Tenant Cloud TCenter Cloud Access Management Best Practice

Authorize sub-accounts to have the operation permission of CVM i

Last Updated At: 2025-11-17 15:23:49

Authorize sub-accounts to have the operation permission of CVM in a specific region

The enterprise account CompanyExample (ownerUin: 12345678) has a sub-account Developer, which needs to have the operation permissions on all machines in Luzon of the enterprise account CompanyExample.

Step 1: The enterprise account CompanyExample directly authorizes the predefined policy QcloudCVMReadOnlyAccess to the sub-account Developer.

Step 2: Create the following policies by policy syntax

{
    "version": "2.0",
    "statement": [
        {
            "action": "cvm:*",
            "resource": "qcs::cvm:CAX01::*",
            "effect": "allow"
        }
    ]
}

Step 2: Authorize the policy to the sub-account.