Related concepts

Role

IAM identities with specific permissions that can be created in the Baidu AI Cloud account. Roles are similar to IAM users. Both are of Baidu AI Cloud identities and can be granted allow or deny permissions to access specific resources. The difference lies in that a role is a virtual identity without definitive credentials (password or key), thereby preventing direct console login or API access to your Baidu AI Cloud resources. A role can only access authorized resources when assumed by a trusted entity identity, which provides temporary security credentials for the role session.

A role can be assumed by the following types of users:

• IAM user in the same account as the role
• IAM user not in the same account as the role
• Web services or products provided by Baidu AI Cloud
• External users provided by an identity provider compatible with SAML2.0

Role carrier

Referring to an object capable of assuming role permissions. Define role principals for adding and managing specific roles in trust policies to allow or deny these principals access to your resources in Baidu AI Cloud. Currently, eligible role carriers include primary IAM users, roles, or groups.

Switch (assume) role

Refer to the operation where a role carrier switches from its own user space to an authorized role space. Once a user is granted the permission of STSAssumeRoleAccess, it can switch between the own user space and role space, but only to a single role space at a time. After switching to the target role space, the user will only possess the permissions of the target role. Currently, role switching is only supported via API. For detailed instructions, refer to [Use Role](IAM/Operation guide/Role Management/Using Roles.md).