Permissions boundary is an advanced feature used by Tencent Cloud to set a permissions boundary for a sub-account/role. After you set a permissions boundary for a sub-account/role, it can only perform operations allowed by both the associated policy and the permissions boundary. A permissions boundary only limits the maximum scope of permissions owned by a sub-account/role, but cannot be used to set permissions for the sub-account/role. For detailed evaluation logic, please see the following figure:
You can use a preset or custom policy to set permissions for a sub-account/role. This policy is the maximum scope of permissions that the sub-account/role can have. This document describes how to use a permissions boundary to set the maximum scope of permissions for a sub-account.
Suppose a company's Tencent Cloud resource admin needs to set permissions for OPS employees to meet the following requirements:
test1
and test2
respectively.test1
only needs to manage all COS permissions under the root account.test2
only needs to manage the operation permission for the server with the instance ID of ins-1
under the root account.test1
test1
and click the user's nickname to enter the user details page.QcloudCOSFullAccess
policy to set all COS permissions for the sub-account test1
.10.217.182.3/24, 111.21.33.72/24
as the IP value.test2
Log in to the admin account and create a custom policy syntax named policygen-2
by referring to the following policy syntax. For more information, please see "Create by Policy Syntax".
{
"version": "2.0",
"statement": [
{
"effect": "allow",
"resource": [
"qcs::cvm:gz::instance/ins-1"
],
"action": [
"name/cvm:*"
]
}
]
}
On the user list page, find the sub-account test2
and click the user's nickname to enter the user details page.
In the Permissions Policy section under the Permission tab, click Associate Policy and select the policygen-2
policy to set the operation permission of the CVM instance named ins-1
for the sub-account test2
.
In the Permissions Boundary section under the Permission tab, click Set Boundary to enter the Set Permissions Boundary page.
On the permissions boundary setting page, click Create Custom Policy to enter the custom policy creation page.
On the custom policy creation page, set the policy name as policygen-3.
In the Visual Policy Generator, check to add the following information:
10.217.182.3/24, 111.21.33.72/24
as the IP value.Click Create to enter the permissions boundary setting page.
On the permissions boundary setting page, check the policygen-3
policy in the policy list.
Click Set Boundary.
Was this page helpful?