Creating an Agency (by a Delegating Party)

Prerequisites

Before creating an agency, complete the following operations:

• Understand the basic concepts of permissions.
• Determine the system permissions to be assigned to the agency, and check whether the permissions have dependencies. For more details, see Assigning Dependency Roles.

Procedure

1. Log in to the IAM console.
2. On the IAM console, choose Agencies from the navigation pane, and click Create Agency in the upper right corner.
3. Enter an agency name.
4. Specify the agency type as Account, and enter the name of an account.
   

   • Account: Share resources with another account or delegate an individual or team to manage your resources. You can specify the delegated account only as another account, and you cannot specify it as a federated user or IAM user.
   • Cloud service: Delegate a specific service to access other services. For more information, see Cloud Service Delegation.

5. Set the validity period and enter a description for the agency.
6. Click Assign Permissions, select the permissions you want to grant to the agency, and click OK.
   

   • Assigning permissions to an agency is similar to assigning permissions to a user group. The two operations differ only in the number of available permissions. For details about how to assign permissions to a user group, see Assigning Permissions to a User Group.
   • Agencies cannot be assigned the Security Administrator role. For account security, grant only the permissions required to agencies according to your business requirements.

7. Click OK.
   

   After creating an agency, provide your account name, agency name, agency ID, and agency permissions to the delegated party. The delegated party can then switch the role to your account and manage specific resources based on the assigned permissions.