Using a Role

Last updated: 2021-09-16 14:44:19

    Overview

    You can use roles through the console or APIs. This document describes how to use roles with typical examples.

    Prerequisites

    For example:

    • Company A wants to outsource its OPS engineer position to company B. The person taking the position needs the access to company A's all CVM resources located in the Guangzhou region.
    • Company A has an enterprise account CompanyExampleA (ownerUin: 12345).
    • Company B has an enterprise account CompanyExampleB (ownerUin: 67890).
    • Company B has a sub-account DevB and wants to use DevB to do the work.

    Directions

    You can click the following tabs to view the corresponding directions.

    1. Company A creates a role for company B (as instructed in Creating a Role).
      Select Tencent Cloud Account as the role entity and create a role (DevOpsRole for example). Then, set company B's enterprise account "67890" as its role entity and add it the permission to manipulate company A's CVM resources in the Guangzhou region.

    2. Company B authorizes the sub-account of company B (as instructed in Authorizing a Sub-account with the Policy of Assuming a Role).
      Set a policy allowing company B's sub-account DevB to use the DevOpsRole role of company A (ownerUin: 12345) and grant it the permission of the sts:AssumeRole API.

    3. Company B's sub-account uses the role to log in to the console.
      Log in to the console with company B's sub-account DevB and click Switch Role in the drop-down list under the profile photo.
      Enter company A's root account "12345" and the role name "DevOpsRole". After confirmation, company B can switch to the DevOpsRole role of company A (ownerUin: 12345).
      You can also switch to other roles by clicking Switch Role in the drop-down list.
      If you want to return to the original sub-account after switching the role, you can click Back to Sub-user in the drop-down list.

      Note

      You can only switch to a role after being authorized to use it, and the role entity must be a Tencent Cloud account. You cannot switch to unauthorized roles.