1. Company A creates a role for company B (as instructed in Creating a Role).
   Select Tencent Cloud Account as the role entity and create a role (DevOpsRole for example). Then, set company B's enterprise account "67890" as its role entity and add it the permission to manipulate company A's CVM resources in the Guangzhou region.

2. Company B authorizes the sub-account of company B (as instructed in Authorizing a Sub-account with the Policy of Assuming a Role).
   Set a policy allowing company B's sub-account DevB to use the DevOpsRole role of company A (ownerUin: 12345) and grant it the permission of the sts:AssumeRole API.

3. Company B's sub-account uses the role to log in to the console.
   Log in to the console with company B's sub-account DevB and click Switch Role in the drop-down list under the profile photo.
   Enter company A's root account "12345" and the role name "DevOpsRole". After confirmation, company B can switch to the DevOpsRole role of company A (ownerUin: 12345).
   You can also switch to other roles by clicking Switch Role in the drop-down list.
   If you want to return to the original sub-account after switching the role, you can click Back to Sub-user in the drop-down list.
   

   Note

   You can only switch to a role after being authorized to use it, and the role entity must be a Tencent Cloud account. You cannot switch to unauthorized roles.

Company A takes the following steps as instructed in Creating a Role:

1. Create a role and set the role entity to company B's enterprise account CompanyExampleB.
2. Call the CreateRole API to create a role with the roleName as DevOpsRole and grant the role the permission to manipulate company A's all CVM resources in the Guangzhou region.

Company B takes the following steps as instructed in Authorizing a Sub-account with the Policy of Assuming a Role:

1. Authorize the sub-account DevB to assume the DevOpsRole role.
2. Call the AssumeRole API to apply for temporary credentials for the role DevOpsRole. Input parameters are as follows:
   

   Note

   If company B (CompanyExampleB) wants to directly manipulate the resources of company A (CompanyExampleA), they can also request temporary credentials to perform operations.

   
   

   roleArn=qcs::cam::uin/12345:roleName/DevOpsRole,
   roleSessionName=DevBAssumeTheRole,
   durationSeconds=7200
   

   
   If this API is called successfully, the response will be as follows:
   

   {
   "credentials": {
       "sessionToken": "5e776c4216ff4d31a7c74fe194a978a3ff2a42864",
       "tmpSecretId": "AKI***PCl",
       "tmpSecretKey": "Vpx***MqD"
   },
   "expiredTime": 1506433269,
   "expiration": "2018-09-26T13:41:09Z"
   }
   

3. DevB can perform operations on company A's resources within the scope of permissions during the validity period of the credentials.
   For example, if DevB wants to call the DescribeInstances API to view the CVM list, then DevB needs to replace the values of SecretId and SecretKey with the values of tmpSecretId and tmpSecretKey and set the Token in common parameters to the value of sessionToken.
   

   Note

   To stop authorizing company B, company A only needs to delete the DevOpsRole role.