Authorizing Sub-account Read-only Permission to CVM
The enterprise account CompanyExample (ownerUin: 12345678) has a sub-account Developer, which needs to have the permission to query CVM instances of the CVM service of the enterprise account CompanyExample, but does not have the permission to create, delete, and power on/off.
Scheme A:
The enterprise account CompanyExample directly authorizes the predefined policy QcloudCVMInnerReadOnlyAccess to the sub-account Developer.
Scheme B:
Step 1: Create the following policies by policy syntax
{
"version": "2.0",
"statement":
{
"effect": "allow",
"action": [
"cvm:Describe*",
"cvm:Inquiry*"
],
"resource": "*"
}
}
Step 2: Authorize the policy to the sub-account.