Tenant Cloud TCenter Cloud Access Management Best Practice

Authorize the sub-account to have all the permissions of CVM, but not including payment permissions

Last Updated At: 2025-10-21 09:10:00

Authorize the sub-account to have all the permissions of CVM, but not including payment permissions

The enterprise account CompanyExample (ownerUin: 12345678) has a sub-account Developer. This sub-account needs to have all permissions (creation, management and other operations) for the CVM service of the enterprise account CompanyExample, excluding payment permission. It can place an order but cannot pay.

Scheme A:

The enterprise account CompanyExample directly authorizes the predefined policy QcloudCDCFullAccess to the sub-account Developer.

Scheme B:

Step 1: Create the following policies by policy syntax

 {
    "version": "2.0",
    "statement":[
         {
             "effect": "allow",
             "action": "cvm:*",
             "resource": "*"
         }
    ]
}

Step 2: Authorize the policy to the sub-account.