Vertical products integrate with the cloud API according to specifications, and cloud APIs can be configured as either signature authentication or signature-only without authentication, depending on the requirement:
- For cloud APIs that have signature authentication enabled, the cloud API calls CAM to perform signature authentication.
- For cloud APIs set to signature-only without authentication, the cloud API passes through the request directly to the vertical product, and the vertical product may choose to call CAM itself for signature authentication.
The cloud API or vertical product extracts information such as account, API, resource, and conditions from the request, then calls the CAM API to determine whether the current logged-in account has permission to access the specified resource via the cloud API.
CAM supports general authentication, anonymous authentication, cross-account authentication, token-based authentication, tag-based authentication, and list-based authentication. The common authentication process is as follows:
List-based authentication uses tags to implement resource isolation. Vertical products directly call the CAM checkResource API to query the resource instance and tag lists that the current account has permission to access.
