# 策略授权参考
本章节介绍DAS策略授权场景下支持的策略授权项。
#### 支持的授权项
策略包含系统策略和自定义策略，如果系统策略不满足授权要求，管理员可以创建自定义策略，并通过给用户组授予自定义策略来进行精细的访问控制。策略支持的操作与API相对应，授权项列表说明如下：
- 权限：允许或拒绝某项操作。
- 对应API接口：自定义策略实际调用的API接口。
- 授权项：自定义策略中支持的Action，在自定义策略中的Action中写入授权项，可以实现授权项对应的权限功能。
- 依赖的授权项：部分Action存在对其他Action的依赖，需要将依赖的Action同时写入授权项，才能实现对应的权限功能。
- IAM项目(Project)/企业项目(Enterprise Project)：自定义策略的授权范围，包括IAM项目与企业项目。授权范围如果同时支持IAM项目和企业项目，表示此授权项对应的自定义策略，可以在IAM和企业管理两个服务中给用户组授权并生效。如果仅支持IAM项目，不支持企业项目，表示仅能在IAM中给用户组授权并生效，如果在企业管理中授权，则该自定义策略不生效。管理员可以在授权项列表中查看授权项是否支持IAM项目或企业项目，"√"表示支持，"×"表示暂不支持。关于IAM项目与企业项目的区别，详情请参见：[IAM与企业管理的区别](https://support.huaweicloud.com/iam_faq/iam_01_0101.html)。
DAS的支持自定义策略授权项如下所示：
表1云DBA 
| 权限                | 对接API接口                                                                                 | 授权项(Action)                             | IAM项目(Project) | 企业项目(Enterprise Project) |
|:---|:---|:---|:---|:---|
| 查询数据库用户列表         | GET /v3/{project_id}/instances/{instance_id}/db-users                                   | das:clouddba:listDbUser                 | √              | x                        |
| 注册数据库用户           | POST /v3/{project_id}/instances/{instance_id}/db-users                                  | das:clouddba:registerDbUser             | √              | x                        |
| 查询数据库用户信息         | GET /v3/{project_id}/instances/{instance_id}/db-users/{db_user_id}                      | das:clouddba:getDbUser                  | √              | x                        |
| 修改数据库用户           | PUT /v3/{project_id}/instances/{instance_id}/db-users/{db_user_id}                      | das:clouddba:modifyDbUser               | √              | x                        |
| 删除数据库用户           | DELETE /v3/{project_id}/instances/{instance_id}/db-users/{db_user_id}                   | das:clouddba:deleteDbUser               | √              | x                        |
| 查询SQL执行计划         | GET /v3/{project_id}/instances/{instance_id}/sql/explain                                | das:clouddba:showSqlExecutionPlan       | √              | x                        |
| 查询SQL执行计划         | POST /v3/{project_id}/instances/{instance_id}/sql/explain                               | das:clouddba:showSqlExecutionPlan       | √              | x                        |
| 查询实例会话列表          | GET /v3/{project_id}/instances/{instance_id}/processes                                  | das::showCloudDBAInfo                   | √              | x                        |
| 查杀会话              | DELETE /v3/{project_id}/instances/{instance_id}/process                                 | das:clouddba:deleteProcess              | √              | ×                        |
| 查询元数据锁列表          | GET /v3/{project_id}/instances/{instance_id}/metadata-locks                             | das:clouddba:listMetadataLock           | √              | ×                        |
| 查询InnoDB锁等待列表     | GET /v3/{project_id}/instances/{instance_id}/innodb-locks                               | das:clouddba:listInnodbLock             | √              | ×                        |
| 导出慢SQL数据          | GET /v3/{project_id}/instances/{instance_id}/slow-query-logs                            | das:clouddba:slowSqlExport              | √              | ×                        |
| 导出全量SQL           | GET /v3/{project_id}/instances/{instance_id}/sql-statements                             | das:clouddba:fullSqlExport              | √              | ×                        |
| 查询SQL洞察任务列表       | GET /v3/{project_id}/instances/{instance_id}/full-sql-tasks                             | das:clouddba:listFullSql                | √              | ×                        |
| 导出全量SQL明细         | GET /v3/{project_id}/instances/{instance_id}/full-sql-search                            | das:clouddba:listFullSql                | √              | ×                        |
| 查询全量SQL和慢SQL的开关状态 | GET /v3/{project_id}/instances/{instance_id}/sql/switch                                 | das:clouddba:showSqlSwitchStatus        | √              | ×                        |
| 开启/关闭全量SQL、慢SQL开关 | POST /v3/{project_id}/instances/{instance_id}/sql/switch                                | das:clouddba:changeSqlSwitch            | √              | ×                        |
| 查询历史事务开关          | GET /v3/{project_id}/instances/{instance_id}/transaction/switch                         | das::showCloudDBAInfo                   | √              | ×                        |
| 开启/关闭历史事务开关       | POST /v3/{project_id}/instances/{instance_id}/transaction/switch                        | das:clouddba:changeTransactionSwitch    | √              | ×                        |
| 查询历史事务列表          | GET /v3/{project_id}/instances/{instance_id}/transaction                                | das::showCloudDBAInfo                   | √              | ×                        |
| 获取空间分析数据列表        | GET /v3/{project_id}/instances/{instance_id}/space-analysis                             | das:clouddba:listSpaceAnalysis          | √              | ×                        |
| 创建空间分析任务          | POST /v3/{project_id}/instances/{instance_id}/space-analysis                            | das:clouddba:createSpaceAnalysisTask    | √              | ×                        |
| 查看SQL限流开关状态       | GET /v3/{project_id}/instances/{instance_id}/sql-limit/switch                           | das:clouddba:showSqlLimitSwitchStatus   | √              | ×                        |
| 设置SQL限流开关状态       | POST /v3/{project_id}/instances/{instance_id}/sql-limit/switch                          | das:clouddba:changeSqlLimitSwitchStatus | √              | ×                        |
| 查询SQL限流任务         | GET /v3/{project_id}/instances/{instance_id}/sql-limit/job                              | das:clouddba:showSqlLimitJobInfo        | √              | ×                        |
| 查询SQL限流规则列表       | GET /v3/{project_id}/instances/{instance_id}/sql-limit/rules                            | das:clouddba:listSqlLimitRules          | √              | ×                        |
| 创建SQL限流规则         | POST /v3/{project_id}/instances/{instance_id}/sql-limit/rules                           | das:clouddba:createSqlLimitRules        | √              | ×                        |
| 删除SQL限流规则         | DELETE /v3/{project_id}/instances/{instance_id}/sql-limit/rules                         | das:clouddba:deleteSqlLimitRules        | √              | ×                        |
| 修改SQL限流规则         | PUT /v3/{project_id}/instances/{instance_id}/sql-limit/rules                            | das:clouddba:updateSqlLimitRules        | √              | ×                        |
| 根据原始SQL生成SQL限流关键字 | POST /v3/{project_id}/instances/{instance_id}/sql-limit/parse                           | das:clouddba:createSqlLimitRules        | √              | ×                        |
| 查询云DBA配额          | GET /v3/{project_id}/quotas                                                             | das::showQuotas                         | √              | ×                        |
| 导出TopSQL模板列表      | GET /v3/{project_id}/instances/{instance_id}/top-sql-templates                          | das:clouddba:listTopSql                 | √              | ×                        |
| 导出SQL执行耗时区间数据     | GET /v3/{project_id}/instances/{instance_id}/top-sql-trend                              | das:clouddba:listTopSql                 | √              | ×                        |
| 导出慢SQL模板列表        | GET /v3/{project_id}/instances/{instance_id}/slow-sql-templates                         | das:clouddba:slowSqlExport              | √              | ×                        |
| 导出慢SQL数量趋势        | GET /v3/{project_id}/instances/{instance_id}/slow-sql-trend                             | das:clouddba:slowSqlExport              | √              | ×                        |
| 导出慢SQL统计数据        | POST /v3/{project_id}/instances/{instance_id}/slow-sql-statistics                       | das::showCloudDBAInfo                   | √              | ×                        |
| 执行SQL诊断           | POST /v3/{project_id}/connections/{connection_id}/tuning/create-tuning                  | das:clouddba:sqlDiagnosis               | √              | ×                        |
| 获取诊断结果            | GET /v3/{project_id}/connections/{connection_id}/tuning/{message_id}/show-tuning-result | das:clouddba:sqlDiagnosis               | √              | ×                        |
| 导出TOP风险实例列表       | GET /v3/{project_id}/instances/top-risk                                                 | das::showCloudDBAInfo                   | √              | ×                        |
| 查询资源风险实例风险趋势      | GET /v3/{project_id}/instances/risk-trend                                               | das::showCloudDBAInfo                   | √              | ×                        |
| 查询实例分布情况          | GET /v3/{project_id}/instances/distribution                                             | das::showCloudDBAInfo                   | √              | ×                        |
| 查询TOP慢SQL列表       | GET /v3/{project_id}/instances/top-slow-log                                             | das::showCloudDBAInfo                   | √              | ×                        |
| 查询实例的TOP慢SQL列表    | GET /v3/{project_id}/instances/{instance_id}/top-slow-log                               | das::showCloudDBAInfo                   | √              | ×                        |
| 多节点单指标支持指标信息      | GET /v3/{project_id}/metric-names/support                                               | das::showCloudDBAInfo                   | √              | ×                        |
| 获取单个实例节点信息        | GET /v3/{project_id}/instance/nodes-info                                                | das::showCloudDBAInfo                   | √              | ×                        |
| 获取多节点单指标数据        | POST /v3/{project_id}/multi-nodes/single-metric                                         | das::showCloudDBAInfo                   | √              | ×                        |
| 查询资源风险实例风险项       | GET /v3/{project_id}/get-risk-items                                                     | das::showCloudDBAInfo                   | √              | ×                        |
| 设置指标阈值            | POST /v3/{project_id}/set-metric-threshold                                              | das::setMetricThreshold                 | √              | ×                        |
| 获取DAS云DBA实例列表     | GET /v3/{project_id}/instances                                                          | das::listInstances                      | √              | ×                        |
| 创建实例健康诊断任务        | POST /v3/{project_id}/instances/{instance_id}/create-instance-health-report-task        | das:clouddba:dailyReportsSubscribe      | √              | ×                        |
| 查询实例健康诊断报告列表      | GET /v3/{project_id}/instances/{instance_id}/get-instance-health-report-task-list       | das:clouddba:listDailyReports           | √              | ×                        |
| 获取实例健康诊断报告内容      | GET /v3/{project_id}/instances/{instance_id}/get-instance-health-report                 | das:clouddba:listDailyReports           | √              | ×                        |
| 同步实例列表            | POST /v3/{project_id}/instances/synchronize-instance-list                               | das::showCloudDBAInfo                   | √              | ×                        |
| 设置付费模式            | POST /v3/{project_id}/cloud-dba/change-payment-mode                                     | das:clouddba:changePaymentMode          | √              | ×                        |
| 创建全量SQL明细解析任务     | POST /v3/{project_id}/instances/{instance_id}/full-sql/add-task                         | das:clouddba:listFullSql                | √              | ×                        |
| 内置账号登录            | POST /v3/{project_id}/instances/{instance_id}/login-built-in-account                    | das:clouddba:builtInAccountlogin        | √              | ×                        |
| 内置账号登出            | POST /v3/{project_id}/instances/{instance_id}/logoff-built-in-account                   | das:clouddba:builtInAccountlogoff       | √              | ×                        |
| 创建导出历史事务任务        | POST /v3/{project_id}/transaction/{instance_id}/create-export-task                      | das::showCloudDBAInfo                   | √              | ×                        |
| 删除导出历史事务任务        | POST /v3/{project_id}/transaction/{instance_id}/delete-export-task                      | das::showCloudDBAInfo                   | √              | ×                        |
| 查询历史事务导出任务列表      | GET /v3/{project_id}/transaction/{instance_id}/get-export-task-list                     | das::showCloudDBAInfo                   | √              | ×                        |
| 查询历史事务导出任务详情      | GET /v3/{project_id}/transaction/{instance_id}/get-export-task-info                     | das::showCloudDBAInfo                   | √              | ×                        |
   
表2开发工具 
| 权限       | 对应API接口                                                         | 授权项(Action)                           | IAM项目(Project) | 企业项目(Enterprise Project) |
|:---|:---|:---|:---|:---|
| 设置共享链接   | POST /v3/{project_id}/connections/share                         | das:connection:createShareConnections | √              | x                        |
| 删除共享链接   | DELETE /v3/{project_id}/connections/share                       | das:connection:cancelShareConnections | √              | x                        |
| 创建实例连接   | POST /v3/{project_id}/instances/{instance_id}/create-connection | das:instance:createConnection         | √              | x                        |
| 查询实例连接列表 | GET /v3/{project_id}/list-connections                           | das::showCloudDBAInfo                 | √              | x                        |
   
![](https://support.huaweicloud.com/api-das/public_sys-resources/note_3.0-zh-cn.png)
"√"表示支持，"x"表示暂不支持。