tencent cloud

All product documents
Cloud Access Management
DocumentationCloud Access ManagementCAM-Enabled APICloud Resource ManagementIdentity Aware Platform
Identity Aware Platform
Download PDF
Last updated: 2025-03-26 10:00:10
Identity Aware Platform
Last updated: 2025-03-26 10:00:10
Download PDF

Fundamental information

Product Abbreviation in CAM Console Authorization by Tag Authorization Granularity IP Restriction
Identity Aware Platform iap Supported not supported Operation level Supported

Note：

The authorization granularity of cloud products is divided into three levels: service level, operation level, and resource level, based on the degree of granularity.

  • Service level: It defines whether a user has the permission to access the service as a whole. A user can have either full access or no access to the service. For the authorization granularity of cloud products at service level, the authorization of specific APIs are not supported.
  • Operation level: It defines whether a user has the permission to call a specific API of the service. For example, granting an account read-only access to the CVM service is an authorization at the operation level.
  • Resource level: It is the finest authorization granularity which defines whether a user has the permission to access specific resources. For example, granting an account read/write access to a specific CVM instance is an authorization at the resource level.

API authorization granularity

Two authorization granularity levels of API are supported: resource level, and operation level.

  • Resource level: It supports the authorization of a specific resource.
  • Operation level: It does not support the authorization of a specific resource. If the policy syntax restricts a specific resource during authorization, CAM will determine that this API is not within the scope of authorization, and deem it as unauthorized.

Write operations

API API Description Authorization Granularity Six-segment Resource Description IP Restriction
CreateIAPUserOIDCConfig Create IAP service OIDC configuration Operation level * Supported
DisableIAPUserSSO Disable IAP service Operation level * Supported
ModifyIAPLoginSessionDuration Modify the login session duration Operation level * Supported
UpdateIAPUserOIDCConfig Modify the IAP service OIDC configuration Operation level * Supported

Read operations

API API Description Authorization Granularity Six-segment Resource Description IP Restriction
DescribeIAPLoginSessionDuration Describe the login session duration Operation level * Supported
DescribeIAPUserOIDCConfig Describe IAP service OIDC configuration Operation level * Supported
Was this page helpful?
You can also Contact Sales or Submit a Ticket for help.
Yes
No

Feedback

Contact Us

Contact our sales team or business advisors to help your business.

Contact Us
Technical Support

Open a ticket if you're looking for further assistance. Our Ticket is 7x24 avaliable.

Submit a Ticket
7x24 Phone Support
Hong Kong, China
+852 800 906 020 (Toll Free)
United States
+1 844 606 0804 (Toll Free)
United Kingdom
+44 808 196 4551 (Toll Free)
Canada
+1 888 605 7930 (Toll Free)
Australia
+61 1300 986 386 (Toll Free)
EdgeOne hotline
+852 300 80699
More local hotlines coming soon