tencent cloud

Cloud Access Management

문서Cloud Access ManagementUser GuidePoliciesDefinitionGlobal Preset Policies

Global Preset Policies

Download
포커스 모드
폰트 크기
마지막 업데이트 시간: 2026-08-07 16:08:05
AI 번역

Administrator Policy: AdministratorAccess

Policy description: You are allowed to manage all users and their permissions, finance-related information, and cloud service assets within your account.
Policy update: Tencent Cloud maintains and updates this policy. To view the change history of this policy, go to the CAM console, select the policy, and then choose Policy Version to view the update history.
Policy syntax:
{
    "statement": [
        {
            "action": "*",
            "effect": "allow",
            "resource": "*"
        },
    ],
    "version": "2.0"
}

Global Read Only Policy: ReadOnlyAccess

Policy description: This policy allows you read-only access to all cloud service assets within your account that support API level or resource level authorization.
Policy update: Tencent Cloud maintains and updates this policy. To view the change history of this policy, go to the CAM console, select the policy, and then choose Policy Version to view the update history.
Policy syntax:
{
    "statement": [
        {
            "action": "*",
            "condition": {
                "numeric_equal": {
                    "qcs:read_only_action": 1
                }
            },
            "effect": "allow",
            "resource": "*"
        },
    ],
    "version": "2.0"
}
Note:
Condition key qcs:read_only_action:1 (API attribute defined as "read", primarily includes those starting with:
APIs whose names start with "Check", "List", "Describe", "Search", "Get", "BatchGet", "Query", "BatchQuery", "Download", "Export", "View", "Inquiry", "Inquire", "Compare", "Verify", or "Validate")
Condition operator: numeric_equal (meaning numeric equal)

Global Resource Management Policy: QCloudResourceFullAccess

Policy description: This policy allows you to manage all cloud service resources within your account (excluding all finance permissions), as well as some CAM APIs, such as permissions for managing special resources like sub-user attributes, sub-user keys, and user groups. This policy was upgraded to a new version on 2021-07-29. Sub-accounts authorized before 2021-07-29 00:00:00 still follow the "Version 1" policy syntax, which denies access to CAM and finance permissions. To authorize using the new "Version 2" syntax, you must unbind the policy and then re-associate it.
Policy update: Tencent Cloud maintains and updates this policy. To view the change history of this policy, go to the CAM console, select the policy, and then choose Policy Version to view the update history.
Policy syntax:
{
    "statement": [
        {
            "action": "*",
            "condition": {
                "numeric_equal": {
                    "qcs:except_cam_finance": 1
                }
            },
            "effect": "allow",
            "resource": "*"
        },
    ],
    "version": "2.0"
}
Note:
Condition key: qcs:except_cam_finance:1 (excluded finance permissions and some CAM API permissions)
Condition operator: numeric_equal (meaning numeric equal)
The CAM APIs permitted by this policy are as follows:
API Name
API Description
AddSubAccount
Adds a sub-user.
AddUserToGroup
Adds a user to a user group.
CreateCollApiKey
Creates a key for a sub-user.
CreateGroup
Creates a user group.
CreateProjectKey
Creates a project key.
CreateRole
This API (CreateRole) is used to create a role.
CreateRoleByConsole
This API (CreateRoleByConsole) is used to create a role via the console.
CreateSAMLProvider
Creates a SAML identity provider.
CreateSubUserInviteQRCode
Creates an invitation QR code for a sub-account.
DeleteCollApiKey
Deletes a key for a sub-user.
DeleteGroup
Delete a user group.
DeleteProjectKey
Deletes a project key.
DeleteSAMLProvider
Deletes a SAML identity provider.
DeleteSubAccount
Deletes a sub-account.
DescribeMFADeviceColl
Queries MFA devices.
DescribeSafeAuthFlagColl
Queries security settings.
DisableCollApiKey
Disables a key for a sub-user.
DisableProjectKey
Disables a project key.
EnableCollApiKey
Enables a key for a sub-user.
EnableProjectKey
Enables a project key.
GetGroup
Queries user group details.
GetSAMLProvider
Gets the SSO identity provider for a role.
ListGroups
Queries a list of user groups.
ListGroupsForConsole
Queries a list of user groups in the console.
ListGroupsForUser
Lists the user groups associated with a user.
ListIdentityProvider
Queries a list of identity providers.
ListMaskedSubAccounts
Queries a list of sub-accounts (with sensitive information masked).
ListReceiver
Gets a list of message recipients.
ListSAMLProviders
Queries a list of SAML identity providers.
ListSubAccounts
Queries a list of sub-accounts.
ListUsersForGroup
Queries a list of users associated with a user group.
ModifyMessageReceiver
Modifies a message recipient.
QueryCollApiKey
Queries a key for a sub-user.
QueryKeyBySecretId
Queries a personal API key based on the SecretId.
RemoveUserFromGroup
Removes a user from a user group.
SetSafeAuthFlag
Configures the login protection and sensitive operation verification methods for a user.
SetSafeAuthFlagIntl
Configures the login protection and sensitive operation verification methods for a user (International).
UnbindStoken
Unbinds a soft Token.
UnbindSubAccountStoken
Unbinds an SToken card.
UnbindSubAccountToken
Unbinds a Token card.
UnbindToken
Unbinds a Token card.
UpdateGroup
Updates a user group.
UpdateSAMLProvider
Updates SAML identity provider information.
UpdateSubAccount
Modifies a sub-account.
UpdateSubAccountAttr
Updates sub-account attributes.
ListAttachedRolePolicies
Gets the list of policies bound to a role.
GetRole
Gets role details.

Global Financial Management Policy: QCloudFinanceFullAccess

Policy description: This policy allows you to manage finance-related content within your account, such as payments and invoicing.
Policy update: Tencent Cloud maintains and updates this policy. To view the change history of this policy, go to the CAM console, select the policy, and then choose Policy Version to view the update history.
Policy syntax:
{
    "statement": [
        {
            "action": "cooperator:MANAGE_FINANCE",
            "effect": "allow",
            "resource": "*"
        },
        {
            "action": "finance:*",
            "effect": "allow",
            "resource": "*"
        },
    ],
    "version": "2.0"
}
Note:
cooperator:MANAGE_FINANCE: the name of the Tencent Cloud finance-related API collection.
이전 주제: Policy다음 주제: Creating Custom Policy

도움말 및 지원

문제 해결에 도움이 되었나요?

피드백