Authorizing a Sub Account to Perform Operations on EIP Addresses

Authorizing a Sub Account to Perform Operations on EIP Addresses

The enterprise account CompanyExample (ownerUin: 12345678) has a sub account Developer, which needs to have the permissions to view and use the EIP addresses in the CVM console for the CVM service of the enterprise account CompanyExample.

Step 1: Create the following policy by policy syntax.

{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "cvm:AllocateAddresses",
                "cvm:AssociateAddress",
                "cvm:DescribeAddresses",
                "cvm:DisassociateAddress",
                "cvm:ModifyAddressAttribute",
                "cvm:ReleaseAddresses"
            ],
            "resource": "*",
            "effect": "allow"
        }
    ]
}

Step 2: Grant the policy to the sub account.

The following policy allows the sub account to view EIP addresses and assign them to instances and associate them with each other. The sub account can modify the attributes of EIP addresses, cancel their association, or release them.

Step 1: Create the following policy by policy syntax.

{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "cvm:DescribeAddresses",
                "cvm:AllocateAddresses",
                "cvm:AssociateAddress"
            ],
            "resource": "*",
            "effect": "allow"
        }
    ]
}

Step 2: Grant the policy to the sub account. /130622231683297280/130622242107191296).