Authorize Sub-account Permission to Perform Operations on CBSs

Authorize Sub-account Permission to Perform Operations on CBSs

The enterprise account CompanyExample (ownerUin: 12345678) has a sub-account Developer, which needs permissions to view CBS information in the CVM Console, create CBS, and use CBS under the CompanyExample enterprise account.

Scheme A:

The enterprise account CompanyExample directly authorizes the predefined policy QcloudCDCFullAccess to the sub-account Developer.

Step 1: Create the following policies by policy syntax

{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "cvm:CreateCbsStorages",
                "cvm:AttachCbsStorages",
                "cvm:DetachCbsStorages",
                "cvm:ModifyCbsStorageAttributes",
                "cvm:DescribeCbsStorages",
                "cvm:DescribeInstancesCbsNum",
                "cvm:RenewCbsStorage",
                "cvm:ResizeCbsStorage"
                ],
            "resource": "*",
            "effect": "allow"
        }
    ]
}

Step 2: Authorize the policy to the sub-account.

Note: If you do not allow the sub-account to modify CBS attributes, please remove "cvm:ModifyCbsStorageAttributes" from the above policy syntax.