Granting Permissions with Custom Policies

This document describes how to configure CloudBase custom policies to grant specific permissions to sub-accounts.

note

Custom policies support more flexible permission configuration and allow fine-grained permission division. You can set elements in the policy, including action, resource, and effect. For more policy syntax, see Element Reference.

Activating CloudBase

When using Tencent Cloud CloudBase for the first time, you need to authorize and activate CloudBase. The activation methods differ by identity:

Root account: When entering the CloudBase console for the first time, the console prompts for authorization confirmation. After confirming authorization, you can create an environment.

note

This is a one-time action. Once CloudBase is activated, you no longer need to perform this operation. (Recommended)

Sub-account: A sub-account can only use CloudBase resources after the root account grants resource access. For activation, see Using CloudBase below.

Configuring Environment Isolation Policies

Prerequisites

Before composing a policy, you need to obtain the basic information of the target environment and the identifiers of its associated cloud resources.

Variable	Description	How to Obtain
$\{uin\}	Root account UIN	Console > Account Information
$\{appId\}	Tencent Cloud account AppId	Console > Account Information
$\{region\}	Region where the environment is located, such as ap-shanghai or ap-guangzhou	Region returned by the DescribeEnvs API
$\{envId\}	CloudBase environment ID, such as your-env-id-001	EnvId returned by the DescribeEnvs API
$\{namespace\}	SCF cloud function namespace (usually the same as envId)	Functions returned by the DescribeEnvs API
$\{topicId\}	CLS log topic ID	LogServices returned by the DescribeEnvs API
$\{bucket\}	COS bucket name (with AppId suffix), such as tcb-xxx-123456	Storages returned by the DescribeEnvs API

Call the DescribeEnvs API to obtain the resources associated with the environment:

$\{region\}    = EnvList[0].Region                 -> "ap-shanghai"
$\{envId\}     = EnvList[0].EnvId                  -> "your-env-id-001"
$\{namespace\} = EnvList[0].Functions[0].Namespace -> "your-env-id-001"
$\{topicId\}   = EnvList[0].LogServices[0].TopicId -> "xxx-topic-id"
$\{appId\}     = EnvList[0].Storages[0].AppId      -> "1234567890"
$\{bucket\}    = EnvList[0].Storages[0].Bucket     -> "tcb-xxx-1234567890"

Policy Syntax

The following policy syntax helps the root account configure environment permissions for sub-accounts.

note

You need to replace variables such as $\{region\} with real values to grant sub-accounts access to specific environments.

{
  "version": "2.0",
  "statement": [
    {
      "effect": "allow",
      "action": [
        "cam:CreateRole",
        "cam:AttachRolePolicy",
        "cam:ListAttachedRolePolicies",
        "cam:UpdatePolicy",
        "cam:CreateServiceLinkedRole",
        "cam:DescribeServiceLinkedRole",
        "cam:GetRole",
        "tcb:CheckTcbService",
        "tcb:DescribePackages",
        "tcb:DescribeEnvLimit",
        "tcb:DescribeBillingInfo",
        "tcb:DescribeExtensionsInstalled",
        "tcb:DescribeCloudBaseRunAdvancedConfiguration",
        "tcb:DescribeCloudBaseProjectLatestVersionList",
        "tcb:DescribeExtensions",
        "tcb:DescribePostPackage",
        "tcb:DescribeICPResources",
        "tcb:DescribeExtensionUpgrade",
        "tcb:DescribeMonitorMetric",
        "tcb:DescribeLowCodeUserQuotaUsage",
        "tcb:DescribeEnvStatistics",
        "tcb:DescribeLowCodeEnvQuotaUsage",
        "tcb:CheckFeaturePermission",
        "tcb:DescribeCommonBillingResources",
        "tcb:DescribeCommonBillingPackages",
        "tcb:DescribeExtraPackages",
        "ssl:DescribeCertificateDetail",
        "ssl:DescribeCertificates"
      ],
      "resource": ["*"]
    },
    {
      "effect": "allow",
      "action": ["tcb:*"],
      "resource": ["qcs::tcb:$\{region\}:uin/$\{uin\}:env/$\{envId\}"]
    },
    {
      "effect": "allow",
      "action": ["tcbr:*"],
      "resource": ["qcs::tcbr:$\{region\}:uin/$\{uin\}:env/$\{envId\}"]
    },
    {
      "effect": "allow",
      "action": ["lowcode:*"],
      "resource": ["qcs::lowcode::uin/$\{uin\}:env/$\{envId\}"]
    },
    {
      "effect": "allow",
      "action": ["scf:*"],
      "resource": ["qcs::scf:$\{region\}:uin/$\{uin\}:namespace/$\{namespace\}/function/*"]
    },
    {
      "effect": "allow",
      "action": ["cls:*"],
      "resource": ["qcs::cls::uin/$\{uin\}:topic/$\{topicId\}"]
    },
    {
      "effect": "allow",
      "action": ["cos:*"],
      "resource": ["qcs::cos:$\{region\}:uid/$\{appId\}:$\{bucket\}/*"]
    }
  ]
}

Attaching Custom Policies to Sub-accounts

note

Sub-accounts have no access to CloudBase resources by default, so a sub-account logging into the CloudBase console cannot access CloudBase resources.

To grant specific permissions, you can attach a custom policy to the sub-account to allow access to CloudBase resources. The steps are as follows:

Step 1: Add a Custom Policy

1. Log in to the CAM console, and select Policies from the left menu.
2. On the policies page, click Create Custom Policy.
3. Choose a creation method, and click Create by Policy Syntax.
4. Choose a policy template, select Blank Template, and click Next.
5. Copy the policy from Policy Syntax into the policy content editor, and replace $\{envId\} with the real environment ID.

Step 2: Attach the Custom Policy

1. Log in to the CAM console, and select Users > User List from the left menu.
2. On the user list page, click Create User.
3. On the create user page, fill in the user information as prompted.
4. After filling in the information, go to the policy list and select the newly created custom policy.
5. Click Complete to finish creating the sub-account.

In addition to adding policies when creating a sub-account, you can also grant permissions by attaching policies to users. For details, see the Authorization Management guide.

FAQ

How do I grant tag permissions to a sub-account?

The following policy syntax helps the root account configure tag permissions for sub-accounts. After attaching this policy, sub-accounts can associate tags when purchasing resources.

{
  "statement": [
    {
      "action": [
        "tag:DescribeTagKeys",
        "tag:DescribeTagValues",
        "tag:DescribeResourceTagsByResourceIds",
        "tag:DescribeResourceTagsByTagKeys"
      ],
      "effect": "allow",
      "resource": ["*"]
    }
  ],
  "version": "2.0"
}