What are primary accounts, sub-accounts, and IAM accounts?

The primary account is the account to which resources belong and also the basic entity for resource usage metering and billing. It generally corresponds to the top-level management identity of an enterprise or organization. 

 A sub-account is an account created by the primary account, used for managing the affiliated organization. Each sub-account has its own independent resources and quotas, achieving resource isolation between tenants. A sub-account itself is also a "tenant" and, like the primary account, can log in to the user console, create and manage IAM users and projects within its account, and perform resource operations. 

 An IAM account is a user created by a primary account or sub-account (i.e., tenant account) in IAM (Unified Identity Authentication Service) on the user console, serving as the actual user of cloud services. It implements rights separation within an account. A tenant can create multiple IAM users and assign them to different employees or systems to avoid sharing the primary account password.