文档首页/ 分布式数据库中间件 DDM/ API参考/ 权限和授权项/ 策略授权参考
更新时间：2026-08-21 GMT+08:00
查看PDF
分享

策略授权参考

本章节介绍DDM策略授权场景下支持的策略授权项。

支持的授权项

策略包含系统策略和自定义策略，如果系统策略不满足授权要求，管理员可以创建自定义策略，并通过给用户组授予自定义策略来进行精细的访问控制。策略支持的操作与API相对应，授权项列表说明如下：

  • 权限：允许或拒绝某项操作。
  • 对应API接口：自定义策略实际调用的API接口。
  • 授权项：自定义策略中支持的Action，在自定义策略中的Action中写入授权项，可以实现授权项对应的权限功能。
  • 依赖的授权项：部分Action存在对其他Action的依赖，需要将依赖的Action同时写入授权项，才能实现对应的权限功能。
  • IAM项目(Project)/企业项目(Enterprise Project)：自定义策略的授权范围，包括IAM项目与企业项目。授权范围如果同时支持IAM项目和企业项目，表示此授权项对应的自定义策略，可以在IAM和企业管理两个服务中给用户组授权并生效。如果仅支持IAM项目，不支持企业项目，表示仅能在IAM中给用户组授权并生效，如果在企业管理中授权，则该自定义策略不生效。管理员可以在授权项列表中查看授权项是否支持IAM项目或企业项目，“√”表示支持，“×”表示暂不支持。关于IAM项目与企业项目的区别，详情请参见：IAM与企业管理的区别。

DDM的支持自定义策略授权项如下所示：

表1 实例管理

描述

对应API接口

授权项（Action）

IAM项目

(Project)

企业项目

(Enterprise Project)

创建数据库实例

POST /v1/{project_id}/instances

ddm:instance:create

√

√

查询实例列表

GET /v1/{project_id}/instances?offset={offset}&limit={limit}

ddm:instance:list

√

√

查询实例详情

GET /v1/{project_id}/instances/{instance_id}

ddm:instance:get

√

√

修改实例名称

PUT /v1/{project_id}/instances/{instance_id}/modify-name

ddm:instance:modify

√

√

修改实例安全组

PUT /v1/{project_id}/instances/{instance_id}/modify-security-group

ddm:instance:modify

√

√

删除实例

DELETE /v1/{project_id}/instances/{instance_id}?delete_rds_data=true

ddm:instance:delete

√

√

重启实例

POST /v1/{project_id}/instances/{instance_id}/action

ddm:instance:reboot

√

√

表数据重载

POST /v1/{project_id}/instances/{instance_id}/reload-config

ddm:instance:modify

√

√

实例节点扩容

POST /v2/{project_id}/instances/{instance_id}/action/enlarge

ddm:instance:extendNode

√

√

实例节点缩容

POST /v2/{project_id}/instances/{instance_id}/action/reduce

ddm:instance:extendNode

√

√

修改已关联的数据库实例的读策略

PUT /v2/{project_id}/instances/{instance_id}/action/read-write-strategy

ddm:rds:modifyReadPolicy

√

√

同步DN信息

POST /v1/{project_id}/instances/{instance_id}/rds/sync

ddm:rds:synchro

√

√

查询实例节点列表

GET /v1/{project_id}/instances/{instance_id}/nodes?offset={offset}&limit={limit}

ddm:instance:list

√

√

查询实例节点详情

GET /v1/{project_id}/instances/{instance_id}/nodes/{node_id}

ddm:instance:get

√

√

查询引擎信息

GET /v2/{project_id}/engines?offset={offset}&limit={limit}

ddm:product:list

√

√

查询可用区规格信息

GET /v2/{project_id}/flavors?engine_id={engine_id}&offset={offset}&limit={limit}

ddm:product:list

√

√

变更实例规格

PUT /v3/{project_id}/instances/{instance_id}/flavor

ddm:instance:resize

√

√

获取实例组信息列表

GET /v3/{project_id}/instances/{instance_id}/groups?offset={offset}&limit={limit}

ddm:instance:list

√

√

创建实例组

POST /v3/{project_id}/instances/{instance_id}/groups

ddm:instance:extendNode

√

√

删除实例组

DELETE /v3/{project_id}/instances/{instance_id}/groups/{group_id}

ddm:instance:extendNode

√

√

查询引擎信息V3

GET /v3/{project_id}/engines?offset={offset}&limit={limit}

ddm:product:list

√

√

查询可用区规格信息V3

GET /v3/{project_id}/flavors?engine_id={engine_id}&offset={offset}&limit={limit}&engine_version={engine_version}&available_zones={available_zones}

ddm:product:list

√

√

查询指定实例的参数详情

GET /v3/{project_id}/instances/{instance_id}/configurations?offset={offset}&limit={limit}

ddm:param:list

√

√

修改实例参数V3.1

PUT /v3.1/{project_id}/instances/{instance_id}/configurations

ddm::updateParamGroup

√

√

实例节点扩容V3

POST /v3/{project_id}/instances/{instance_id}/nodes

ddm:instance:extendNode

√

√

删除实例V3

DELETE /v3/{project_id}/instances/{instance_id}

ddm:instance:delete

√

√

设置SSL数据加密V3

POST /v3/{project_id}/instances/{instance_id}/switch-ssl

ddm:instance:modifySsl

√

√

修改实例端口

PUT /v3/{project_id}/instances/{instance_id}/port

ddm:instance:modify

√

√

重启实例V3

POST /v3/{project_id}/instances/{instance_id}/restart

ddm:instance:reboot

√

√

重启节点V3

POST /v3/{project_id}/instances/{instance_id}/nodes/{node_id}/restart

ddm:instance:reboot

√

√

绑定弹性公网IPV3

POST /v3/{project_id}/instances/{instance_id}/eip

ddm:instance:modifyPublicAccess

√

√

解绑弹性公网IPV3

DELETE /v3/{project_id}/instances/{instance_id}/eip

ddm:instance:modifyPublicAccess

√

√

修改实例的ELB IPV3

PUT /v3/{project_id}/instances/{instance_id}/elb/ip

ddm:instance:modify

√

√

删除实例的节点V3

DELETE /v3/{project_id}/instances/{instance_id}/nodes

ddm:instance:extendNode

√

√

批量删除实例的节点V3

POST /v3/{project_id}/instances/{instance_id}/nodes/batch-delete

ddm:instance:extendNode

√

√

查询实例节点详情V3

GET /v3/{project_id}/instances/{instance_id}/nodes/{node_id}

ddm:instance:get

√

√

购买实例V3

POST /v3/{project_id}/instances

ddm:instance:create

√

√

获取实例绑定的弹性公网IP信息V3

GET /v3/{project_id}/instances/{instance_id}/public-ips

ddm:instance:get

√

√

同步数据节点V3

POST /v3/{project_id}/instances/{instance_id}/data-nodes/sync

ddm:rds:synchro

√

√

修改实例名称V3

PUT /v3/{project_id}/instances/{instance_id}/name

ddm:instance:modify

√

√

修改实例安全组V3

PUT /v3/{project_id}/instances/{instance_id}/security-group

ddm:instance:modify

√

√

表数据重载V3

POST /v3/{project_id}/instances/{instance_id}/reload-config

ddm:instance:modify

√

√

RDS连通性检查V3

POST /v3/{project_id}/instances/{instance_id}/rds/connection

ddm:instance:list

√

√

设置实例只读状态

PUT /v3/{project_id}/instances/{instance_id}/readonly-status

ddm:instance:modify

√

√

查询TMLOG信息

GET /v3/{project_id}/instances/{instance_id}/tmlogs

ddm:instance:getTmlogs

√

√

移动TMLOG文件

POST /v3/{project_id}/instances/{instance_id}/tmlogs

ddm:instance:modify

√

√

查询实例详情V3

GET /v3/{project_id}/instances/{instance_id}

ddm:instance:get

√

√

查询实例列表V3

GET /v3/{project_id}/instances

ddm:instance:list

√

√

创建访问控制组V3

POST /v3/{project_id}/instances/{instance_id}/ip-group

ddm:instance:modify

√

√

查询访问控制组V3

GET /v3/{project_id}/instances/{instance_id}/ip-group

ddm:instance:get

√

√
表2 逻辑库管理

描述

对应API接口

授权项（Action）

IAM项目

(Project)

企业项目

(Enterprise Project)

创建逻辑库

POST /v1/{project_id}/instances/{instance_id}/databases

ddm:database:create

√

√

查询逻辑库列表

GET /v1/{project_id}/instances/{instance_id}/databases?offset={offset}&limit={limit}

ddm:database:list

√

√

查询逻辑库详细信息

GET /v1/{project_id}/instances/{instance_id}/databases/{ddm_dbname}

ddm:database:get

√

√

删除逻辑库

DELETE /v1/{project_id}/instances/{instance_id}/databases/{ddm_dbname}?delete_rds_data=true

ddm:database:delete

√

√

查询创建逻辑库可选取的数据库实例列表

GET /v1/{project_id}/instances/{instance_id}/rds?offset={offset}&limit={limit}

ddm:rds:list

√

√

创建逻辑库V3

POST /v3/{project_id}/instances/{instance_id}/databases

ddm:database:create

√

√

删除逻辑库V3

DELETE /v3/{project_id}/instances/{instance_id}/databases/{database_name}

ddm:database:delete

√

√

查询逻辑库详情V3

GET /v3/{project_id}/instances/{instance_id}/databases/{database_name}

ddm:database:get

√

√

导出逻辑库元数据V3

GET /v3/{project_id}/instances/{instance_id}/schema-metadata

ddm:database:get

√

√

导入逻辑库元数据V3

POST /v3/{project_id}/instances/{instance_id}/schema-metadata

ddm:database:create

√

√

查询创建逻辑库可选取的数据节点实例列表V3

GET /v3/{project_id}/instances/{instance_id}/available-data-nodes

ddm:rds:list

√

√

查询分片变更可选取的数据节点实例列表V3

GET /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/available-data-nodes

ddm:rds:list

√

√

分片变更预校验V3

POST /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/precheck

ddm:database:migrate

√

√

查询分片变更预校验异步结果V3

GET /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/precheck/{job_id}

ddm:instance:list

√

√

分片变更V3

POST /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration

ddm:database:migrate

√

√

查询分片变更任务详情V3

GET /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}

ddm:task:list

√

√

取消分片变更V3

PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/cancel

ddm:database:migrate

√

√

回滚分片变更V3

PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/rollback

ddm:database:migrateRollback

√

√

清理分片变更V3

PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/clean

ddm:database:migrate

√

√

重试分片变更V3

PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/retry

ddm:database:migrate

√

√

修改切换路由策略V3

PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/route-switch-strategy

ddm:database:migrate

√

√

切换路由V3

PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/route-switch

ddm:database:migrate

√

√

解绑逻辑库V3

POST /v3/{project_id}/instances/{instance_id}/databases/{logic_db_name}/unbind

ddm:database:unbind

√

√
表3 账号管理

描述

对应API接口

授权项（Action）

IAM项目

(Project)

企业项目

(Enterprise Project)

创建DDM账号

POST /v1/{project_id}/instances/{instance_id}/users

ddm:user:create

√

√

查询DDM账号列表

GET /v1/{project_id}/instances/{instance_id}/users?offset={offset}&limit={limit}

ddm:user:list

√

√

修改DDM账号

PUT /v1/{project_id}/instances/{instance_id}/users/{username}

ddm:user:modify

√

√

删除DDM账号

DELETE /v1/{project_id}/instances/{instance_id}/users/{username}

ddm:user:delete

√

√

重置DDM账号密码

POST /v2/{project_id}/instances/{instance_id}/users/{username}/password

ddm:user:modify

√

√

DDM管理员账号密码管理V3

PUT /v3/{project_id}/instances/{instance_id}/admin-user

ddm:user:modify

√

√

弱密码校验V3

POST /v3/{project_id}/weak-password-verification

ddm:user:list

√

√

创建账号V3

POST /v3/{project_id}/instances/{instance_id}/users

ddm:user:create

√

√

查询账号列表V3

GET /v3/{project_id}/instances/{instance_id}/users

ddm:user:list

√

√

修改账号V3

PUT /v3/{project_id}/instances/{instance_id}/users/{username}

ddm:user:modify

√

√

删除账号V3

DELETE /v3/{project_id}/instances/{instance_id}/users/{username}

ddm:user:delete

√

√

重置账号密码V3

POST /v3/{project_id}/instances/{instance_id}/users/{username}/password

ddm:user:modify

√

√
表4 任务管理

描述

对应API接口

授权项（Action）

IAM项目

(Project)

企业项目

(Enterprise Project)

获取任务信息

GET /v1/{project_id}/jobs/{job_id}

ddm:task:list

√

√

获取指定ID的任务信息

GET /v3/{project_id}/jobs/{job_id}

ddm:task:get

√

√

查询任务列表V3

GET /v3/{project_id}/jobs

ddm:task:list

√

√
表5 监控管理

描述

对应API接口

授权项（Action）

IAM项目

(Project)

企业项目

(Enterprise Project)

慢日志监控

GET /v2/{project_id}/instances/{instance_id}/slowlog?curPage={curPage}&perPage={perPage}&startDate={startDate}&endDate={endDate}

ddm:instance:listSlowSqlInfo

√

√
表6 会话管理

描述

对应API接口

授权项（Action）

IAM项目

(Project)

企业项目

(Enterprise Project)

查询逻辑会话列表V3

GET /v3/{project_id}/instances/{instance_id}/logical-processes?offset={offset}&limit={limit}

ddm:instance:queryProcessList

√

√

kill逻辑会话V3

DELETE /v3/{project_id}/instances/{instance_id}/logical-processes

ddm:instance:killProcessList

√

√

查询物理会话列表V3

GET /v3/{project_id}/instances/{instance_id}/physical-processes?offset={offset}&limit={limit}

ddm:instance:queryProcessList

√

√

kill物理会话V3

DELETE /v3/{project_id}/instances/{instance_id}/physical-processes

ddm:instance:killProcessList

√

√

查询kill会话审计日志V3

GET /v3/{project_id}/instances/{instance_id}/processes-audit-log?offset={offset}&limit={limit}&start_time={start_time}&end_time={end_time}

ddm:instance:queryProcessList

√

√
表7 版本管理

描述

对应API接口

授权项（Action）

IAM项目

(Project)

企业项目

(Enterprise Project)

查询DDM可变更内核版本V3

GET /v3/{project_id}/instances/{instance_id}/database-version/available-versions

ddm:instance:get

√

√

变更DDM内核版本V3

POST /v3/{project_id}/instances/{instance_id}/database-version/change-version

ddm:instance:changeVersion

√

√

回滚DDM内核版本V3

POST /v3/{project_id}/instances/{instance_id}/database-version/rollback-version

ddm:instance:changeVersion

√

√

DDM内核版本风险提醒V3

GET /v3/{project_id}/instances/{instance_id}/show-risk-info

ddm:instance:get

√

√
表8 备份管理

描述

对应API接口

授权项（Action）

IAM项目

(Project)

企业项目

(Enterprise Project)

获取备份列表

GET /v3/{project_id}/backups

ddm:backup:list

√

√

删除备份

DELETE /v3/{project_id}/backups/{backup_id}

ddm:backup:delete

√

√

查询备份详情V3

GET /v3/{project_id}/instances/{instance_id}/backups/{backup_id}

ddm:backup:get

√

√

查询实例在恢复时间点关联的数据节点V3

GET /v3/{project_id}/instances/{instance_id}/backups/related-dn

ddm:backup:get

√

√

查询可恢复时间段V3

GET /v3/{project_id}/instances/{instance_id}/backups/restorable-time-interval

ddm:backup:get

√

√

查询可用于时间点恢复的数据节点列表V3

GET /v3/{project_id}/instances/{instance_id}/backups/restorable-data-node

ddm:rds:list

√

√

查询可用于恢复的实例列表V3

GET /v3/{project_id}/instances/{instance_id}/backups/restorable-instances

ddm:instance:list

√

√

元数据恢复V3

POST /v3/{project_id}/instances/{instance_id}/backups/metadata-recovery

ddm:backup:restore

√

√

恢复到新实例V3

POST /v3/{project_id}/instances/{instance_id}/backups/recovery

ddm:backup:restore

√

√
表9 参数管理

描述

对应API接口

授权项（Action）

IAM项目

(Project)

企业项目

(Enterprise Project)

获取参数模板列表

GET /v3/{project_id}/configurations

ddm:param:list

√

√

获取指定参数模板的参数

GET /v3/{project_id}/configurations/{config_id}

ddm:param:list

√

√

创建参数组V3

POST /v3/{project_id}/configurations

ddm:param:create

√

√

删除参数组V3

DELETE /v3/{project_id}/configurations/{config_id}

ddm:param:delete

√

√

查询参数组应用记录V3

GET /v3/{project_id}/configurations/{config_id}/apply-histories

ddm:param:list

√

√

复制参数组V3

POST /v3/{project_id}/configurations/{config_id}/copy

ddm:param:create

√

√

更新参数组V3

PUT /v3/{project_id}/configurations/{config_id}

ddm:param:update

√

√

查询参数组可应用的实例列表V3

GET /v3/{project_id}/configurations/{config_id}/query-instances

ddm:instance:list

√

√

比较参数组V3

PUT /v3/{project_id}/configurations/diff

ddm:param:list

√

√
父主题： 权限和授权项

相关文档