Product Introduction
Purchase Guide
Getting Started
User Guide
- Overview
- Users
- Access Key
- User Groups
- Role
- Identity Provider
- Policies
- Permissions Boundary
- Troubleshooting
- Downloading Security Analysis Report
CAM-Enabled Role
- Overview
- Compute
- Container
- Microservice
- Essential Storage Service
- Data Process and Analysis
- Data Migration
- Relational Database
- Enterprise Distributed DBMS
- NoSQL Database
- Database SaaS Tool
- Database SaaS Service
- Networking
- CDN and Acceleration
- Network Security
- Data Security
- Application Security
- Domains & Websites
- Big Data
- Middleware
- Interactive Video Services
- Real-Time Interaction
- Media On-Demand
- Media Process Services
- Media Process
- Cloud Real-time Rendering
- Game Services
- Cloud Resource Management
- Management and Audit Tools
- Developer Tools
- Monitor and Operation
- More
CAM-Enabled API
- Overview
- Compute
- Edge Computing
- Container
- Distributed cloud
- Microservice
- Serverless
- Essential Storage Service
- Data Process and Analysis
- Data Migration
- Relational Database
- Enterprise Distributed DBMS
- NoSQL Database
- Database SaaS Tool
- Networking
- CDN and Acceleration
- Network Security
- Endpoint Security
- Data Security
- Business Security
- Application Security
- Domains & Websites
- Office Collaboration
- Big Data
- Voice Technology
- Image Creation
- Tencent Big Model
- AI Platform Service
- Natural Language Processing
- Optical Character Recognition
- Middleware
- Communication
- Interactive Video Services
- Real-Time Interaction
- Stream Services
- Media On-Demand
- Media Process Services
- Media Process
- Cloud Real-time Rendering
- Game Services
- Education Sevices
- Medical Services
- Cloud Resource Management
- Management and Audit Tools
- Developer Tools
- Monitor and Operation
- More
Use Cases
- Security Practical Tutorial
- Multi-Identity Personnel Permission Management
- Authorizing Certain Operations by Tag
- Supporting Isolated Resource Access for Employees
- Enterprise Multi-Account Permissions Management
- Reviewing Employee Operation Records on Tencent Cloud
- Implementing Attribute-Based Access Control for Employee Resource Permissions Management
- During tag-based authentication, only tag key matching is supported
Business Use Cases
- TencentDB for MySQL
- CLB
- CMQ
- COS
- CVM
- VPC
- VOD
- Others
API Documentation
- History
- Introduction
- API Category
- Making API Requests
- User APIs
- Policy APIs
- Role APIs
- Identity Provider APIs
- Data Types
- Error Codes
FAQs
Glossary

Authorization by Tag

Focus Mode

Font Size

Last updated: 2025-08-11 15:25:21

Overview
This document describes how to grant permissions by tag to allow the sub-user cvmtest01 only to manage the resource-level API permissions of ins-duglsqg0.
For details, see Overview. 
Policy Content
To grant permissions by tag as needed, you can use the following policy content:
{
    "version": "2.0",
    "statement": [
        {
            "effect": "allow",
            "action": [
                "cvm:*",
                "vpc:DescribeVpcEx",
                "vpc:DescribeNetworkInterfaces"
            ],
            "resource": "*",
            "condition": {
                "for_any_value:string_equal": {
                    "qcs:resource_tag": [
                        "game&webpage"
                    ]
                }
            }
        }
    ]
}
Directions
Step 1. Create a policy and configure permissions
1. Log in to the CAM console with the admin account. On the Policies page, create a custom policy by tag as instructed in Creating Custom Policy > Authorizing by tag.
 
﻿
﻿
Authorized user: cvmtest01
Bound tag: game:webpage
Operation permissions: All CVM operation permissions and the DescribeVpcEx and DescribeNetworkInterfaces permissions of VPC. If you are not sure what other APIs are involved, see Authorization by Resource ID > Step 3.
2. Click Next and enter a policy name.
3. Click Save.
﻿
﻿
Step 2: Verify the result
1. Log in to the CVM console as the sub-user cvmtest01 and access the instance list page.
Then the sub-user cvmtest01 can start, shut down, restart, rename, and reset the password of the CVM instance.
﻿
﻿