Such policies are read-only and not writable. Custom policies are created by users to provide a more specific description of resource management permissions. Preset policies cannot target specific resources and are coarse-grained, whereas custom policies offer the flexibility to meet users' differentiated permission management requirements.
Authorization is completed by binding one or more policies to a user or user group. The policy involved in the authorization can be either a preset policy or a custom policy.