Permission Management Overview
For Tencent Cloud CloudBase resources, different teams or personnel need to be granted different access permissions, whether across enterprises or between multiple teams within the same enterprise. You can use Cloud Access Management (CAM) to configure different operation permissions for CloudBase, enabling different teams or personnel to collaborate.
User Types
CloudBase involves two types of CAM accounts: root accounts and sub-accounts. Their definitions are as follows:
| Account Type | Root Account | Sub-account and Sub-user |
|---|---|---|
| Definition | Owns all Tencent Cloud resources and can access any of them. It is not recommended to operate resources with the root account. Instead, create a sub-account, assign policies following the principle of least privilege, and use a sub-account with limited permissions to operate your cloud resources. | Created by the root account and fully owned by the root account that created the sub-user. |
Permissions
A permission describes the allowance or denial of certain operations and resource access under certain conditions.
By default, the root account is the owner of resources and has access to all resources under its name; sub-accounts have no access to any resources and must be granted permissions by the root account.
Policies
A policy is a syntax specification used to define and describe one or more permissions. Tencent Cloud policies are divided into preset policies and custom policies. To add permissions to a CAM user or group, you can directly attach a preset policy, or create a custom policy and then attach it to a CAM user or group. Each policy can contain multiple permissions, and multiple policies can be attached to a single CAM user or group.
Preset Policies
Preset policies are created and managed by CloudBase. You can directly select a preset policy to simplify permission management. Preset policies are system-provided and cannot be edited by users. For details, see Granting Permissions with TCB Preset Policies.
Custom Policies
Custom policies are permission sets created by users that describe resource management permissions in greater detail. They allow fine-grained permission division and flexibly meet differentiated permission management requirements. You can configure fine-grained permissions for different environments. For details, see Granting Permissions with Custom Policies.