If you use services such as Key Management Service (KMS), Virtual Private Cloud (VPC), Cloud Virtual Machine (CVM), and databases, which are managed by different personnel but all share your cloud account key, the following issues will arise:
Your key is shared among multiple personnel, leading to a high risk of leakage.
You cannot restrict others' access permissions, which can easily lead to accidental operations causing security risks.
Access Control (CAM) manages the access permissions to resources under your Tencent Cloud account. Through CAM, you can control which sub-accounts have operational permissions on which resources via identity management and policy management. For example, if your root account has a main key and you want only sub-account A to use it while preventing sub-account B from using it, you can control the sub-accounts' permissions by configuring a policy in CAM.
If you do not need to control the access to KMS resources by sub-accounts, you can skip this section. This will not affect your understanding and usage of other parts in the document.
Basic Concepts of CAM
The root account authorizes sub-accounts by binding policies. Policy settings can be specific to the dimensionalities of (API, Resource, User/User Group, Allow/Deny, Condition).
Account
Root Account: It is the fundamental entity for Tencent Cloud resource ownership and usage metering/billing, and can be used to log in to Tencent Cloud services.
Sub-account: It is an account created by a root account, has a specific identity ID and credentials, and can log in to the Tencent Cloud console. A root account can create multiple sub-accounts (users). By default, a sub-account does not own any resources and must be authorized by its root account.
Identity Credentials: Include log-in credentials and access certificates. Log-in credentials refer to a user's log-in name and password. Access certificates refer to cloud API keys (SecretId and SecretKey).
Resources and Permissions
Resource: An object operated within Cloud Services, such as a main key in KMS, a CVM instance, a COS bucket, a VPC instance, etc.
Permission: It is an authorization that allows or forbids users to perform certain operations. By default, a root account has full access to all resources under it, while a sub-account does not have access to any resources under its root account.
Policy: It is a syntax rule that defines and describes one or more permissions. The root account performs authorization by associating policies with users/user groups.
For more information, refer to the CAM product documentation. References
|
Understand the relationship between policies and users. | |
Understand the basic policy structure | |
Learn about which other products support CAM | |