Docs

NAT Gateway

IAM

IAM overview

Identity and Access Management (IAM) is a permission management system and one of the free services provided by VolcanoEngine. You can create IAM users for your VolcanoEngine account (root account) and grant them appropriate permissions based on different purposes to control access to cloud resources by different identities. This achieves decentralized resource management, improves management efficiency, and reduces the risk of information leakage.

Why use IAM

Before using VolcanoEngine resources, you need to register an account. The registered account is the root user, which by default has full management permissions for all resources under the account.

Using only the main account to manage resources may cause the following issues:

Multiple people share the main account for actions, making it impossible to identify the actual user.

The main account has extensive permissions, so any exposure would have severe consequences.

Using the main account directly for operation and maintenance (O&M) tasks involves higher risks.

You can avoid the above issues through the IAM feature. Under the root user, you can create IAM users, user groups, and roles. Newly created IAM users, user groups, and roles have no permissions. You can grant corresponding permissions to the created IAM users, user groups, and roles based on actual needs, achieving multi-identity management and fine-grained permission control. For more features, see IAM Overview.

IAM topics

Topic	Description	Related documents
IAM terms	Using IAM for permission management involves many technical terms, such as IAM identities (user, user group, or role), policies, and single sign-on (SSO).	Terms
IAM limits	IAM resources are limited by resource quotas. If the quota limit is exceeded, new resources cannot be created.	Limits
IAM usage process	You can authorize IAM users directly or authorize them by adding them to a user group.	Create a user and authorize it Grant user API key management permissions
IAM policy overview	A policy is a set of permissions described using a syntax structure. Policy type: IAM supports two types of policies: System default policy and Custom policy. Policy syntax structure: IAM policies follow a fixed syntax format, allowing you to create diversified and customized IAM policies as needed. Policy scope: IAM policies apply two scopes: Global and Designated projects.	Basic structure NAT Gateway IAM policy types

Last updated: 2026.07.09 19:16:53