Cloud Access Management (CAM)

Cloud Access Management (CAM) is Tencent Cloud's identity and access management service. CAM controls who can access your resources and what they can do — the equivalent of AWS IAM or Alibaba Cloud RAM.

---

Root Account and Sub-Accounts

Root Account

When you sign up for Tencent Cloud, you receive a root account with full access to all resources and billing.

Root account best practices:

• Never use the root account for daily tasks
• Enable MFA on the root account
• Create sub-accounts for all operational work

Sub-Accounts

CAM supports two types of sub-accounts:

Type	Description	Use Case
Sub-user	An identity with its own login credentials	Team members, developers
Collaborator	Another root account granted access to your resources	Partner companies, cross-account access

Each sub-user gets:

• A unique login (CAM user name)
• Optional console password (web access)
• Optional API keys (SecretId + SecretKey for programmatic access)

---

User Groups

User groups let you manage permissions for multiple users at once:

User Group: Developers
├── Sub-user: alice
├── Sub-user: bob
└── Sub-user: charlie
    → Attached policy: QcloudCVMFullAccess
    → Attached policy: QcloudCOSReadOnlyAccess

Best practice: Always attach policies to groups, not individual users.

---

CAM Policies

Policies are JSON documents that define permissions:

{
  "version": "2.0",
  "statement": [
    {
      "effect": "allow",
      "action": ["cvm:*"],
      "resource": ["*"]
    }
  ]
}

Policy Types

Type	Description
Preset policies	Pre-built policies managed by Tencent (e.g., QcloudCVMFullAccess)
Custom policies	Policies you write for fine-grained control

Policy Elements

Element	Description
effect	allow or deny
action	API operations permitted (e.g., cvm:RunInstances)
resource	Resources the policy applies to (resource six-segment format)
condition	Optional conditions (IP range, time, MFA status)

---

Roles

CAM roles provide temporary credentials for:

• Service roles — allow Tencent Cloud services to act on your behalf
• Cross-account roles — allow users from another account to access your resources
• Identity provider (IdP) roles — federated login via SAML 2.0

Assuming a Role

When a role is assumed, temporary credentials (SecretId, SecretKey, Token) are issued with an expiry time.

---

Multi-Factor Authentication (MFA)