Authorize sub-accounts to have read-only permission of CVM related resources

Authorize sub-accounts to have read-only permission of CVM related resources

The enterprise account CompanyExample (ownerUin: 12345678) has a sub-account Developer. This sub-account needs to have the permission to query CVM instances and related resources (VPC, Cloud Load Balancer) of the CVM service of the enterprise account CompanyExample, but does not have the permission to create, delete, or power on/off.

Scheme A:

The enterprise account CompanyExample directly authorizes the predefined policy QcloudCVMReadOnlyAccess to its sub-account Developer.

Scheme B:

Step 1: Create the following policies by policy syntax

{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "cvm:Describe*",
                "cvm:Inquiry*"
            ],
            "resource": "*",
            "effect": "allow"
        },
        {
            "action": [
                "vpc:Describe*",
                "vpc:Inquiry*",
                "vpc:Get*"
            ],
            "resource": "*",
            "effect": "allow"
        },
        {
            "action": [
                "clb:Describe*"
            ],
            "resource": "*",
            "effect": "allow"
        },
        {
            "effect": "allow",
            "action": "monitor:*",
            "resource": "*"
        }
    ]
}

Step 2: Authorize the policy to the sub-account.