Welcome to use Cloud Access Management (CAM)
Access Management (CAM) helps you securely and conveniently manage access to Tencent Cloud services and resources. You can use CAM to create sub-users, user groups, and roles, and control permissions through policies. CAM supports user and role SSO login. Based on specific business scenarios, you can connect it to your internal unified authentication system to implement enterprise-level centralized identity management and access control.
The initially created Tencent Cloud main account has full access to all Tencent Cloud services and resources under the account. Protect the credentials of the root account, use sub-users or roles for daily access, and enable multi-factor authentication and scheduled key rotation. For details, see the access management product document.
Users can use the following document to perform related operations on API and access management. For supported operations, see API overview (https://www.tencentcloud.com/document/product/598/33155?from_cn_redirect=1).
Note:
-The access management API interfaces in this section are the latest CAM 3.0 interfaces. New CAM features and APIs will be updated in this section. We strongly recommend that you use the latest API 3.0 version.
-Some API features are still in grayscale release, with some functions uncovered or unstable.
Common terminology of access management API interfaces: see the table below:
| Terminology | Description |
|---|---|
| Root account | When users apply for a Tencent Cloud account, a root account is created by the system to log in to Tencent Cloud services. The root account has the highest resource usage and management permissions. It can manage and possess all resources and permissions under the account, and can create sub-accounts and assign permissions to them for permission isolation. |
| Sub-account | A sub-account is an entity you create in Tencent Cloud, with a confirmed identity ID and identity credential. It is divided into sub-user, WeCom sub-user, collaborator, and message recipient. The difference between a sub-user and a collaborator is that a sub-user completely belongs to the main account, while a collaborator is a previously registered Tencent Cloud root account. That is, a collaborator can have two identities: one as the root account of its own account, and it can also switch to the collaborator of the corresponding main account. For details, see User Type. |
| Admin user | An admin user is a sub-account with AdministratorAccess authorization permission, created by the root account or an admin. It has management permissions for CAM resources and high-level permission by default. Use it only when necessary. |
| User Group | A user group is a collection of multiple users (sub-accounts) with the same function. You can create different user groups based on your business needs and associate appropriate policies with them to assign different permissions. |
| Role | A CAM role can be understood as a virtual user, different from entity users such as sub-users, collaborators, or message recipients. A role can also be granted policies. A role can be assumed by any Tencent Cloud account and is not exclusively associated with an account. A role has no associated persistent credentials (password or access key). The root account only needs to use persistent credentials when applying for a role. When a user assumes a role, the root account dynamically creates temporary credentials and provides them to the user for access. The user can use the role through the Console and API. |
| Permission | A permission describes the allowance or denial of certain actions to access specific resources under certain conditions. By default, the root account is the owner of the resources and has access to all resources under its name. Sub-accounts have no access to any resources. Creators of resources do not automatically have access permissions to the resources they create, which requires authorization from the resource owner. |
| Policy | A policy is a syntax specification for defining and describing one or more permissions. Tencent cloud policy types are divided into preset policies and custom policies |
For API parameter limits, refer to the parameter descriptions in each API document.
You can use the API Explorer tool to call APIs online.
Document base: To create a CAM sub-user, use the API Explorer Tool to make an API call as follows:
フィードバック