tencent cloud

Billing Center

Release Notes and Announcements
Release Notes
Product Announcements
Billing Details
Billing Mode
Frozen Funds
Balance Notifications
Refunds
Billing Mode
Yearly/Monthly Subscription Products
Purchase Guide
Purchasing Cloud Services
Payment Methods
Beneficiary Account Bank Transfer
Top-up
Payment Methods for Prepaid Products
Post-paid Account Payment
Auto-payment
Transactions
Promo Vouchers
Savings Plan
Renewal Management
Bill Management
View bills
Bill Introduction
Fields in Bills
Usage Details
Billing Export Center
Bill subscription
Saving Bills to COS
Granting Billing-related CAM Access
Self-Service Invoice
Tax Management
FOCUS 1.0
FOCUS 1.0 Conformance Gaps
Cost Management
Consumption Bill Overview
Consumption Bill Description
Anomaly Detection
Fields in Consumption Bill
Cost Explorer
Budget Management
Cost Allocation Management
Cost Allocation Units
Cost Allocation Bill
Cost Allocation Tags
Cost Allocation Backtracking
API Documentation
API Category
Funds Management APIs
Order Management APIs
Resource Management APIs
Bill Management APIs
Cost Allocation Management APIs
Cost Management APIs
Making API Requests
Organization Account APIs
Data Types
Error Codes
FAQs
Bills
Promo Vouchers
Renewal
DocumentaçãoBilling CenterBill ManagementGranting Billing-related CAM Access

Granting Billing-related CAM Access

PDF
Modo Foco
Tamanho da Fonte
Última atualização: 2025-11-25 14:48:46

Overview

This document shows you how to grant a sub-account (sub-user/collaborator) read-only or read/write access to bills via the CAM console.

Directions

Creating sub-user/collaborator

For detailed directions on how to create a sub-user/collaborator, see Creating Sub-user/Creating Collaborator.

Associating preset policy

1. On the User List page, find the target sub-user/collaborator and click Authorize.

2. Select a billing-related preset policy (e.g., QcloudFinanceBillReadOnlyAccess) you want to associate and click Confirm.


For detailed directions, see Authorization Management.

Billing-related Preset Policies

Policy
Access
Description
QcloudFinanceBillReadOnlyAccess
Read-only access to bills
The sub-user/collaborator can read the bills of the root account and its sub-accounts, but are not allowed to configure bill storage, confirm bills, apply for stamps, or set cost allocation tags.
Note: If a sub-user/collaborator had been associated with the QCloudResourceFullAccess policy before July 29, 2021, you need to disassociate and associate the policy again; otherwise, all billing-related permissions will be denied.
QcloudFinanceBillFullAccess
Read/Write access to bills
The sub-user/collaborator has read/write access to the bills of the root account and its sub-accounts.
Notes:
If a sub-user/collaborator had been associated with the QCloudResourceFullAccess policy before July 29, 2021, you need to disassociate and associate the policy again; otherwise, all billing-related permissions will be denied.
To allow the sub-user/collaborator to configure bill storage, you also need to associate it with the following policies:
QcloudCOSGetServiceAccess (access to COS buckets)
QcloudCamSubaccountsAuthorizeRoleFullAccess (permission to authorize CAM service roles)
QCloudFinanceFullAccess
All billing-related access
The sub-user/collaborator can perform any billing-related operation, such as payment or invoicing, for the root account and its sub-accounts.
AdministratorAccess
Administrator access
The sub-user/collaborator can manage all users and their permissions, billing information, and resources under the root account.

Bills-Related Custom Policies

This section introduces how to configure bills-related custom policies and grant sub-accounts specific permissions. You can refer to the text and configure based on actual business needs.

Policy Syntax Guide


action: refers to the API.
resource: Indicates the resource.

View and Download Bills Custom Policies

If you have not configured preset permissions related to bills but still need to view and download bills, please first refer to the following API list to configure permissions for bill-related read-only APIs.
Feature
Action Field
Bills-Related APIs
"finance:DescribeBill*"
"finance:DescribeResourceBill*"
Bills Download-Related APIs
"finance:DescribeConsolidatedBillDownloadUrl"
"finance:DownloadCustomizedResourceSummary"
"finance:DownloadCustomizedDetail"
Usage Detail Viewing-Related APIs
"finance:DescribeDosage*"
Cost Allocation Bill Viewing-Related APIs
"finance:DescribeAllocat*"
"finance:DescribeGather*"
Consumption Bill Viewing-Related APIs
"finance:DescribeConsumption*"
API for Retrieving the Activation Time of Consumption Bills
"finance:DescribeCostWhiteUserStatus"

Bills Storage in COS Custom Policies

If you have read-only permission for bills or have configured the above relevant APIs but still need to use custom policies for storing bills in COS, refer to the following API list and configure based on actual business needs.
Feature
Action Field
Obtaining Configuration for Storing Bills in COS
"finance:UpdateBillGetUserCosInfo"
Save configuration for storing bills in COS
"finance:UpdateBillAuthUserCosInfo"
Obtain member list for storing bills in COS
"finance:DescribeBillByBillId"

Best Practices for Storing Bills in COS

Notes:
Delete comments to use this policy.
{
    "version": "2.0",
    "statement": [
        {
            "effect": "allow",
            "action": [//Permission for shipping bills to COS
                "finance:UpdateBillGetUserCosInfo",
                "finance:UpdateBillAuthUserCosInfo"
            ],
            "resource": [
                "*"
            ]
        },
        {
            "effect": "allow",
            "action": [//Permission for delivering bills involving COS
                "cos:GetService",
                "cos:GetBucket",
                "cos:ListMultipartUploads",
                "cos:GetObject",
                "cos:HeadObject",
                "cos:OptionsObject",
                "cos:ListParts",
                "cos:DeleteObject",
                "cos:PostObject",
                "cos:PutObject",
                "cos:InitiateMultipartUpload",
                "cos:UploadPart",
                "cos:UploadPartCopy",
                "cos:CompleteMultipartUpload",
                "cos:AbortMultipartUpload",
                "cos:AppendObject"
            ],
            "resource": [
                "*"
            ]
        },
        {
            "effect": "allow",
            "action": [//Relevant permissions for cam
                "cam:CreatePolicy",
                "cam:CreateRole",
                "cam:AttachRolePolicy",
                "cam:GetRole",
                "cam:ListAttachedRolePolicies",
                "cam:UpdatePolicy",
                "cam:CreateServiceLinkedRole",
                "cam:DescribeServiceLinkedRole"
            ],
            "resource": [
                "*"
            ]
        },
        {
            "action": [//Read-only permission for bills
                "finance:DescribeBill*",
                "finance:DescribeConsolidatedBillDownloadUrl",
                "finance:DownloadCustomizedResourceSummary",
                "finance:DescribeResourceBill*",
                "finance:DescribeDosage*",
                "finance:DownloadCustomizedDetail",
                "finance:DescribeAllocat*",
                "finance:DescribeGather*",
                "finance:DescribeConsumption*",
                "finance:DescribeCostWhiteUserStatus"
            ],
            "effect": "allow",
            "resource": "*"
        }
    ]
}
Anterior: Saving Bills to COSPróximo: Self-Service Invoice

Ajuda e Suporte

Esta página foi útil?

comentários