# 策略授权参考
本章节介绍DDM策略授权场景下支持的策略授权项。
#### 支持的授权项
策略包含系统策略和自定义策略，如果系统策略不满足授权要求，管理员可以创建自定义策略，并通过给用户组授予自定义策略来进行精细的访问控制。策略支持的操作与API相对应，授权项列表说明如下：
- 权限：允许或拒绝某项操作。
- 对应API接口：自定义策略实际调用的API接口。
- 授权项：自定义策略中支持的Action，在自定义策略中的Action中写入授权项，可以实现授权项对应的权限功能。
- 依赖的授权项：部分Action存在对其他Action的依赖，需要将依赖的Action同时写入授权项，才能实现对应的权限功能。
- IAM项目(Project)/企业项目(Enterprise Project)：自定义策略的授权范围，包括IAM项目与企业项目。授权范围如果同时支持IAM项目和企业项目，表示此授权项对应的自定义策略，可以在IAM和企业管理两个服务中给用户组授权并生效。如果仅支持IAM项目，不支持企业项目，表示仅能在IAM中给用户组授权并生效，如果在企业管理中授权，则该自定义策略不生效。管理员可以在授权项列表中查看授权项是否支持IAM项目或企业项目，"√"表示支持，"×"表示暂不支持。关于IAM项目与企业项目的区别，详情请参见：[IAM与企业管理的区别](https://support.huaweicloud.com/iam_faq/iam_01_0101.html)。
DDM的支持自定义策略授权项如下所示：
表1实例管理 
| 描述                | 对应API接口                                                                                                                                                | 授权项（Action）                     | **IAM**项目 (Project) | 企业项目 (Enterprise Project) |
|:---|:---|:---|:---|:---|
| 创建数据库实例           | POST /v1/{project_id}/instances                                                                                                                        | ddm:instance:create             | √                                                                                  | √                                                          |
| 查询实例列表            | GET /v1/{project_id}/instances?offset={offset}\&limit={limit}                                                                                          | ddm:instance:list               | √                                                                                  | √                                                          |
| 查询实例详情            | GET /v1/{project_id}/instances/{instance_id}                                                                                                           | ddm:instance:get                | √                                                                                  | √                                                          |
| 修改实例名称            | PUT /v1/{project_id}/instances/{instance_id}/modify-name                                                                                               | ddm:instance:modify             | √                                                                                  | √                                                          |
| 修改实例安全组           | PUT /v1/{project_id}/instances/{instance_id}/modify-security-group                                                                                     | ddm:instance:modify             | √                                                                                  | √                                                          |
| 删除实例              | DELETE /v1/{project_id}/instances/{instance_id}?delete_rds_data=true                                                                                   | ddm:instance:delete             | √                                                                                  | √                                                          |
| 重启实例              | POST /v1/{project_id}/instances/{instance_id}/action                                                                                                   | ddm:instance:reboot             | √                                                                                  | √                                                          |
| 表数据重载             | POST /v1/{project_id}/instances/{instance_id}/reload-config                                                                                            | ddm:instance:modify             | √                                                                                  | √                                                          |
| 实例节点扩容            | POST /v2/{project_id}/instances/{instance_id}/action/enlarge                                                                                           | ddm:instance:extendNode         | √                                                                                  | √                                                          |
| 实例节点缩容            | POST /v2/{project_id}/instances/{instance_id}/action/reduce                                                                                            | ddm:instance:extendNode         | √                                                                                  | √                                                          |
| 修改已关联的数据库实例的读策略   | PUT /v2/{project_id}/instances/{instance_id}/action/read-write-strategy                                                                                | ddm:rds:modifyReadPolicy        | √                                                                                  | √                                                          |
| 同步DN信息            | POST /v1/{project_id}/instances/{instance_id}/rds/sync                                                                                                 | ddm:rds:synchro                 | √                                                                                  | √                                                          |
| 查询实例节点列表          | GET /v1/{project_id}/instances/{instance_id}/nodes?offset={offset}\&limit={limit}                                                                      | ddm:instance:list               | √                                                                                  | √                                                          |
| 查询实例节点详情          | GET /v1/{project_id}/instances/{instance_id}/nodes/{node_id}                                                                                           | ddm:instance:get                | √                                                                                  | √                                                          |
| 查询引擎信息            | GET /v2/{project_id}/engines?offset={offset}\&limit={limit}                                                                                            | ddm:product:list                | √                                                                                  | √                                                          |
| 查询可用区规格信息         | GET /v2/{project_id}/flavors?engine_id={engine_id}\&offset={offset}\&limit={limit}                                                                     | ddm:product:list                | √                                                                                  | √                                                          |
| 变更实例规格            | PUT /v3/{project_id}/instances/{instance_id}/flavor                                                                                                    | ddm:instance:resize             | √                                                                                  | √                                                          |
| 获取实例组信息列表         | GET /v3/{project_id}/instances/{instance_id}/groups?offset={offset}\&limit={limit}                                                                     | ddm:instance:list               | √                                                                                  | √                                                          |
| 创建实例组             | POST /v3/{project_id}/instances/{instance_id}/groups                                                                                                   | ddm:instance:extendNode         | √                                                                                  | √                                                          |
| 删除实例组             | DELETE /v3/{project_id}/instances/{instance_id}/groups/{group_id}                                                                                      | ddm:instance:extendNode         | √                                                                                  | √                                                          |
| 查询引擎信息V3          | GET /v3/{project_id}/engines?offset={offset}\&limit={limit}                                                                                            | ddm:product:list                | √                                                                                  | √                                                          |
| 查询可用区规格信息V3       | GET /v3/{project_id}/flavors?engine_id={engine_id}\&offset={offset}\&limit={limit}\&engine_version={engine_version}\&available_zones={available_zones} | ddm:product:list                | √                                                                                  | √                                                          |
| 查询指定实例的参数详情       | GET /v3/{project_id}/instances/{instance_id}/configurations?offset={offset}\&limit={limit}                                                             | ddm:param:list                  | √                                                                                  | √                                                          |
| 修改实例参数V3.1        | PUT /v3.1/{project_id}/instances/{instance_id}/configurations                                                                                          | ddm::updateParamGroup           | √                                                                                  | √                                                          |
| 实例节点扩容V3          | POST /v3/{project_id}/instances/{instance_id}/nodes                                                                                                    | ddm:instance:extendNode         | √                                                                                  | √                                                          |
| 删除实例V3            | DELETE /v3/{project_id}/instances/{instance_id}                                                                                                        | ddm:instance:delete             | √                                                                                  | √                                                          |
| 设置SSL数据加密V3       | POST /v3/{project_id}/instances/{instance_id}/switch-ssl                                                                                               | ddm:instance:modifySsl          | √                                                                                  | √                                                          |
| 修改实例端口            | PUT /v3/{project_id}/instances/{instance_id}/port                                                                                                      | ddm:instance:modify             | √                                                                                  | √                                                          |
| 重启实例V3            | POST /v3/{project_id}/instances/{instance_id}/restart                                                                                                  | ddm:instance:reboot             | √                                                                                  | √                                                          |
| 重启节点V3            | POST /v3/{project_id}/instances/{instance_id}/nodes/{node_id}/restart                                                                                  | ddm:instance:reboot             | √                                                                                  | √                                                          |
| 绑定弹性公网IPV3        | POST /v3/{project_id}/instances/{instance_id}/eip                                                                                                      | ddm:instance:modifyPublicAccess | √                                                                                  | √                                                          |
| 解绑弹性公网IPV3        | DELETE /v3/{project_id}/instances/{instance_id}/eip                                                                                                    | ddm:instance:modifyPublicAccess | √                                                                                  | √                                                          |
| 修改实例的ELB IPV3     | PUT /v3/{project_id}/instances/{instance_id}/elb/ip                                                                                                    | ddm:instance:modify             | √                                                                                  | √                                                          |
| 删除实例的节点V3         | DELETE /v3/{project_id}/instances/{instance_id}/nodes                                                                                                  | ddm:instance:extendNode         | √                                                                                  | √                                                          |
| 批量删除实例的节点V3       | POST /v3/{project_id}/instances/{instance_id}/nodes/batch-delete                                                                                       | ddm:instance:extendNode         | √                                                                                  | √                                                          |
| 查询实例节点详情V3        | GET /v3/{project_id}/instances/{instance_id}/nodes/{node_id}                                                                                           | ddm:instance:get                | √                                                                                  | √                                                          |
| 购买实例V3            | POST /v3/{project_id}/instances                                                                                                                        | ddm:instance:create             | √                                                                                  | √                                                          |
| 获取实例绑定的弹性公网IP信息V3 | GET /v3/{project_id}/instances/{instance_id}/public-ips                                                                                                | ddm:instance:get                | √                                                                                  | √                                                          |
| 同步数据节点V3          | POST /v3/{project_id}/instances/{instance_id}/data-nodes/sync                                                                                          | ddm:rds:synchro                 | √                                                                                  | √                                                          |
| 修改实例名称V3          | PUT /v3/{project_id}/instances/{instance_id}/name                                                                                                      | ddm:instance:modify             | √                                                                                  | √                                                          |
| 修改实例安全组V3         | PUT /v3/{project_id}/instances/{instance_id}/security-group                                                                                            | ddm:instance:modify             | √                                                                                  | √                                                          |
| 表数据重载V3           | POST /v3/{project_id}/instances/{instance_id}/reload-config                                                                                            | ddm:instance:modify             | √                                                                                  | √                                                          |
| RDS连通性检查V3        | POST /v3/{project_id}/instances/{instance_id}/rds/connection                                                                                           | ddm:instance:list               | √                                                                                  | √                                                          |
| 设置实例只读状态          | PUT /v3/{project_id}/instances/{instance_id}/readonly-status                                                                                           | ddm:instance:modify             | √                                                                                  | √                                                          |
| 查询TMLOG信息         | GET /v3/{project_id}/instances/{instance_id}/tmlogs                                                                                                    | ddm:instance:getTmlogs          | √                                                                                  | √                                                          |
| 移动TMLOG文件         | POST /v3/{project_id}/instances/{instance_id}/tmlogs                                                                                                   | ddm:instance:modify             | √                                                                                  | √                                                          |
| 查询实例详情V3          | GET /v3/{project_id}/instances/{instance_id}                                                                                                           | ddm:instance:get                | √                                                                                  | √                                                          |
| 查询实例列表V3          | GET /v3/{project_id}/instances                                                                                                                         | ddm:instance:list               | √                                                                                  | √                                                          |
| 创建访问控制组V3         | POST /v3/{project_id}/instances/{instance_id}/ip-group                                                                                                 | ddm:instance:modify             | √                                                                                  | √                                                          |
| 查询访问控制组V3         | GET /v3/{project_id}/instances/{instance_id}/ip-group                                                                                                  | ddm:instance:get                | √                                                                                  | √                                                          |
   
表2逻辑库管理 
| 描述                    | 对应API接口                                                                                                        | 授权项（Action）                  | **IAM**项目 (Project) | 企业项目 (Enterprise Project) |
|:---|:---|:---|:---|:---|
| 创建逻辑库                 | POST /v1/{project_id}/instances/{instance_id}/databases                                                        | ddm:database:create          | √                                                                                                  | √                                                                                       |
| 查询逻辑库列表               | GET /v1/{project_id}/instances/{instance_id}/databases?offset={offset}\&limit={limit}                          | ddm:database:list            | √                                                                                                  | √                                                                                       |
| 查询逻辑库详细信息             | GET /v1/{project_id}/instances/{instance_id}/databases/{ddm_dbname}                                            | ddm:database:get             | √                                                                                                  | √                                                                                       |
| 删除逻辑库                 | DELETE /v1/{project_id}/instances/{instance_id}/databases/{ddm_dbname}?delete_rds_data=true                    | ddm:database:delete          | √                                                                                                  | √                                                                                       |
| 查询创建逻辑库可选取的数据库实例列表    | GET /v1/{project_id}/instances/{instance_id}/rds?offset={offset}\&limit={limit}                                | ddm:rds:list                 | √                                                                                                  | √                                                                                       |
| 创建逻辑库V3               | POST /v3/{project_id}/instances/{instance_id}/databases                                                        | ddm:database:create          | √                                                                                                  | √                                                                                       |
| 删除逻辑库V3               | DELETE /v3/{project_id}/instances/{instance_id}/databases/{database_name}                                      | ddm:database:delete          | √                                                                                                  | √                                                                                       |
| 查询逻辑库详情V3             | GET /v3/{project_id}/instances/{instance_id}/databases/{database_name}                                         | ddm:database:get             | √                                                                                                  | √                                                                                       |
| 导出逻辑库元数据V3            | GET /v3/{project_id}/instances/{instance_id}/schema-metadata                                                   | ddm:database:get             | √                                                                                                  | √                                                                                       |
| 导入逻辑库元数据V3            | POST /v3/{project_id}/instances/{instance_id}/schema-metadata                                                  | ddm:database:create          | √                                                                                                  | √                                                                                       |
| 查询创建逻辑库可选取的数据节点实例列表V3 | GET /v3/{project_id}/instances/{instance_id}/available-data-nodes                                              | ddm:rds:list                 | √                                                                                                  | √                                                                                       |
| 查询分片变更可选取的数据节点实例列表V3  | GET /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/available-data-nodes                | ddm:rds:list                 | √                                                                                                  | √                                                                                       |
| 分片变更预校验V3             | POST /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/precheck                           | ddm:database:migrate         | √                                                                                                  | √                                                                                       |
| 查询分片变更预校验异步结果V3       | GET /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/precheck/{job_id}                   | ddm:instance:list            | √                                                                                                  | √                                                                                       |
| 分片变更V3                | POST /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration                                    | ddm:database:migrate         | √                                                                                                  | √                                                                                       |
| 查询分片变更任务详情V3          | GET /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}                       | ddm:task:list                | √                                                                                                  | √                                                                                       |
| 取消分片变更V3              | PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/cancel                | ddm:database:migrate         | √                                                                                                  | √                                                                                       |
| 回滚分片变更V3              | PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/rollback              | ddm:database:migrateRollback | √                                                                                                  | √                                                                                       |
| 清理分片变更V3              | PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/clean                 | ddm:database:migrate         | √                                                                                                  | √                                                                                       |
| 重试分片变更V3              | PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/retry                 | ddm:database:migrate         | √                                                                                                  | √                                                                                       |
| 修改切换路由策略V3            | PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/route-switch-strategy | ddm:database:migrate         | √                                                                                                  | √                                                                                       |
| 切换路由V3                | PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/route-switch          | ddm:database:migrate         | √                                                                                                  | √                                                                                       |
| 解绑逻辑库V3               | POST /v3/{project_id}/instances/{instance_id}/databases/{logic_db_name}/unbind                                 | ddm:database:unbind          | √                                                                                                  | √                                                                                       |
   
表3账号管理 
| 描述             | 对应API接口                                                                           | 授权项（Action）     | **IAM**项目 (Project) | 企业项目 (Enterprise Project) |
|:---|:---|:---|:---|:---|
| 创建DDM账号        | POST /v1/{project_id}/instances/{instance_id}/users                               | ddm:user:create | √                                                                                                    | √                                                          |
| 查询DDM账号列表      | GET /v1/{project_id}/instances/{instance_id}/users?offset={offset}\&limit={limit} | ddm:user:list   | √                                                                                                    | √                                                          |
| 修改DDM账号        | PUT /v1/{project_id}/instances/{instance_id}/users/{username}                     | ddm:user:modify | √                                                                                                    | √                                                          |
| 删除DDM账号        | DELETE /v1/{project_id}/instances/{instance_id}/users/{username}                  | ddm:user:delete | √                                                                                                    | √                                                          |
| 重置DDM账号密码      | POST /v2/{project_id}/instances/{instance_id}/users/{username}/password           | ddm:user:modify | √                                                                                                    | √                                                          |
| DDM管理员账号密码管理V3 | PUT /v3/{project_id}/instances/{instance_id}/admin-user                           | ddm:user:modify | √                                                                                                    | √                                                          |
| 弱密码校验V3        | POST /v3/{project_id}/weak-password-verification                                  | ddm:user:list   | √                                                                                                    | √                                                          |
| 创建账号V3         | POST /v3/{project_id}/instances/{instance_id}/users                               | ddm:user:create | √                                                                                                    | √                                                          |
| 查询账号列表V3       | GET /v3/{project_id}/instances/{instance_id}/users                                | ddm:user:list   | √                                                                                                    | √                                                          |
| 修改账号V3         | PUT /v3/{project_id}/instances/{instance_id}/users/{username}                     | ddm:user:modify | √                                                                                                    | √                                                          |
| 删除账号V3         | DELETE /v3/{project_id}/instances/{instance_id}/users/{username}                  | ddm:user:delete | √                                                                                                    | √                                                          |
| 重置账号密码V3       | POST /v3/{project_id}/instances/{instance_id}/users/{username}/password           | ddm:user:modify | √                                                                                                    | √                                                          |
   
表4任务管理 
| 描述          | 对应API接口                            | 授权项（Action）   | **IAM**项目 (Project) | 企业项目 (Enterprise Project) |
|:---|:---|:---|:---|:---|
| 获取任务信息      | GET /v1/{project_id}/jobs/{job_id} | ddm:task:list | √                                                                                                    | √                                                           |
| 获取指定ID的任务信息 | GET /v3/{project_id}/jobs/{job_id} | ddm:task:get  | √                                                                                                    | √                                                           |
| 查询任务列表V3    | GET /v3/{project_id}/jobs          | ddm:task:list | √                                                                                                    | √                                                           |
   
表5监控管理 
| 描述    | 对应API接口                                                                                                                             | 授权项（Action）                  | **IAM**项目 (Project) | 企业项目 (Enterprise Project) |
|:---|:---|:---|:---|:---|
| 慢日志监控 | GET /v2/{project_id}/instances/{instance_id}/slowlog?curPage={curPage}\&perPage={perPage}\&startDate={startDate}\&endDate={endDate} | ddm:instance:listSlowSqlInfo | √                                                                                                    | √                                                          |
   
表6会话管理 
| 描述             | 对应API接口                                                                                                                                       | 授权项（Action）                   | **IAM**项目 (Project) | 企业项目 (Enterprise Project) |
|:---|:---|:---|:---|:---|
| 查询逻辑会话列表V3     | GET /v3/{project_id}/instances/{instance_id}/logical-processes?offset={offset}\&limit={limit}                                                 | ddm:instance:queryProcessList | √                                                                                                    | √                                                          |
| kill逻辑会话V3     | DELETE /v3/{project_id}/instances/{instance_id}/logical-processes                                                                             | ddm:instance:killProcessList  | √                                                                                                    | √                                                          |
| 查询物理会话列表V3     | GET /v3/{project_id}/instances/{instance_id}/physical-processes?offset={offset}\&limit={limit}                                                | ddm:instance:queryProcessList | √                                                                                                    | √                                                          |
| kill物理会话V3     | DELETE /v3/{project_id}/instances/{instance_id}/physical-processes                                                                            | ddm:instance:killProcessList  | √                                                                                                    | √                                                          |
| 查询kill会话审计日志V3 | GET /v3/{project_id}/instances/{instance_id}/processes-audit-log?offset={offset}\&limit={limit}\&start_time={start_time}\&end_time={end_time} | ddm:instance:queryProcessList | √                                                                                                    | √                                                          |
   
表7版本管理 
| 描述             | 对应API接口                                                                          | 授权项（Action）                | **IAM**项目 (Project) | 企业项目 (Enterprise Project) |
|:---|:---|:---|:---|:---|
| 查询DDM可变更内核版本V3 | GET /v3/{project_id}/instances/{instance_id}/database-version/available-versions | ddm:instance:get           | √                                                                                                    | √                                                          |
| 变更DDM内核版本V3    | POST /v3/{project_id}/instances/{instance_id}/database-version/change-version    | ddm:instance:changeVersion | √                                                                                                    | √                                                          |
| 回滚DDM内核版本V3    | POST /v3/{project_id}/instances/{instance_id}/database-version/rollback-version  | ddm:instance:changeVersion | √                                                                                                    | √                                                          |
| DDM内核版本风险提醒V3  | GET /v3/{project_id}/instances/{instance_id}/show-risk-info                      | ddm:instance:get           | √                                                                                                    | √                                                          |
   
表8备份管理 
| 描述                  | 对应API接口                                                                              | 授权项（Action）        | **IAM**项目 (Project) | 企业项目 (Enterprise Project) |
|:---|:---|:---|:---|:---|
| 获取备份列表              | GET /v3/{project_id}/backups                                                         | ddm:backup:list    | √                                                                                                    | √                                                          |
| 删除备份                | DELETE /v3/{project_id}/backups/{backup_id}  | ddm:backup:delete  | √                                                                                                    | √                                                          |
| 查询备份详情V3            | GET /v3/{project_id}/instances/{instance_id}/backups/{backup_id}                     | ddm:backup:get     | √                                                                                                    | √                                                          |
| 查询实例在恢复时间点关联的数据节点V3 | GET /v3/{project_id}/instances/{instance_id}/backups/related-dn                      | ddm:backup:get     | √                                                                                                    | √                                                          |
| 查询可恢复时间段V3          | GET /v3/{project_id}/instances/{instance_id}/backups/restorable-time-interval        | ddm:backup:get     | √                                                                                                    | √                                                          |
| 查询可用于时间点恢复的数据节点列表V3 | GET /v3/{project_id}/instances/{instance_id}/backups/restorable-data-node            | ddm:rds:list       | √                                                                                                    | √                                                          |
| 查询可用于恢复的实例列表V3      | GET /v3/{project_id}/instances/{instance_id}/backups/restorable-instances            | ddm:instance:list  | √                                                                                                    | √                                                          |
| 元数据恢复V3             | POST /v3/{project_id}/instances/{instance_id}/backups/metadata-recovery              | ddm:backup:restore | √                                                                                                    | √                                                          |
| 恢复到新实例V3            | POST /v3/{project_id}/instances/{instance_id}/backups/recovery                       | ddm:backup:restore | √                                                                                                    | √                                                          |
   
表9参数管理 
| 描述              | 对应API接口                                                         | 授权项（Action）       | **IAM**项目 (Project) | 企业项目 (Enterprise Project) |
|:---|:---|:---|:---|:---|
| 获取参数模板列表        | GET /v3/{project_id}/configurations                             | ddm:param:list    | √                                                                                                    | √                                                           |
| 获取指定参数模板的参数     | GET /v3/{project_id}/configurations/{config_id}                 | ddm:param:list    | √                                                                                                    | √                                                           |
| 创建参数组V3         | POST /v3/{project_id}/configurations                            | ddm:param:create  | √                                                                                                    | √                                                           |
| 删除参数组V3         | DELETE /v3/{project_id}/configurations/{config_id}              | ddm:param:delete  | √                                                                                                    | √                                                           |
| 查询参数组应用记录V3     | GET /v3/{project_id}/configurations/{config_id}/apply-histories | ddm:param:list    | √                                                                                                    | √                                                           |
| 复制参数组V3         | POST /v3/{project_id}/configurations/{config_id}/copy           | ddm:param:create  | √                                                                                                    | √                                                           |
| 更新参数组V3         | PUT /v3/{project_id}/configurations/{config_id}                 | ddm:param:update  | √                                                                                                    | √                                                           |
| 查询参数组可应用的实例列表V3 | GET /v3/{project_id}/configurations/{config_id}/query-instances | ddm:instance:list | √                                                                                                    | √                                                           |
| 比较参数组V3         | PUT /v3/{project_id}/configurations/diff                        | ddm:param:list    | √                                                                                                    | √                                                           |