tencent cloud

Cloud Access Management

Product Introduction
CAM Overview
Features
Scenarios
Basic Concepts
Use Limits
User Types
Purchase Guide
Getting Started
Creating Admin User
Creating and Authorizing Sub-account
Logging In to Console with Sub-account
User Guide
Overview
Users
Access Key
User Groups
Role
Identity Provider
Policies
Permissions Boundary
Troubleshooting
Downloading Security Analysis Report
CAM-Enabled Role
Overview
Compute
Container
Microservice
Essential Storage Service
Data Process and Analysis
Data Migration
Relational Database
Enterprise Distributed DBMS
NoSQL Database
Database SaaS Tool
Database SaaS Service
Networking
CDN and Acceleration
Network Security
Data Security
Application Security
Domains & Websites
Big Data
Middleware
Interactive Video Services
Real-Time Interaction
Media On-Demand
Media Process Services
Media Process
Cloud Real-time Rendering
Game Services
Cloud Resource Management
Management and Audit Tools
Developer Tools
Monitor and Operation
More
CAM-Enabled API
Overview
Compute
Edge Computing
Container
Distributed cloud
Microservice
Serverless
Essential Storage Service
Data Process and Analysis
Data Migration
Relational Database
Enterprise Distributed DBMS
NoSQL Database
Database SaaS Tool
Networking
CDN and Acceleration
Network Security
Endpoint Security
Data Security
Business Security
Application Security
Domains & Websites
Office Collaboration
Big Data
Voice Technology
Image Creation
Tencent Big Model
AI Platform Service
Natural Language Processing
Optical Character Recognition
Middleware
Communication
Interactive Video Services
Real-Time Interaction
Stream Services
Media On-Demand
Media Process Services
Media Process
Cloud Real-time Rendering
Game Services
Education Sevices
Medical Services
Cloud Resource Management
Management and Audit Tools
Developer Tools
Monitor and Operation
More
Use Cases
Security Practical Tutorial
Multi-Identity Personnel Permission Management
Authorizing Certain Operations by Tag
Supporting Isolated Resource Access for Employees
Enterprise Multi-Account Permissions Management
Reviewing Employee Operation Records on Tencent Cloud
Implementing Attribute-Based Access Control for Employee Resource Permissions Management
During tag-based authentication, only tag key matching is supported
Business Use Cases
TencentDB for MySQL
CLB
CMQ
COS
CVM
VPC
VOD
Others
API Documentation
History
Introduction
API Category
Making API Requests
User APIs
Policy APIs
Role APIs
Identity Provider APIs
Data Types
Error Codes
FAQs
Role
Key
Others
CAM Users and Permissions
Glossary
문서Cloud Access ManagementUser GuideRoleUsing Role

Using Role

PDF
포커스 모드
폰트 크기
마지막 업데이트 시간: 2025-09-11 17:44:21

Overview

You can use roles through the console or APIs. This document describes how to use roles with typical examples.

Prerequisites

For example:
Company A wants to outsource its OPS engineer position to company B. The person taking the position needs the access to company A's all CVM resources located in the Guangzhou region.
Company A has an enterprise account CompanyExampleA (ownerUin: 12345).
Company B has an enterprise account CompanyExampleB (ownerUin: 67890).
Company B has a sub-account DevB and wants to use DevB to do the work.

Directions

You can click the following tabs to view the corresponding directions.
Using the role in the console
Using roles through API
1. Company A creates a role for company B (as instructed in Creating a Role). Select Tencent Cloud Account as the role entity and create a role (DevOpsRole for example). Then, set company B's enterprise account "67890" as its role entity and add it the permission to manipulate company A's CVM resources in the Guangzhou region.
2. Company B authorizes the sub-account of company B (as instructed in Authorizing a Sub-account with the Policy of Assuming a Role). Set a policy allowing company B's sub-account DevB to use the DevOpsRole role of company A (ownerUin: 12345) and grant it the permission of the sts:AssumeRole API.
3. Company B's sub-account uses the role to log in to the console. Log in to the console with company B's sub-account DevB and click Switch Role in the drop-down list under the profile photo. Enter company A's root account "12345" and the role name "DevOpsRole". After confirmation, company B can switch to the DevOpsRole role of company A (ownerUin: 12345). You can also switch to other roles by clicking Switch Role in the drop-down list. If you want to return to the original sub-account after switching the role, you can click Back to Sub-user in the drop-down list.
Note:
You can only switch to a role after being authorized to use it, and the role entity must be a Tencent Cloud account. You cannot switch to unauthorized roles.

Company A takes the following steps as instructed in Creating a Role:
1. Create a role and set the role entity to company B's enterprise account CompanyExampleB.
2. Call the CreateRole API to create a role with the roleName as DevOpsRole and grant the role the permission to manipulate company A's all CVM resources in the Guangzhou region.
Company B takes the following steps as instructed in Authorizing a Sub-account with the Policy of Assuming a Role:
1. Authorize the sub-account DevB to assume the DevOpsRole role.
2. Call the AssumeRole API to apply for temporary credentials for the role DevOpsRole. Input parameters are as follows:
Note:
If company B (CompanyExampleB) wants to directly manipulate the resources of company A (CompanyExampleA), they can also request temporary credentials to perform operations.
roleArn=qcs::cam::uin/12345:roleName/DevOpsRole,
roleSessionName=DevBAssumeTheRole,
durationSeconds=7200
If this API is called successfully, the response will be as follows:
{
    "credentials": {
        "sessionToken": "5e776c4216ff4d31a7c74fe194a978a3ff2a42864",
        "tmpSecretId": "AKI***PCl",
        "tmpSecretKey": "Vpx***MqD"
    },
    "expiredTime": 1506433269,
    "expiration": "2018-09-26T13:41:09Z"
}
3. DevB can perform operations on company A's resources within the scope of permissions during the validity period of the credentials. For example, if DevB wants to call the DescribeInstances API to view the CVM list, then DevB needs to replace the values of SecretId and SecretKey with the values of tmpSecretId and tmpSecretKey and set the Token in common parameters to the value of sessionToken.
Note:
To stop authorizing company B, company A only needs to delete the DevOpsRole role.


이전 주제: Modifying Role다음 주제: Deleting a Role

도움말 및 지원

문제 해결에 도움이 되었나요?

피드백