Overview

A permission specifies whether to allow or deny some operations on the corresponding resources in specific conditions. A policy is a set of permissions.

Permission

Permissions indicate whether a user is allowed to perform a specific operation on a resource. Permissions include Allow and Deny.

Policy

Policies are a set of permissions defined based on the policy syntax and structure, which can accurately describe the authorized resource set, operation set, and authorization conditions.

Identity and Access Management (IAM) supports the following two types of policies:

• System policies: Kingsoft Cloud creates and updates system policies. You can only use the policies but not modify them.
• Custom policies: You can create, update, and delete the policies.

Authorization

Authorization is the operation of granting permissions necessary for specific work to the corresponding identity (IAM user, IAM group, or IAM role). After obtaining the permissions, the identity can access the corresponding cloud service and perform required operations.

• You can attach system policies and custom policies to the identity.
• If the attached policies are updated, the new policies automatically take effect, and you do not need to attach the new policies to the identity.