Access Permission
EdgeOne Makers controls access permissions through Tencent Cloud Access Management (CAM). Root accounts have all permissions by default. Sub-accounts, collaborators, and roles must be granted the required permissions by an administrator before they can use the console or EdgeOne CLI.
Makers APIs belong to the Edge Security Acceleration Platform EO (
teo) service. In this document, "workspace" is referred to as "space", which corresponds to a site (Zone) in EO.Scenario | Recommended Method |
All team members need to use Makers normally without the need for granular permission division. | Quick authorization: directly grant the preset policy of the teo service. |
Need to distinguish roles such as read-only, development, and management. | Fine-grained authorization by role |
Isolate spaces by team or business. | Isolate permissions by space |
Quick Authorization
Use a root account or an account with CAM administrative permissions to locate the target identity in User, User Group, or Role in the CAM console, and associate one of the following preset policies:
Preset Policy | Permission Scope |
QcloudTEOFullAccess | teo service full read-write permissions, allowing full use of Makers. |
QcloudTEOReadOnlyAccess | teo service read-only permission. Users can only view resources and cannot create, modify, or delete them. |
Note:
The preset policy covers all APIs and spaces of the
teo service and is the simplest to configure. To narrow down permissions by role or space, see the advanced usage below.Advanced: Fine-Grained Authorization by Role
Makers uses only some of the EO APIs. To grant permissions based on the principle of least privilege, create a custom policy based on the API list below:
1. In the CAM console, go to Policies > Create Custom Policy, select Create by Policy Syntax, and paste the content from the preset role policy. Alternatively, select Create by Policy Generator, choose Edge Security Acceleration Platform EO (
teo) as the service, select the operations according to the API list, and choose All resources (*) for the resource scope.2. Locate the target identity in User, User Group, or Role, and associate the policy with it.
Sub-accounts without CAM administrative permissions can send the policy content of the required role to an administrator for configuration.
API List
API | Description | Space-Scopeable | Read-only | Developer | Administrator |
DescribeZones | Query the zone list (for selecting and switching zones and checking status). | Yes | ✓ | ✓ | ✓ |
CheckCnameStatus | Check Domain CNAME Status. | Yes | ✓ | ✓ | ✓ |
DescribeAccountInfo | Query account information. | No | ✓ | ✓ | ✓ |
DescribeBotData | Query Bot timing data. | Yes | ✓ | ✓ | ✓ |
DescribePacks | Query package feature list. | No | ✓ | ✓ | ✓ |
DescribePagesResources | Query Makers resources. | Yes | ✓ | ✓ | ✓ |
DescribeTimingFunctionAnalysisData | Query edge function analysis timing data. | Yes | ✓ | ✓ | ✓ |
DescribeTimingL7AnalysisData | Query Layer 7 traffic timing data. | Yes | ✓ | ✓ | ✓ |
DescribeTopDomainSuffix | Query top-level domain suffixes. | No | ✓ | ✓ | ✓ |
DescribeUserStatus | Query user service status. | No | ✓ | ✓ | ✓ |
DescribeWebManagedRulesData | Query Web managed rule data. | Yes | ✓ | ✓ | ✓ |
DescribeWebProtectionData | Query Web protection data. | Yes | ✓ | ✓ | ✓ |
DescribeHostCertificates | Query domain certificates. | Yes | ✓ | ✓ | ✓ |
DescribeOpenEdgeResources | Query OpenEdge resources (for deployment). | No | ✓ | ✓ | ✓ |
CreatePagesResources | Create Makers resources. | Yes | — | ✓ | ✓ |
ModifyPagesResources | Modify Makers resources. | Yes | — | ✓ | ✓ |
CreateOpenEdgeResources | Create OpenEdge resources (for deployment). | No | — | ✓ | ✓ |
ModifyOpenEdgeResources | Modify OpenEdge resources (for deployment). | No | — | ✓ | ✓ |
DeletePagesResources | Delete Makers resources. | Yes | — | — | ✓ |
DeleteOpenEdgeResources | Delete OpenEdge resources (for deployment). | No | — | — | ✓ |
Note:
API names follow the EO naming convention, where
Pages in the name refers to Makers. "Restrictable to space" corresponds to the authorization granularity in the CAM API list: "Yes" indicates resource-level granularity, allowing you to specify a space in the policy, while "No" indicates operation-level granularity, where the resource can only be set to *.Preset Role
The policies for the following three roles can be copied and used directly, or you can add or remove APIs as needed.
Read-Only (Viewer)
You can view the console, statistics, and deployment status, but cannot create, modify, or delete resources. This role is suitable for product, operations, and audit personnel.
{"version": "2.0","statement": [{"effect": "allow","action": ["teo:DescribeZones","teo:CheckCnameStatus","teo:DescribePagesResources","teo:DescribeHostCertificates","teo:DescribeBotData","teo:DescribeTimingFunctionAnalysisData","teo:DescribeTimingL7AnalysisData","teo:DescribeWebManagedRulesData","teo:DescribeWebProtectionData","teo:DescribeOpenEdgeResources","teo:DescribeAccountInfo","teo:DescribeUserStatus","teo:DescribePacks","teo:DescribeTopDomainSuffix"],"resource": ["*"]}]}
Developer
In addition to read-only permissions, you can create projects, deploy and modify configurations, but cannot delete them. This role is suitable for daily development and is recommended as the default role.
{"version": "2.0","statement": [{"effect": "allow","action": ["teo:DescribeZones","teo:CheckCnameStatus","teo:DescribePagesResources","teo:DescribeHostCertificates","teo:DescribeBotData","teo:DescribeTimingFunctionAnalysisData","teo:DescribeTimingL7AnalysisData","teo:DescribeWebManagedRulesData","teo:DescribeWebProtectionData","teo:DescribeOpenEdgeResources","teo:DescribeAccountInfo","teo:DescribeUserStatus","teo:DescribePacks","teo:DescribeTopDomainSuffix","teo:CreatePagesResources","teo:ModifyPagesResources","teo:CreateOpenEdgeResources","teo:ModifyOpenEdgeResources"],"resource": ["*"]}]}
Administrator (Admin)
In addition to developer permissions, you can delete resources. This role is suitable for personnel responsible for resource cleanup.
{"version": "2.0","statement": [{"effect": "allow","action": ["teo:DescribeZones","teo:CheckCnameStatus","teo:DescribePagesResources","teo:DescribeHostCertificates","teo:DescribeBotData","teo:DescribeTimingFunctionAnalysisData","teo:DescribeTimingL7AnalysisData","teo:DescribeWebManagedRulesData","teo:DescribeWebProtectionData","teo:DescribeOpenEdgeResources","teo:DescribeAccountInfo","teo:DescribeUserStatus","teo:DescribePacks","teo:DescribeTopDomainSuffix","teo:CreatePagesResources","teo:ModifyPagesResources","teo:CreateOpenEdgeResources","teo:ModifyOpenEdgeResources","teo:DeletePagesResources","teo:DeleteOpenEdgeResources"],"resource": ["*"]}]}
Advanced: Isolating Permissions by Space
To isolate different teams or businesses from each other, you can restrict a sub-account to access only specific spaces. The following two methods can be used simultaneously, and both take effect only for APIs whose "Restrictable to space" value is "Yes" in the API list.
Tag-based Authorization
Grant spaces with a specified tag to a sub-account at once. When adding new spaces later, you only need to add the same tag to bring them into the authorization scope without modifying the policy.
1. On the Makers console homepage, go to Settings > Workspaces and add a tag to the target workspace, for example,
team = team-a. For details, see Workspaces.2. In the CAM console, go to Policies > Create Custom Policy and select Authorization by Tag.
3. In the Edit Policy step, complete the following configurations:
Configuration Item | Value |
Service | Edge Security Acceleration Platform EO ( teo) |
Operation | Select the APIs in the API list based on the required role. |
Select Tag. | Same tag key and tag value as those in step 1 |
Conditional Operator | Or ( for_any_value) |
Whether to Grant the "resource": "*" Permission to APIs That Do Not Support Tags | Yes |
4. In the Associate User/User Group/Role step, select the target identity to complete the creation.
5. After logging in with this sub-account, the user can only view and operate spaces with matching tags.
Note:
"Grant permissions for APIs that do not support tags" must be set to "Yes". APIs whose "Restrictable to space" value is "No" in the API list do not support authorization by tag. Selecting "No" will result in no permissions for these APIs, making the console and deployment unable to function properly.
Do not select "Group (
string_equal)" as the condition operator. This method does not support list APIs, so the sub-account will be unable to view the space list.Specifying Spaces in a Policy
Change the policy resource from
* to a specific space in the format qcs::teo::uin/:zone/${ZoneId}, where ${ZoneId} is the space ID.Because some APIs cannot be restricted to specific spaces, the policy must be split into two parts: for APIs that can be restricted, specify the space ID, and for the remaining APIs, keep
*. The following example restricts the developer role to two spaces (use the actual space IDs):{"version": "2.0","statement": [{"effect": "allow","action": ["teo:DescribeZones","teo:CheckCnameStatus","teo:DescribePagesResources","teo:DescribeHostCertificates","teo:DescribeBotData","teo:DescribeTimingFunctionAnalysisData","teo:DescribeTimingL7AnalysisData","teo:DescribeWebManagedRulesData","teo:DescribeWebProtectionData","teo:CreatePagesResources","teo:ModifyPagesResources"],"resource": ["qcs::teo::uin/:zone/zone-xxxx","qcs::teo::uin/:zone/zone-yyyy"]},{"effect": "allow","action": ["teo:DescribeOpenEdgeResources","teo:DescribeAccountInfo","teo:DescribeUserStatus","teo:DescribePacks","teo:DescribeTopDomainSuffix","teo:CreateOpenEdgeResources","teo:ModifyOpenEdgeResources"],"resource": ["*"]}]}
After spaces are added or deleted, the resource list in the policy must be updated accordingly.
Permission Control Scope
CAM grants permissions by API, and some APIs can be further restricted to a space. The following table lists whether common requirements can be achieved through CAM:
Requirement | Whether Supported | Approach |
View only, no modification. | Supported | Grant the read-only role. |
Can create and deploy, cannot delete. | Supported | Grant the developer role. |
Access only the specified space. | Partially supported | See Restrict Accessible Spaces. APIs marked as "No" for "Can be restricted to a space" in the API list are not subject to this restriction and remain effective for all spaces. |
Access only some projects within the space. | Not supported | CAM can only be scoped down to spaces, not to projects. |
Can only deploy to preview environments, or cannot modify specified configurations such as environment variables. | Not supported | CAM cannot grant permissions by environment or specific configuration items. |
Purchase, upgrade, or renew a package. | Out of scope of this document | Billing-related APIs are not included in the above list and require separate authorization. |
Recommendations:
Grant the Developer role for daily development, and grant deletion permissions only to a few designated owners.
Place teams or businesses that need to be isolated from each other in different spaces, and then restrict access scope by space.
Verifying the Configuration
1. Log in to the console with this sub-account and confirm that the space list is displayed correctly and contains only spaces within the authorized scope.
2. Go to the project details page and confirm that the statistics and deployment records load properly.
3. Perform a deployment and confirm that the process completes successfully.
4. CLI scenario: Run
edgeone login, then execute edgeone deploy and confirm that the deployment is successful.If the issue persists, record the RequestId from the error and the missing API name, and contact the administrator to grant the required permissions.