In practice, product feature operation permissions need to be granted to sub-accounts of employees at different job levels through the root account to meet security compliance requirements. This document lists the permission authorization practices in multiple scenarios.
Prerequisites
Tencent Cloud accounts are managed in Tencent Cloud CAM (Cloud Access Management). You need to understand basic concepts such as sub-accounts, permissions, and policies in advance. For more information, see CAM Basic Concepts. A policy is a collection of one or more operation permissions, and policies are classified as follows:
|
Preset policy | Various Tencent Cloud products | A collection of permissions for frequently used product features | QcloudISSReadOnlyAccess
ISS read-only access permission | Users can only view and cannot modify. |
|
|
| QcloudISSFullAccess
ISS full read-write access permission | Users can fully operate and view. |
Custom policy | User | Fine-grained permission management that users can independently create based on business scenarios. | None | None |
To perform the complete process of sub-account permission authorization, see User Permissions. Scenario 1: Authorizing Full Operation Permissions for a Sub-Account
Applicable to: headquarters Ops team and headquarters digitalization department (responsible for building the video business)
Scenario: This type of sub-account coordinates the overall business (equivalent to the role of a super administrator),
Authorization policy: The root account grants the sub-account the product's preset policy: QcloudISSFullAccess, which provides full read/write access to the Intelligent Surveillance System (ISS).
Note:
This type of sub-account can be used to create multiple sub-accounts for regional personnel. To do so, grant the sub-account the QcloudCamFullAccess preset policy, after which sub-accounts can be created.
Scenario 2: Authorizing a Sub-Account to View Only Live Streaming and Recordings Without Editing Permissions
Applicable to: sub-accounts of regional personnel
Scenario: This sub-account assists headquarters personnel in troubleshooting device faults and routinely accesses device videos in its responsible regions. Therefore, it can only perform live streaming and recording playback (local and cloud) on authorized devices, and cannot edit device organization, add/delete devices, download cloud recordings, or access other features.
Authorization policy: A custom policy must be created by the root account, which must include the following product APIs. For details, see Custom Policy Creation Guide. The policy is then granted to the sub-account. |
DescribeOrganization | Query Organization |
DescribeDeviceChannel | Query Device Channel |
DescribeDeviceRegion | Query All Service Nodes of a Device |
DescribeDictionary | Obtain Dictionary |
DescribeRecordPlaybackUrl | Obtain Cloud Recording Playback URL |
DescribeUserDevice | Query Device |
ListDevices | Obtaining the Device List |
DescribeRecordFile | Recording File Search |
ControlDeviceStream | Obtain Stream URL |
ControlRecord | Recording Control |
ControlRecordTimeline | Request Recording Timeline |
PlayRecord | Recording Playback |
RefreshDeviceChannel | Refresh Device Channel |
ListTasks | Queries the task list. |