# Sub-users

A sub-user is a type of IAM (Identity and Access Management) user, with the following characteristics:

- Belongs to a cloud service account (i.e., the primary account), created and managed by the primary account. It generally corresponds to enterprise employees or applications.
- Has no permissions by default; it can only log in/access resources after being authorized by the primary account.
- Each sub-user independently holds a long-term valid API secret key.
- Does not support independent billing; all consumption generated by the sub-user is settled through the primary account.
- Deleting a sub-user does not affect the resources created by it.

<!-- image-todo -->
![img](https://cdn.udelivrs.com/2025/04/ead182fcca93660dea69b5a9dc40e16c_1745737549157.png)<br>


### Creating a Sub-user

A sub-user logs in via email, and the username is the unique identifier of the sub-user under the cloud service account.
<!-- image-todo -->
![img](https://cdn.udelivrs.com/2025/04/2c9063fba8ca10c673cfbc1933bb92af_1745737549158.png)<br>

### Adding Permissions to a Sub-user

A sub-user needs to obtain resource permissions before performing a series of management tasks. IAM allows the sub-user to be directly bound with resource permissions, or to exercise the group’s resource permissions by joining a user group.
<!-- image-todo -->
![img](https://cdn.udelivrs.com/2025/04/d612f45e0311aab72a4a2aa95d17ee4d_1745737549159.png)<br>
<!-- image-todo -->
![img](https://cdn.udelivrs.com/2025/04/a7ce5b4ed6efb97da70e11fd79c814c9_1745737549160.png)<br>
<!-- image-todo -->
![img](https://cdn.udelivrs.com/2025/04/b05d706f7fa113d679226fff7d04dfe3_1745737549161.png)<br>

### Sub-user Joining a User Group

After a sub-user joins a user group, it automatically obtains the group’s resource permissions. A sub-user can join multiple user groups.
<!-- image-todo -->
![img](https://cdn.udelivrs.com/2025/04/27fe064b7567a49577dc288246b5fe38_1745737549162.png)<br>
<!-- image-todo -->
![img](https://cdn.udelivrs.com/2025/04/f9d8d6167886df590cfab1188e0e5dac_1745737549163.png)<br>


### Freezing/Unfreezing/Canceling a Sub-user

A frozen sub-user will not be able to log in, but it can recover upon thawing. The cancellation of a sub-user is irreversible. Any changes to a sub-user do not affect the use of resources under the cloud service account.
<!-- image-todo -->
![img](https://cdn.udelivrs.com/2025/04/3f5b84858477c6c9cdf72b015081cfda_1745737549164.png)<br>

### Viewing Sub-user Details
Manage the sub-user’s specific permissions and group information through the details page. Note that a sub-user cannot manage the resource permissions of the group it belongs to.
<!-- image-todo -->
![img](https://cdn.udelivrs.com/2025/04/c5c7437fb6c2c2b86c594fa418dab001_1745737549165.png)<br>