This document describes how to use the root account to authorize sub-accounts at the tag level. After successful authorization, the sub-accounts will have the capability to control a certain resource under the authorized tag.
Prerequisites
You must have a Tencent Cloud root account and have activated the Cloud Access Management (CAM) service.
Your root account must have at least one sub-account, and you have completed the authorization as instructed in Getting Access Authorization.
You must have at least one CKafka cluster instance.
You must have at least one tag, if you don’t have one, you can go to the Tag console > Tag List to create a new one.
Directions
By using the policy feature in the CAM console, you can grant a sub-account full access to the tagged CKafka resources owned by the root account through the tag authorization. The following describes the detailed steps for granting the sub-account access to CKafka resources by tag
Step 1. Bind tags to resources
1. Log in to the CKafka console with root account, and enter the instance list page.
2. Select the target instance, click Edit Tag in the upper left corner, and bind the resource tag to the instance.
3. In the visual policy generator, enter CKafka in Service to filter, and select CKafka (ckafka). Then, select All actions in Action, and you can also select the action type as needed.
4. Click Next and enter a policy name as needed.
5. Click Select Users or Select User Groups to select the users or user groups that need to be granted resource permissions.
6. Click Complete. The sub-account can control the resources under the specified tag according to the policy.
Managing Resource Tags
You can also manage resource tags in a unified manner in the Tag console. The detailed operations are as follows.
Yes
No
Was this page helpful?