This guide introduces the basic concepts of Atomile IAM. As an administrator, you can use IAM to manage roles and grant permissions for individual service resources across your subscribed Atomile products.

User Account Types

Atomile Console offers two types of user accounts:

Main Account

• Serves as the primary administrator for all Atomile products
• Has full privileges to manage all user accounts and grant permissions
• Only one Main Account is provided per contract
• Can create and manage multiple sub-accounts based on your business requirements

Sub Account

• Used as an end-user login account to access products and services
• Permissions are determined by the roles assigned by the Main Account
• Access is limited to the functions and resources specifically granted by the Main Account

To check your account type, navigate to Account Management > Basic Information.

Identity Credentials

Identity credentials are used to identify you when logging in to the Atomile Console. These include:

Login Name and Password

• Use these credentials to log in to the Atomile Console
• Manage your products and service resources through the web interface

AccessKey

• Used to send API requests or use cloud service SDKs
• Currently available for specific products such as Content Acceleration
• Enables programmatic access to resources through API authentication

Important: Identity credentials are confidential information. Keep all passwords and access keys secure.

Policies (Permissions and Actions)

How Policies Work

A policy defines which actions are allowed or denied for specific resources. When you make a request:

1. Atomile Console authenticates your credentials.
2. The platform requests IAM to verify whether your request is authorized.
3. IAM checks whether your account has permission for the requested action.
4. IAM verifies your access to the specific resource, such as a CDN domain.
5. If both conditions are met, your request is processed.

Policy Types

By Owner

• System Policies
  • Created and managed by Atomile
  • Cannot be modified by customers
• Custom Policies
  • Created and managed by customers
  • Tailored to specific business requirements

By Creation Method

• Function Policy
  • Available for CDN and Cloud Security products
  • Controls access to specific functions
  • Works together with control group management to determine which domains users can access
• Expression Policy
  • Available only for the Object Storage product
  • Uses expression syntax to assign specific permissions
  • Does not apply to CDN or Cloud Security products

Control Groups

Control Groups organize acceleration domains and manage user access to these resources.

Purpose and Function

• Manage groups of acceleration domains running through Atomile
• Assign users different access levels for monitoring, billing, and configuration tools
• Supported by CDN and Cloud Security products, such as CA, DWA, MA, Flood Shield, and WAF
• Help manage multiple contracts within the same product

Control Group Types

Predefined – Customer

• Automatically created when a contract and the first user are established
• Includes all domains associated with the customer account
• The name cannot be modified

Predefined – Product

• Automatically generated for each new contract
• Includes all domains associated with a specific contract
• Useful for viewing total traffic under a contract and reconciling it with billing
• The name can be customized by the Main Account

User-Customized Control Groups

• Created by the Main Account
• Can include any combination of domains across multiple contracts
• Provide flexible access management for users associated with your account