The Dashboard in the CAM Console contains five modules: CAM Resources, Login URL, Sensitive Operations, Last Login Info, and the Security Guide. This documents describes each module in detail.
QcloudCamSummaryAccesspolicy can view the information of all modules when they log in to the console as shown below:
QcloudCamSummaryAccesspolicy will only see the Login URL and Last Login Info modules as shown below:
QcloudCamSummaryAccesspolicy as needed to allow them to view the Dashboard information in the console.
The CAM resources module displays the numbers of users, user groups, custom policies, roles, and identity providers created under the current root account. You can create more resources by clicking the button below each resource quantity.
The login URL module displays the login URL for the sub-user. Both the root account and the sub-account can copy the URL by clicking Copy icon to the right of the URL.
The sensitive operations module displays the overview information of all sensitive operations under the current root account in the last 3 days (up to 50 entries). The displayed information includes account ID, operator ID, sensitive operation details, and operation time. You can also click View All Records to enter the Cloud Audit Console to view more detailed sensitive operation records.
For the security of your accounts and assets in Tencent Cloud, you are strongly recommended to complete all the configurations in the security guide.
The security guide module provides basic CAM feature descriptions and necessary security operation guidance, such as binding MFA devices to root accounts, enabling account protection for root accounts, creating sub-accounts, and creating groups and adding sub-accounts.
- Operation permission: the Bind MFA Device to Root Account and Enable Account Protection for Root Account features can only be done by the root account, while the other five features can be completed by all authorized users.
- Feature status: each feature has two states: Not Completed and Completed. The root account user can view the status of each feature. Sub-accounts cannot view feature statuses.
- Feature links: sub-accounts with permissions can view feature descriptions and links by clicking the triangle icon to the left of each guide item. The following figure shows the security guide module the root account sees.
Multi-factor authentication (MFA) is an additional layer of security protection provided by Tencent Cloud besides authentication with username and password. Currently, two types of MFA devices are supported: hardware MFA devices and virtual MFA devices.
The root account user can click Bind MFA Device below the detailed description to enter Security Settings. For detailed directions, please see:
Account protection includes login protection and operation protection. After login protection is enabled, you need to verify your identity through MFA when logging in to the Tencent Cloud Console. After operation protection is enabled, you need to verify your identity through MFA when performing sensitive operations.
The root account user can click Enable Account Protection below the detailed description to enter Security Settings. For detailed directions, please see:
Types of sub-account include sub-users, collaborators, and message recipients. You can create sub-accounts with different responsibilities to assist you according to your business needs.
An authorized user can click Create User below the detailed description to create a user. For detailed directions, please see:
Creating, assigning permissions to, and adding users to user groups can help simplify permission management and review for sub-accounts.
An authorized user can click Create Group below the detailed description to create a user group. For detailed directions, please see:
CAM supports two types of policies: preset policies and custom policies.
Assigning permissions to user groups or users simplifies the process of managing and reviewing the permissions of CAM users in your account.
An authorized user can click Create Custom Policy below the detailed description to the Policies page. For detailed directions, please see:
An authorized user can select a sub-account in the user list and enable login protection and operation protection on the Security tab in the user’s details page. MFA will then be required when the user logs in or performs sensitive operations. Currently, MFA modes supported for sub-accounts include virtual MFA device verification, hardware MFA device verification, and mobile verification code.
An authorized user can click Enable Account Protection for Sub-Account below the detailed description to enter the User List page. For detailed directions, please see:
An authorized user can select a sub-user or collaborator in the user list and enable MFA device protection on the Security tab in the user’s details page. The user will need to bind the MFA device upon next login.
An authorized user can click Bind MFA Device to Sub-Account below the detailed description to enter the User List page. For detailed directions, please see:
For more information on the limits of the number of sub-accounts, user groups, and policies allowed, please see Limits.