Help Center> Database Security Service> Service Overview> Permissions Management
View PDF

Permissions Management

If you need to assign different permissions to employees in your enterprise to access your DBSS resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your HUAWEI CLOUD resources.

With IAM, you can use your HUAWEI CLOUD account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use DBSS but must not delete DBSS resources or perform any high-risk operations. To achieve this result, you can create IAM users for the software developers and grant them only the permissions required for using DBSS resources.

If your HUAWEI CLOUD account does not need individual IAM users for permissions management, then you may skip over this chapter.

IAM can be used free of charge. You pay only for the resources in your account. For more information about IAM, see IAM Service Overview.

DBSS Permissions

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. After authorization, the user can perform specified operations on BMS based on the permissions.

DBSS is a project-level service deployed and accessed in specific physical regions. To assign DBSS permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing DBSS, the users need to switch to a region where they have been authorized to use cloud services.

Table 1 describes all the system-defined DBSS roles. DBSS roles are dependent on the roles of other services. When assigning DBSS permissions to users, you need to also assign dependent roles for the DBSS permissions to take effect.

Table 1 System roles supported by DBSS

Role Name

Description

Dependency

DBSS System Administrator

(DBSS system administrator, who has the permissions to perform operations on DBSS system resources)
  • Users with this set of permissions can perform the following operations on database audit:
    • Purchasing an instance
    • Starting, disabling, and restarting an instance
    • Obtaining the instance list
    • Obtaining the basic information of an instance
    • Obtaining the audit statistics
    • Obtaining the monitoring information
    • Obtaining the operation logs
    • Managing databases
    • Managing agents
    • Configuring email notifications
    • Backup and restoration
  • Users with this set of permission can perform the following operations on database protection:
    • Purchasing an instance
    • Obtaining the instance list
    • Starting, disabling, and restarting an instance
    • Upgrading an instance
    • Associating or disassociating an EIP
    • Logging in to the DBSS console
To perform payment operations (for example, purchasing or renewing a DBSS instance), you must have the BSS Administrator, VPC Administrator, and ECS Administrator roles.
  • VPC Administrator: Users with this set of permissions can perform all execution permission for Virtual Private Cloud (VPC). It is a project-level role, which must be assigned in the same project.
  • BSS Administrator: Users with this set of permissions can perform any operation on menu items on pages My Account, Billing Center, and Resource Center. It is a project-level role, which must be assigned in the same project.
  • ECS Administrator: Users with this set of permissions can perform any operations on an ECS. It is a project-level role, which must be assigned in the same project.

DBSS Audit Administrator

(DBSS audit administrator, who has the permissions to check DBSS security logs)
  • Users with this set of permission can perform the following operations on database audit:
    • Obtaining the instance list
    • Obtaining the basic information of an instance
    • Obtaining the audit statistics
    • Obtaining the report results
    • Obtaining the rule information
    • Obtaining the statement information
    • Obtaining the session information
    • Obtaining the monitoring information
    • Obtaining the operation logs
    • Obtaining the database list
    • Managing reports
  • Users with this set of permission can perform the following operations on database protection:
    • Obtaining the instance list
    • Logging in to the DBSS console

None

DBSS Security Administrator

(DBSS security administrator, who has the permissions to set DBSS security policies)
  • Users with this set of permission can perform the following operations on database audit:
    • Obtaining the instance list
    • Obtaining the basic information of an instance
    • Obtaining the audit statistics
    • Obtaining the report results
    • Obtaining the rule information
    • Obtaining the statement information
    • Obtaining the session information
    • Obtaining the monitoring information
    • Obtaining the operation logs
    • Obtaining the database list
    • Configuring audit rules
    • Configuring alarm notifications
    • Managing reports
  • Users with this set of permission can perform the following operations on database protection:
    • Obtaining the instance list
    • Logging in to the DBSS console

None

Table 2 lists the common operations supported by each system-defined permission of DBSS. Select the permissions as needed.

Table 2 Common operations supported by each system-defined permission

Service

Operation

DBSS System Administrator

DBSS Audit Administrator

DBSS Security Administrator

Database Protection

Purchase an instance.

√

×

×

Obtaining the instance list

√

√

√

Starting, disabling, and restarting an instance

√

×

×

Upgrading an instance

√

×

×

Associating or disassociating an EIP

√

×

×

Database Audit

Purchasing an instance

√

×

×

Starting, disabling, and restarting an instance

√

×

×

Obtaining the instance list

√

√

√

Obtaining the basic information of an instance

√

√

√

Obtaining the audit statistics

√

√

√

Obtaining the monitoring information

√

√

√

Obtaining the operation logs

√

√

√

Managing databases

√

×

×

Managing agents

√

×

×

Configuring email notifications

√

×

×

Backup and restoration

√

×

×

Obtaining the report results

×

√

√

Obtaining the rule information

×

√

√

Obtaining the statement information

×

√

√

Obtaining the session information

×

√

√

Obtaining the database list

√

√

√

Managing reports

×

√

√

Configuring audit rules

×

×

√

Configuring alarm notifications

×

×

√

Helpful Links