# 策略授权参考
本章节介绍DDS策略授权场景下支持的策略授权项。
#### 支持的授权项
策略包含系统策略和自定义策略，如果系统策略不满足授权要求，管理员可以创建自定义策略，并通过给用户组授予自定义策略来进行精细的访问控制。策略支持的操作与API相对应，授权项列表说明如下：
- 权限：允许或拒绝对指定资源在特定条件下进行某项操作。
- 对应API接口：自定义策略实际调用的API接口。
- 授权项：自定义策略中支持的Action，在自定义策略中的Action中写入授权项，可以实现授权项对应的权限功能。
- 依赖的授权项：部分Action存在对其他Action的依赖，需要将依赖的Action同时写入授权项，才能实现对应的权限功能。
- IAM项目(Project)/企业项目(Enterprise Project)：自定义策略的授权范围，包括IAM项目与企业项目。授权范围如果同时支持IAM项目和企业项目，表示此授权项对应的自定义策略，可以在IAM和企业管理两个服务中给用户组授权并生效。如果仅支持IAM项目，不支持企业项目，表示仅能在IAM中给用户组授权并生效，如果在企业管理中授权，则该自定义策略不生效。管理员可以在授权项列表中查看授权项是否支持IAM项目或企业项目，"√"表示支持，"×"表示暂不支持。关于IAM项目与企业项目的区别，详情请参见：[IAM与企业管理的区别](https://support.huaweicloud.com/iam_faq/iam_01_0101.html)。
DDS的支持自定义策略授权项如下所示：
表1实例管理 
| 权限                     | 对接API接口                                                                                                                                                                   | 授权项(Action)                                                                                                                                                                                                                                                      | IAM项目(Project) | 企业项目(Enterprise Project) |
|:---|:---|:---|:---|:---|
| 创建实例                   | POST /v3/{project_id}/instances                                                                                                                                           | dds:instance:create vpc:vpcs:list vpc:vpcs:get vpc:subnets:get vpc:securityGroups:get vpc:ports:get   | √              | √                        |
| 查询实例列表                 | GET /v3/{project_id}/instances?id={id}\&name={name}\&mode={mode}\&datastore_type={datastore_type}\&vpc_id={vpc_id}\&subnet_id={subnet_id}\&offset={offset}\&limit={limit} | dds:instance:list                                                                                                                                                                                                                                                | √              | √                        |
| 删除实例                   | DELETE /v3/{project_id}/instances/{instance_id}                                                                                                                           | dds:instance:deleteInstance                                                                                                                                                                                                                                      | √              | √                        |
| 重启实例                   | POST /v3/{project_id}/instances/{instance_id}/restart                                                                                                                     | dds:instance:reboot                                                                                                                                                                                                                                              | √              | √                        |
| 扩容实例存储容量               | POST /v3/{project_id}/instances/{instance_id}/enlarge-volume                                                                                                              | dds:instance:extendVolume                                                                                                                                                                                                                                        | √              | √                        |
| 扩容集群实例的节点数量            | POST /v3/{project_id}/instances/{instance_id}/enlarge                                                                                                                     | dds:instance:extendNode vpc:vpcs:list vpc:vpcs:get vpc:subnets:get vpc:securityGroups:get vpc:ports:get | √              | √                        |
| 变更实例规格                 | POST /v3/{project_id}/instances/{instance_id}/resize                                                                                                                      | dds:instance:modifySpec                                                                                                                                                                                                                                          | √              | √                        |
| 切换副本集实例的主备节点           | POST /v3/{project_id}/instances/{instance_id}/switchover                                                                                                                  | dds:instance:switchover                                                                                                                                                                                                                                          | √              | √                        |
| 切换SSL开关                | POST/v3/{project_id}/instances/{instance_id}/switch-ssl                                                                                                                   | dds:instance:modifySSL                                                                                                                                                                                                                                           | √              | √                        |
| 修改实例名称                 | PUT /v3/{project_id}/instances/{instance_id}/modify-name                                                                                                                  | dds:instance:modify                                                                                                                                                                                                                                              | √              | √                        |
| 修改数据库端口                | POST /v3/{project_id}/instances/{instance_id}/modify-port                                                                                                                 | dds:instance:modifyPort                                                                                                                                                                                                                                          | √              | √                        |
| 变更实例安全组                | POST /v3/{project_id}/instances/{instance_id}/modify-security-group                                                                                                       | dds:instance:modifySecurityGroup                                                                                                                                                                                                                                 | √              | √                        |
| 绑定弹性公网IP               | POST /v3/{project_id}/nodes/{node_id}/bind-eip                                                                                                                            | dds:instance:bindPublicIp                                                                                                                                                                                                                                        | √              | √                        |
| 解绑弹性公网IP               | POST /v3/{project_id}/nodes/{node_id}/unbind-eip                                                                                                                          | dds:instance:unbindPublicIp                                                                                                                                                                                                                                      | √              | √                        |
| 修改实例内网地址               | POST /v3/{project_id}/instances/{instance_id}/modify-internal-ip                                                                                                          | dds:instance:modifyVIP                                                                                                                                                                                                                                           | √              | √                        |
| 打开集群的Shard/Config IP开关 | POST /v3/{project_id}/instances/{instance_id}/create-ip                                                                                                                   | dds:instance:createIp                                                                                                                                                                                                                                            | √              | √                        |
| 查询实例可迁移到的可用区           | GET /v3/{project_id}/instances/{instance_id}/migrate/az                                                                                                                   | dds:instance:migrate                                                                                                                                                                                                                                             | √              | √                        |
| 实例可用区迁移                | POST /v3/{project_id}/instances/{instance_id}/migrate                                                                                                                     | dds:instance:migrate                                                                                                                                                                                                                                             | √              | √                        |
   
表2连接管理 
| 权限          | 对应API接口                                                                                 | 授权项(Action)          | IAM项目(Project) | 企业项目(Enterprise Project) |
|:---|:---|:---|:---|:---|
| 查询实例节点会话    | GET /v3/{project_id}/nodes/{node_id}/sessions                                           | dds:instance:session | √              | √                        |
| 终结实例节点会话    | POST /v3/{project_id}/nodes/{node_id}/session                                           | dds:instance:session | √              | √                        |
| 查询实例节点连接数统计 | GET /v3/{projectId}/instances/{instance_id}/conn-statistics | dds:instance:list    | √              | √                        |
   
表3备份与恢复 
| 权限            | 对应API接口                                                                                                                                                                                             | 授权项(Action)                                                                                                                                                                                                                                                     | IAM项目(Project) | 企业项目(Enterprise Project) |
|:---|:---|:---|:---|:---|
| 创建手动备份        | POST /v3/{project_id}/backups                                                                                                                                                                       | dds:instance:createManualBackup                                                                                                                                                                                                                                 | √              | √                        |
| 删除手动备份        | DELETE /v3/{project_id}/backups/{backups_id}                                                                                                                                                        | dds:backup:delete                                                                                                                                                                                                                                               | √              | √                        |
| 查询备份列表        | GET /v3/{project_id}/backups?instance_id={instance_id}\&backup_id={backup_id}\&backup_type={backup_type}\&offset={offset}\&limit={limit}\&begin_time={begin_time}\&end_time={end_time}\&mode={mode} | dds:backup:list                                                                                                                                                                                                                                                 | √              | √                        |
| 查询自动备份策略      | GET /v3/{project_id}/instances/{instance_id}/backups/policy                                                                                                                                         | dds:instance:list                                                                                                                                                                                                                                               | √              | √                        |
| 设置自动备份策略      | PUT /v3/{project_id}/instances/{instance_id}/backups/policy                                                                                                                                         | dds:instance:modifyBackupPolicy                                                                                                                                                                                                                                 | √              | √                        |
| 恢复到新实例        | POST /v3/{project_id}/instances                                                                                                                                                                     | dds:instance:create vpc:vpcs:list vpc:vpcs:get vpc:subnets:get vpc:securityGroups:get vpc:ports:get | √              | √                        |
| 获取备份下载链接      | GET /v3/{projectId}/backups/download-file                                                                                                                                                           | dds:backup:download                                                                                                                                                                                                                                             | √              | √                        |
| 查询可恢复的时间段     | GET /v3/{project_id}/instances/{instance_id}/restore-time                                                                                                                                           | dds:instance:list                                                                                                                                                                                                                                               | √              | √                        |
| 获取可恢复的数据库列表   | GET /v3/{project_id}/instances/{instance_id}/restore-database                                                                                                          | dds:instance:list                                                                                                                                                                                                                                               | √              | √                        |
| 获取可恢复的数据库集合列表 | GET /v3/{project_id}/instances/{instance_id}/restore-collection                                                                                                      | dds:instance:list                                                                                                                                                                                                                                               | √              | √                        |
| 恢复到当前实例       | POST /v3/{project_id}/instances/recovery                                                                                                                                                            | dds:backup:refreshInstanceFromBackup                                                                                                                                                                                                                            | √              | √                        |
| 库表级时间点恢复      | POST /v3/{project_id}/instances/{instance_id}/restore/collections                                                                                                                                   | dds:backup:refreshInstanceFromBackup                                                                                                                                                                                                                            | √              | √                        |
   
表4参数配置 
| 权限          | 对应API接口                                                                                     | 授权项(Action)                  | IAM项目(Project) | 企业项目(Enterprise Project) |
|:---|:---|:---|:---|:---|
| 获取参数模板列表    | GET /v3/{project_id}/configurations                          | dds:param:list               | √              | √                        |
| 创建参数模板      | PUT /v3/{project_id}/configurations                         | dds:param:create             | √              | √                        |
| 删除参数模板      | DELETE /v3/{project_id}/configurations/{config_id}           | dds:param:delete             | √              | √                        |
| 获取参数模板的详情   | GET /v3/{projectId}/configurations/{configId}                | dds:param:list               | √              | √                        |
| 修改参数模板      | PUT /v3/{project_id}/configurations/{config_id}             | dds:param:modify             | √              | √                        |
| 应用参数模板      | PUT /v3/{project_id}/configurations/{config_id}/apply         | dds:instance:modifyParameter | √              | √                        |
| 获取指定实例的参数信息 | GET /v3/{project_id}/instances/{instance_id}/configurations | dds:param:list               | √              | √                        |
| 修改指定实例的参数   | PUT /v3/{project_id}/instances/{instance_id}/configurations    | dds:instance:modifyParameter | √              | √                        |
   
表5获取日志信息 
| 权限         | 对应API接口                                                         | 授权项(Action)                       | IAM项目(Project) | 企业项目(Enterprise Project) |
|:---|:---|:---|:---|:---|
| 查询数据库慢日志   | GET /v3/{project_id}/instances/{instance_id}/slowlog            | dds:instance:list                 | √              | √                        |
| 获取慢日志下载链接  | POST /v3/{project_id}/instances/{instance_id}/slowlog-download  | dds:instance:list                 | √              | √                        |
| 查询数据库错误日志  | GET /v3/{project_id}/instances/{instance_id}/errorlog           | dds:instance:list                 | √              | √                        |
| 获取错误日志下载链接 | POST /v3/{project_id}/instances/{instance_id}/errorlog-download | dds:instance:list                 | √              | √                        |
| 设置审计日志策略   | POST /v3/{project_id}/instances/{instance_id}/auditlog-policy   | dds:instance:modifyAuditLogSwitch | √              | √                        |
| 查询审计日志策略   | GET /v3/{project_id}/instances/{instance_id}/auditlog-policy    | dds:instance:list                 | √              | √                        |
| 查询审计日志列表   | GET /v3/{project_id}/instances/{instance_id}/auditlog           | dds:instance:list                 | √              | √                        |
| 获取审计日志下载链接 | POST /v3/{project_id}/instances/{instance_id}/auditlog-links    | dds:instance:downloadAuditLog     | √              | √                        |
   
表6标签管理 
| 权限          | 对应API接口                                                   | 授权项(Action)         | IAM项目(Project) | 企业项目(Enterprise Project) |
|:---|:---|:---|:---|:---|
| 批量添加或删除资源标签 | POST /v3/{project_id}/instances/{instance_id}/tags/action | dds:instance:modify | √              | √                        |
| 查询资源标签      | GET /v3/{project_id}/instances/{instance_id}/tags         | dds:instance:list   | √              | √                        |
   
表7管理数据库和用户 
| 权限         | 对应API接口                                                                                                                                                                                                                                            | 授权项(Action)                     | IAM项目(Project) | 企业项目(Enterprise Project) |
|:---|:---|:---|:---|:---|
| 创建数据库用户    | POST /v3/{project_id}/instances/{instance_id}/db-user                                                                                                                                                                                              | dds:instance:createDatabaseUser | √              | √                        |
| 创建数据库角色    | POST /v3/{project_id}/instances/{instance_id}/db-role                                                                                                                                                                                              | dds:instance:createDatabaseRole | √              | √                        |
| 删除数据库用户    | DELETE /v3/{project_id}/instances/{instance_id}/db-user                                                                                                                                                                                            | dds:instance:deleteDatabaseUser | √              | √                        |
| 删除数据库角色    | DELETE /v3/{project_id}/instances/{instance_id}/db-role                                                                                                                                                                                            | dds:instance:deleteDatabaseRole | √              | √                        |
| 修改数据库用户密码  | PUT /v3/{project_id}/instances/{instance_id}/reset-password                                                                                                                                                           | dds:instance:resetPasswd        | √              | √                        |
| 查询数据库用户列表  | GET /v3/{project_id}/instances/{instance_id}/db-user/detail? offset ={offset}\&limit={limit}\&user_name={user_name }\&db_name={db_name}                                                                                                            | dds:instance:get                | √              | √                        |
| 查询数据库角色列表  | GET /v3/{project_id}/instances/{instance_id}/db-roles?role_name={role_name}\&db_name={db_name}\&offset={offset}\&limit={limit}                                                                                                                     | dds:instance:get                | √              | √                        |
| 查询和设置集群均衡器 | GET /v3/{project_id}/instances/{instance_id}/balancer PUT /v3/{project_id}/instances/{instance_id}/balancer/{action} PUT /v3/{project_id}/instances/{instance_id}/balancer/active-window | dds:instance:balancer           | √              | √                        |
   
![](https://support.huaweicloud.com/api-dds/public_sys-resources/note_3.0-zh-cn.png)
"√"表示支持，"x"表示暂不支持。