Granting Permissions with TCB Preset Policies

This document describes how to configure preset policies for CloudBase custom policies to grant specific permissions to sub-accounts.

note

Using preset policies for sub-account permission configuration helps you easily and quickly assign sub-account permissions. Preset policies cover a broad range of permissions with relatively coarse granularity.

Activating CloudBase

When using Tencent Cloud CloudBase for the first time, you need to authorize and activate CloudBase. The activation methods differ by identity:

Root account: When entering the CloudBase console for the first time, the console prompts for authorization confirmation. After confirming authorization, you can create an environment.

note

This is a one-time action. Once CloudBase is activated, you no longer need to perform this operation. (Recommended)

Sub-account: A sub-account can only use CloudBase resources after the root account grants resource access. For activation, see Using CloudBase below.

Using CloudBase

TCB Preset Policies

You can use the following preset policies to grant permissions to your sub-accounts:

Policy	Description
QcloudAccessForTCBRole	Grants CloudBase (TCB) access to cloud resources.
QcloudAccessForTCBRoleInAccessCloudBaseRun	Attached to the CloudBase (TCB) service role (TCB_QcsRole) to allow TCB to access other cloud service resources, including permissions for Virtual Private Cloud (VPC) and Cloud Virtual Machine (CVM).
QcloudCamReadOnlyAccess	Grants read-only access to user and permission (CAM). After authorization, sub-accounts can log in via the CLI tool's web authorization; without it, they can only log in using API keys.

warning

This permission includes full read/write access to underlying resources such as object storage, cloud functions, logs, monitoring, and VPC. Once this policy is attached to a sub-account, the sub-account will have full read/write access to these resources and will automatically gain full read/write access to newly added resources. Therefore, choose carefully. You can click the policy name to view its permission rules for details.

Sub-account Authorization in the Console

note

Sub-accounts have no access to CloudBase resources by default, so a sub-account logging into the CloudBase console cannot access CloudBase resources.

In this case, you need to attach a preset policy to the sub-account to grant access to CloudBase resources. The steps are as follows:

1. Log in to the CAM console, and select Users > User List from the left menu.
2. On the user list page, click Create User.
3. On the create user page, fill in the user information as prompted.
4. After filling in the information, go to the policy list and select the TCB preset authorization policy.
5. Click Complete to finish creating the sub-account.

In addition to adding policies when creating a sub-account, you can also grant permissions by attaching policies to users. For details, see the Authorization Management guide.