Buy Tencent Cloud Recharge Card Tencent Cloud global sub account creation guide

Overview

In the cloud, a root account feels like the top of a tree wearing a crown made of firewall rules. You can do almost everything, but the more you let different teams play in the same canopy, the more tangled things get. Tencent Cloud provides a clean way to scale without the chaos: global sub accounts. A global sub account is a distinct identity under your main Tencent Cloud organization that can own resources, have its own billing, and be governed by its own access policies. It keeps teams from stepping on each other’s toes while preserving central oversight. This guide walks you through the why, the when, and the how of creating and operating these sub accounts, with practical steps, tips, and a few jokes to keep the process human.

Why use global sub accounts

There are several compelling reasons to adopt a global sub account model. First, it creates a natural boundary between environments. Development, staging, testing, and production each have different risk profiles, and isolating them reduces the blast radius when something goes sideways. Second, it improves cost accountability. When a team’s name appears on the bill, they start acting like grownups who budget, forecast, and occasionally scream at the spreadsheet in a constructive way. Third, it simplifies access control. Instead of one monolithic policy that tries to guess what every engineer needs, you assign roles and policies that reflect actual duties. Finally, it supports governance and compliance. For teams spread across multiple regions or legal entities, a consistent sub account structure enables centralized auditing while respecting local requirements. If your dream is to give every microservice its own department, this is the scaffolding you want to build first.

Key concepts and vocabulary

Before we dive into clicks and confirmations, here are a few terms you will encounter often. A root or master account is your umbrella under which everything else lives. A global sub account is a child identity with its own namespace, permissions, and billing. CAM stands for Cloud Access Management, Tencent Cloud’s identity and access management service. A policy describes what actions are allowed or denied. A role is a set of permissions that can be assumed by a user or sub account. A budget and alarm are features to monitor spending and alert you when you approach limits. Understanding these terms at a high level will save you from chasing acronyms through the cloud like a scavenger hunt without a map.

Design principles for sub accounts

Separation of duties

One of the earliest moves in any cloud governance plan is to separate duties so no single person can do everything. In practice this means you define roles such as administrator, developer, operator, security auditor, and billing owner. The administrator manages cloud services and policies. The developer builds apps and consumes resources within the constraints of their role. The operator handles day to day operations like deployments and monitoring. The security auditor reviews logs and enforces policy. The billing owner tracks spend and enforces cost controls. When you assign sub accounts, try to map teams to roles rather than giving blanket access. It reduces risk and makes ramping up new teammates smoother, because you can clone an existing role rather than reinventing the wheel every time someone asks for access to something new.

Security and compliance

Security is not a feature you enable once and forget about. It is a culture and a set of controls that must be exercised daily. For sub accounts, adopt a defense-in-depth approach: enforce multi factor authentication for all sub accounts, rotate access keys regularly, and minimize the permissions to the smallest set that still gets work done. Use policy versions and keep a change log so you can roll back if something suspicious happens. Consider enabling security services like vulnerability scanning for common cloud assets and enabling logging to capture who did what when. If privacy or data residency is a concern, map sub accounts to regions and apply constraints so that sensitive data never travels to a region that users are not allowed to access. The goal is not to frighten your team, but to make it harder for mischief to slip in, like a cat through an open window.

Buy Tencent Cloud Recharge Card Prerequisites for creating global sub accounts

To avoid being caught in a login loop, make sure you have a Tencent Cloud main account with administrative privileges. You will benefit from enabling organization level governance features, if your account supports them, so you can apply global policies consistently. You should be comfortable using CAM or the Cloud Access Management interface. Gather the information you will need for the sub accounts you plan to create: an appropriate name or alias, contact email, time zone, and a rough idea of the roles that sub account will need. If you already know you will need separate billing for the sub account, plan for a separate billing project or project code. Finally, prepare a basic naming convention that will scale as you add more sub accounts over time. A coherent naming scheme makes it much easier to identify sub accounts at a glance, especially when you start to generate reports for finance and audits.

Step-by-step guide to create a global sub account

Step 1: Planning your sub account structure

Before you click any buttons, sketch a simple map of how you want your sub accounts to relate to your teams, projects, and environments. Decide whether you will create a sub account per team or per project, per environment, or a hybrid model. Consider the following questions: How many sub accounts do you expect in the next year? What are the responsible teams? Which production workloads require tight isolation? What is your preferred method for naming and tagging assets? How will you handle cross-region access and data governance? Write down answers and store them in a shared doc accessible to security, finance, and engineering leads. The planning phase can save you days of confusion later, so take your time to get it right rather than rely on a quick shuffle of roles when someone shouts code in production at 2 am.

Step 2: Access and permissions planning

With a rough map in place, decide on the initial set of roles you will assign to the sub account. For example, you might create a developer role that allows read and write access to compute and storage resources, a operations role with monitoring capabilities, and a security auditor role with access to logs and policy views. Decide your policy language style – a strict allowlist where you explicitly enumerate allowed actions, or a more flexible deny-first model with explicit exceptions. In Tencent Cloud CAM you can define policies that reference actions and resources, and you can assign policies to roles or directly to sub accounts. The important thing is to avoid giving blanket administrator permissions to every sub account by default. Start with least privilege, and only lift limits when you have a real business need. It sounds like a lot of work, but your future self will thank you when you are not chasing a runaway policy in the middle of a production incident.

Step 3: Create the sub account

Now the fun part begins. Log in to the Tencent Cloud Console with your root or primary admin account. Navigate to the Cloud Access Management CAM service. Look for the option to manage sub accounts and choose to create a new sub account. You will be asked for a name and a reference alias. The name should be clear and descriptive, so a teammate looking at a billing report will not wonder which sub account is which. The alias can be a short label used in the console. You may be asked for a contact email and a time zone. Some organizations also require a regional alignment to ensure resource creation happens in approved zones. After you fill out the required fields, proceed to create. The system may present you with an initial temporary password or a notification that the sub account is created and awaiting activation. If the latter, share the credentials securely and remind your new sub account user to set up MFA on first login. It is the cloud equivalent of telling a new neighbor to bring their own flashlight to a dark basement: it reduces drama and keeps things safe from the get go.

Step 4: Assign roles and policies

With the sub account created, the next step is to attach the appropriate roles and policies. In CAM you can associate a sub account with specific policies, or create a role and then allow the sub account or its users to assume that role. Start with a baseline policy set: something like a developer policy that covers compute, storage, and networking operations needed by the team, plus an operator policy for monitoring and basic maintenance, and a security policy for audit and compliance activities. If you have compliance obligations, add policies that enforce data residency, encryption requirements, and access controls. It is often wise to define a parent policy template that can be cloned and adjusted for new sub accounts. This reduces time to onboard new sub accounts and ensures consistency across the organization. After you configure policies, map them to the sub account or to the users who will use that sub account. Remember to keep documentation about why each policy exists and the business reason behind its permissions. The goal is to be secure and efficient, not to turn your cloud into a maze of dead ends where engineers end up asking for access to a treasure map every week.

Step 5: Configure billing and budgets

Billing configuration is an essential piece of the puzzle. In Tencent Cloud you can assign sub accounts to use separate billing accounts or project budgets depending on your organizational settings. Create a budget for the sub account and set up alerts when usage approaches the limit. For example, you might set a monthly cap for development environments so you do not accidentally fund a small cloud island in the middle of a sea of experiments. It is helpful to enable cost analysis reports that show spend by sub account, by service, and by region. This visibility makes it easier to discuss spend with product teams and to identify unexpected spikes early, before the budget conversation becomes a scary meeting in a conference room with a whiteboard covered in red marker. The budgeting process should be revisited regularly as projects shift, new services are adopted, and teams grow.

Step 6: Security measures and onboarding

Security is the secret sauce that holds the dish together. Enforce MFA for all users in the sub account and require password rotation on a schedule that matches your risk tolerance. If possible, enable device binding or conditional access policies so the sub account can only be used from approved networks or locations. Create API access keys carefully; rotate them and store them securely using a vault or secret manager, never in plain text emails or chat messages. For automation friendly teams, consider creating temporary credentials for CI CD pipelines that automatically expire. Document onboarding steps for new developers and maintainers, including how to request additional permissions and how to report suspicious activity. A well documented onboarding process reduces the number of times you hear the question where can I find the permissions for this sub account at 2 am on a Saturday. And yes, you can also set up an automated onboarding workflow with a small amount of scripting or using cloud native templates, which makes life easier when you have a handful of sub accounts to spin up in a month.

Managing sub accounts and ongoing governance

Organizational structure and tagging

Once your sub accounts exist, you will want to organize them for ease of management. A tidy structure helps with cost reporting, access management, and incident response. Use a consistent naming convention that encodes the team, environment, region, and purpose. For example, you might use patterns like team-env-region-app or team-project-env-region. Tag resources within each sub account with the same set of tags to enable cross-account reporting. Tagging is the quiet, patient hero of cloud governance: it makes searching, filtering, and reporting much easier without needing an army of spreadsheets. Create a standard tag dictionary and ensure all automation and CI pipelines apply tags consistently as resources are created. The moment you start doing without tags, you will wonder where that database came from and why it has a tag of unknown that makes no sense. Tagging is not optional; it is a best practice you will thank yourself for later.

Policy design across sub accounts

Policies should be designed with reuse in mind. Create base policy templates for common roles and then tailor them to each sub account as needed. This approach reduces duplication and the risk of drift, where similar sub accounts diverge in policy shape. Maintain a central policy library and a change control process so that updates are reviewed and tested before rolling out. It helps to keep a changelog that records why a policy was updated, who approved it, and what risk was mitigated. When auditing, you want to be able to explain the policy decisions in plain language, not defense attorney jargon. A good policy design is the backbone of a resilient cloud environment and a less sweaty security team at 3 am during a breach scenario.

Cross region access and data residency

Global sub accounts enable teams across regions, but that freedom must be balanced with data residency requirements and legal constraints. If your organization handles sensitive personal data or regulated data, reflect these constraints in the sub account policies and in the contracts that bind service providers. Where possible, keep data within the region that is approved by compliance teams, and ensure that cross region access is strictly controlled and logged. For compute resources that replicate in multiple regions, ensure that the sub account has explicit permission to operate in each target region and that data transfer is protected by encryption in transit and at rest. The goal is not to hinder innovation but to enforce responsible data handling across a distributed organization. The cloud can whisk data around the world like a travel-wary traveler, but good governance makes sure it lands only where it should.

Monitoring, logging, and auditing

Without visibility you are flying blind. Enable centralized logging and monitoring so you can see what is happening across all sub accounts. Use Cloud Monitor and log services to collect metrics, events, and audit trails. Set up dashboards that summarize usage by sub account, region, and service. Create alert rules for unusual activity such as sudden spikes in creation of resources, changes to IAM policies, or a lack of sign-in activity for an extended period. Regularly review logs and audit reports, and set up periodic governance checks. These checks should happen with a cadence that fits your risk posture, whether that means weekly, monthly, or quarterly. The goal is to detect anomalies early and act decisively, rather than spending days debating whether the anomaly is a broken pipeline or a rogue bot that learned to bake cookies from Terraform scripts.

Common pitfalls and troubleshooting

Overly broad permissions

One of the classic mistakes is granting root-like access to sub accounts or blanket full administrator permissions. It is tempting to do this for convenience, but it creates a single point of failure. If you must do something urgent, use temporary credentials or a just-in-time access policy and then revoke permissions when the job is done. You will sleep better and avoid waking up to a security incident that started with a single misconfigured policy.

Billing confusion and cost overruns

Billing can become a swamp of incongruent reports if you do not structure it carefully. Make sure every sub account has a well-defined budget, and enable alerts when spending approaches or exceeds it. Compare usage reports across sub accounts to identify unusual patterns and possible waste. If a sub account consistently runs hot, investigate whether the team saved money by deleting load-bearing resources or if there is a deeper architectural issue that needs attention. Cost management should be seen as a product feature, not a parenthesis in a finances meeting. It is part of the service level you owe to your own business.

Best practices for large teams and mature organizations

Naming conventions and standardization

A consistent naming convention saves hours of motorized head-scratching during audits and rollouts. Decide on a pattern that captures the team, environment, region, and project in a compact, readable way. Document the convention in a living style guide and reference it whenever you create new sub accounts, resources, or policies. Make it easy for new team members to guess what a sub account is for just by looking at its name. If you can make a single acronym or abbreviation that means something obvious, you have achieved naming bliss.

Automation and templates

The cloud loves repetition, and your humans do not. Use templates for sub account creation, policy definitions, and basic resource provisioning. If your platform supports infrastructure as code or automation pipelines for account creation, build a reusable blueprint that creates the sub account, attaches baseline policies, and configures budgets. The blueprint is your friend because it makes onboarding predictable, reduces errors, and scales your governance model as you grow.

Documentation, training, and onboarding

Finally, document everything and train teams. Create quick start guides for developers who need access, security teams who enforce policies, and finance people who monitor spend. Provide onboarding checklists, incident response playbooks, and a sandbox environment where teams can practice without affecting production. The more you document, the less you answer the same questions again and again. A well-documented process is the cloud’s secret handshake that says you know what you are doing even when the system throws a curveball.

Buy Tencent Cloud Recharge Card FAQ: frequently asked questions about global sub accounts

What is the difference between a sub account and a project

A sub account is an identity with its own credentials, permissions, and billing line item, while a project is a grouping of resources that helps you organize those assets. Sub accounts own resources and incur costs; projects help you categorize and report.

Can sub accounts own resources in multiple regions

Yes, sub accounts can own resources across regions, but you should design cross region access with explicit permissions and data residency in mind. Some teams keep most resources in their home region and replicate only what is necessary for availability and disaster recovery.

How do I revoke access or decommission a sub account

First, disable or delete any active access keys and remove policies that allow access. Then delete the sub account from the CAM interface, ensuring there are no orphaned resources or ongoing charges. Finally, update your governance docs to reflect the change and communicate with stakeholders to close out any pending requests tied to that sub account.

What is the recommended review cadence for sub accounts

At minimum, review sub accounts quarterly for policy drift, unused permissions, and stale resources. In high-risk environments or highly regulated industries, monthly reviews may be prudent. The goal is steady governance, not bureaucratic bloat.

Appendix: Quick start checklist

• Define the sub account naming convention and document it.
• Identify initial sub accounts and assign owners.
• Plan roles and attach baseline policies with least privilege.
• Configure MFA and credential hygiene for all accounts.
• Set up separate billing or budgets per sub account with alerts.
• Create a central policy library and onboarding templates.
• Enable centralized logging and monitoring across all sub accounts.
• Buy Tencent Cloud Recharge Card Document escalation paths and incident response playbooks.
• Review and update plans quarterly or after major changes.

Glossary of terms

Root account: the primary owner of the Tencent Cloud organization with broad control. Global sub account: a distinct identity under the root with its own resources, permissions, and billing. CAM: Cloud Access Management, Tencent Cloud identity platform. Policy: a set of rules that grant or restrict actions on resources. Role: a collection of permissions that can be assumed by users or sub accounts. Budget: a planned spending limit with alerts. MFA: multi factor authentication, an extra layer of security beyond passwords. Region: a geographic area where cloud resources are hosted. Data residency: location-based data storage and processing requirements. Tagging: metadata labels attached to resources to aid in organization and reporting.

Conclusion

Global sub accounts in Tencent Cloud are a powerful tool for scaling teams, aligning costs, and enforcing governance across a distributed organization. The process is not mysterious, but it does require planning, discipline, and a willingness to iterate. By defining a clear structure, applying least privilege, setting budgets, and maintaining good documentation, you can create a scalable, secure, and efficient multi-account environment. Remember that the goal is not to hoard control, but to provide teams with the autonomy they need to deliver value while keeping the ship steady and the pirates away from the treasure. With a little humor, a dash of patience, and a solid set of policies, you will have a cloud environment that works for you, not against you. And when questions arise, you can smile and say you already have a guide for this, one that balances practicality with a touch of whimsy, and with that you can get back to building the next great feature without losing your mind in an endless labyrinth of permissions.