DAS Permissions

A policy is a set of permissions defined in JSON format. By default, a new IAM user does not have any permissions assigned. You need to add the user to one or more groups, and assign permission policies to these groups. The user then inherits permissions from the groups. This process is called authorization. After authorization, the user can perform specified operations on DAS based on the permissions. IAM provides system policies that define the common permissions for different services, such as administrator and read-only permissions. You can directly use these system policies to assign permissions.

DAS is a project-level service deployed in specific physical regions. Therefore, DAS permissions are assigned to users in specific regions and only take effect for these regions. If you want the permissions to take effect for all regions, you need to assign the permissions to users in each region. When accessing DAS, users need to switch to a region where they have been authorized to use DAS.

You can grant users permissions by using roles and policies.

Roles: A coarse-grained authorization mechanism provided by IAM to define permissions based on users' job responsibilities. This mechanism provides only a limited number of service-level roles for authorization. When using roles to grant permissions, you need to also assign other roles on which the permissions depend to take effect. However, roles are not ideal for fine-grained authorization and secure access control.

Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, you can grant IAM users only the permissions for managing a certain type of database resources. In addition, if you want to use DAS to manage database resources, add the required DAS system policies. Then, you can log in to DAS to manage these resources.

Table 1 lists all the DAS system permissions.

DAS depends on other services to implement the management and O&M of databases.

If you authorize IAM users in fine-grained mode and want to use DAS to manage DB instances, add the DAS FullAccess system policy during authorization.

With DAS, IAM users can view and manage the DB instances configured in the corresponding services.

By default, users with fine-grained authorization have the permissions to view the database login list, delete database login information, and access CloudDBA on DAS. The instances viewed by these users are the same as those configured in the corresponding services.

Table 2 describes the common operations supported by each system-defined policy or role of DAS.

DAS import and export features require the usage of OBS buckets. You need to obtain required OBS policies before using these features.

• Typically, it is recommended that you configure the Tenant Administrator policy that allows you to perform operations on OBS resources.
• If you do not want employees to have the high-risk permission for creating and deleting buckets, you can configure the OBS OperateAccess policy for the employees so that they can use the DAS features but cannot create and delete OBS buckets.