This document describes two authorization methods to resolves the following issues. Details steps are as below. To configure more complex permission policies, see Custom Policy.
Log in to the CAM console using the root account, go to User List, click Authorize on the left of the sub-user, and the Associate Policy dialog box will pop up.
Search by IM, select the desired policies, and click Confirm to complete the authorization.
- Read/write access: allows users to access the console and modify configurations.
- Read-only access: allows users to access the console only, not to perform other operations.
If Policy associated is prompted in the upper right corner, the authorization is completed.
This solution is designed for customers who need to authorize and manage sub-accounts by tag. Sub-accounts can only access and operate applications under the authorized tags.
- After a tag policy is assigned to a sub-account, the sub-account cannot access or operate applications with no tags. For a sub-account, there are no tags in a newly created application in the IM console. Therefore, the root account needs to change the application tags to authorized tags so that the sub-account can use the application.
- If you want to grant a sub-account the access to an existing app by tag, make sure you have configured tags for the app; otherwise, you will be unable to authorize by tag.
- If no tags are configured for the app, go to the Basic Configuration page in the IM console to configure. For more information, see the Tag Configuration section in Basic Configuration.
Log in to the CAM console using the root account, click Policies > Create Custom Policy, and the Select Policy Creation Method dialog box will pop up.
Select Authorize by Tag to go to Tag Policy Generator.
Enter the sub-account to authorize, tag, and other information in Tag Policy Generator and click Next to go to the next step.
If there are no tags to select from, you need to log in to the Tag console to create a tag.
After confirming the information is correct, click Done to complete the authorization.