Permissions Management

If you need to assign different permissions to employees in your enterprise to access your DDS resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your resources.

With IAM, you can use your account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use DDS resources but must not delete them or perform any high-risk operations. To achieve this result, you can create IAM users for the software developers and grant them only the permissions required for using DDS resources.

If your account does not need individual IAM users for permissions management, you may skip over this topic.

IAM can be used free of charge. You pay only for the resources in your account.

DDS Permissions

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

DDS is a project-level service deployed and accessed in specific physical regions. To assign DDS permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing DDS, users need to switch to a region where they have been authorized to use DDS.

You can grant users permissions by using roles and policies.

  • Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. This mechanism provides only a limited number of service-level roles for authorization. When using roles to grant permissions, you need to also assign other roles on which the permissions depend to take effect. However, roles are not an ideal choice for fine-grained authorization and secure access control.

  • Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, you can grant DDS users only the permissions for managing a certain type of resources.

Table 1 lists all the system-defined roles and policies supported by DDS.

Table 1 System-defined roles and policies supported by DDS

Policy Name/System Role

Description

Type

Dependency

DDS FullAccess

All operations on DDS.

System-defined policy

None

DDS ReadOnlyAccess

Read-only permissions for DDS resources. Users granted these permissions can only view DDS data.

System-defined policy

None

DDS ManageAccess

DBA permissions on DDS except the DDS DB instance deletion operations.

System-defined policy

None

DDS Administrator

DDS administrator, who has all permissions of the service.

System-defined role

The Tenant Guest and Tenant Administrator roles need to be assigned in the same project.

Table 2 lists the common operations supported by each system-defined policy or role of DDS. Select the policies or roles as required.

Table 2 Common operations supported by the DDS system policy

Operation

DDS FullAccess

DDS ReadOnlyAccess

DDS ManageAccess

DDS Administrator

Creating an instance

Y

x

Y

Y

Querying DB instances

Y

Y

Y

Y

Deleting a DB instance

Y

x

x

Y

Restarting a DB instance

Y

x

Y

Y

Performing a primary/secondary switchover

Y

x

Y

Y

Modifying the port

Y

x

Y

Y

Resetting a password

Y

x

Y

Y

Modified SSL

Y

x

Y

Y

Modifying a security group

Y

x

Y

Y

Binding and unbinding an EIP

Y

x

Y

Y

Scaling up storage space

Y

x

Y

Y

Changing DB instance classes

Y

x

Y

Y

Adding nodes

Y

x

Y

Y

Deleting the node that fails to be added

Y

x

x

Y

Modifying an automated backup policy

Y

x

Y

Y

Renaming a DB instance

Y

x

Y

Y

Changing a private IP address

Y

x

Y

Y

Changing the parameter template associated with the node in a DB instance

Y

x

Y

Y

Showing original slow logs

Y

x

Y

Y

Enabling or disabling local log auditing

Y

x

Y

Y

Downloading audit logs

Y

x

Y

Y

Deleting audit logs

Y

x

x

Y

Downloading a backup file

Y

x

Y

Y

Creating a manual backup

Y

x

Y

Y

Querying the backup list

Y

Y

Y

Y

Restoring data to a new DB instance

Y

x

Y

Y

Restoring to an existing DB instance

Y

x

Y

Y

Deleting a backup

Y

x

x

Y

Creating a parameter template

Y

x

Y

Y

Viewing parameter templates

Y

Y

Y

Y

Modifying a parameter template

Y

x

Y

Y

Deleting a parameter template

Y

x

x

Y

Task Center list

Y

x

Y

Y

Table 3 lists common DDS operations and corresponding actions. You can refer to this table to customize permission policies.

Table 3 Common Operations and actions

Operation

Actions

Description

Instance creation page

  • vpc:vpcs:list

  • vpc:subnets:get

  • vpc:securityGroups:get

The VPC, subnet, and security group are displayed on the instance creation page.

Creating an instance

  • dds:instance:create

  • vpc:vpcs:list

  • vpc:vpcs:get

  • vpc:subnets:get

  • vpc:securityGroups:get

  • vpc:ports:get

If the default VPC, subnet, and security group are used, the vpc:*:create permission must be configured.

To create an encrypted instance, configure the KMS Administrator permission for the project.

Querying DB instances

dds:instance:list

-

Querying details of a DB instance

dds:instance:list

If the VPC, subnet, and security group need to be displayed on the instance details page, add the vpc:*:get and vpc:*:list actions.

Exporting DB instance lists

dds:instance:list

If the VPC, subnet, and security group are required, add the vpc:*:get and vpc:*:list actions.

Deleting a DB instance

dds:instance:deleteInstance

When deleting a DB instance, delete the IP address on the data side.

Restarting a DB instance

dds:instance:reboot

-

Performing a primary/secondary switchover

dds:instance:switchover

-

Changing a port

dds:instance:modifyPort

-

Resetting a password

dds:instance:resetPasswd

-

Modified SSL

dds:instance:modifySSL

-

Modifying a security group

dds:instance:modifySecurityGroup

-

Binding an EIP

dds:instance:bindPublicIp

When binding an EIP, you need to query the created EIP.

  • Enterprise projects are not supported.

  • Fine-grained authentication is not supported.

Unbinding an EIP

dds:instance:unbindPublicIp

  • Enterprise projects are not supported.

  • Fine-grained authentication is not supported.

Scaling up storage space

dds:instance:extendVolume

-

Changing DB instance classes

dds:instance:modifySpec

-

Adding nodes

  • dds:instance:extendNode

  • vpc:vpcs:list

  • vpc:vpcs:get

  • vpc:subnets:get

  • vpc:securityGroups:get

  • vpc:ports:get

-

Deleting the node that fails to be added

dds:instance:extendNode

If the IP address has been created but the subsequent procedure fails, delete the IP address on the data side.

Modifying an automated backup policy

dds:instance:modifyBackupPolicy

-

Renaming a DB instance

dds:instance:modify

-

Changing a private IP address

  • dds:instance:modifyVIP

  • vpc:subnets:get

  • vpc:ports:get

Before changing the private IP address, query available IP addresses.

Changing the parameter template associated with the node in a DB instance

dds:instance:modifyParameter

-

Showing original slow logs

dds:instance:modifySlowLogPlaintextSwitch

-

Enabling or disabling local log auditing

dds:instances:modifyAuditLogSwitch

-

Downloading audit logs

dds:instances:downloadAuditLog

-

Deleting audit logs

dds:instance:deleteAuditLog

-

Downloading a backup file

dds:backup:download

-

Creating a Manual Backup

dds:instance:createManualBackup

-

Querying the backup list

dds:backup:list

-

Restoring data to a new DB instance

  • dds:backup:createInstanceFromBackup

  • vpc:vpcs:list

  • vpc:vpcs:get

  • vpc:subnets:get

  • vpc:securityGroups:get

  • vpc:ports:get

The KMS Administrator permission needs to be configured for the encrypted instance in the project.

Restoring to an existing DB instance

dds:backup:refreshInstanceFromBackup

-

Deleting a backup

dds:backup:delete

-

Creating a parameter template

dds:param:create

-

Viewing parameter templates

dds:param:list

-

Modifying a parameter template

dds:param:modify

-

Deleting a parameter template

dds:param:delete

-

Task Center list

dds:task:list

-

last updated: 2024-11-13 14:59 UTC - commit: bf3b4fe264bcd410b2d0775e8a38d9b50d2e688e