tencent cloud

The resource element describes one or multiple operation objects such as CVM resources and COS buckets. This document describes the resource information in CAM.

Definition of All Resources

• If resource is *, it indicates all resources; that is, you can grant the action (operation) permission of all resources.
• If you want to authorize a Tencent Cloud service at the service level or authorize a service operation at the API level, you need to enter * for resource to grant the permission of all resources in the Tencent Cloud service or the action permission of all resources.

Definition of One or Multiple Resources

You can describe the permissions of one or multiple resources in the following six-segment format for authorization. Each service has its own resources and detailed resource definition.
The six-segment format is defined as follows:

qcs:project_id:service_type:region:account:resource

A six-segment resource description contains six fields as detailed below:

Definition of CAM Resources

CAM resources include users, user groups, and policies. A CAM resource can be described as follows:

Root account

qcs::cam::uin/164256472:uin/164256472

Or

qcs::cam::uin/164256472:root 

Sub-account

qcs::cam::uin/164256472:uin/73829520

Group

qcs::cam::uin/164256472:groupid/2340

All resources

*

Policy

qcs::cam::uin/12345678:policyid/*

Or

qcs::cam::uin/12345678:policyid/12423

Notes on Resources

• A resource owner is always a root account. The sub-account that creates a resource will not automatically have access to the resource without authorization; instead, it must be authorized by the resource owner.
• Services such as COS and CAS support cross-account authorization for resource access. Authorized accounts can pass permissions to their sub-accounts through permission propagation.

Relevant Documents

For more information on service-specific resource definitions, see the corresponding product documentation in CAM-Enabled Products.