Help Center> GeminiDB> Service Overview> Permissions Management
View PDF

Permissions Management

If you need to assign different permissions to employees in your enterprise to access your cloud resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your HUAWEI CLOUD resources.

With IAM, you can use your HUAWEI CLOUD account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use GaussDB NoSQL resources but must not delete them or perform any high-risk operations. To achieve this result, you can create IAM users for the software developers and grant them only the permissions required for using GaussDB NoSQL resources.

If your HUAWEI CLOUD account does not need individual IAM users for permissions management, you may skip this chapter.

IAM can be used free of charge. You pay only for the resources in your account. For more information about IAM, see IAM Service Overview.

GaussDB NoSQL Permissions

By default, new IAM users do not have any permissions granted. You need to add a user to one or more groups, and assign policies or roles to these groups. The user then inherits permissions from the groups it is a member of. This process is called authorization. After authorization, the user can perform specified operations on cloud services based on the permissions.

GaussDB NoSQL is a project-level service deployed in specific physical regions. To assign GaussDB NoSQL permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing GaussDB NoSQL, the users need to switch to a region where they have been authorized to use this service.

You can grant users permissions by using roles and policies.

  • Roles: A coarse-grained authorization mechanism provided by IAM to define permissions based on users' job responsibilities. This mechanism provides only a limited number of service-level roles for authorization. When using roles to grant permissions, you also need to assign other roles that the permissions depend on to take effect. However, roles are not ideal for fine-grained authorization and secure access control.
  • Policies: A fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, and meets the requirements for secure access control. For example, you can grant ECS users only the permissions for managing a certain type of ECSs. Most policies define permissions based on APIs. For the API actions supported by GaussDB NoSQL, see Permissions Policies and Supported Actions.

Table 1 lists all the system-defined roles and policies supported by GaussDB NoSQL.

Table 1 GaussDB NoSQL roles or policies

Policy Name/System Role

Description

Type

Dependency

GaussDB NoSQL FullAccess

All permissions of GaussDB NoSQL

System-defined policy

None

GaussDB NoSQL ReadOnlyAccess

Read-only permissions of GaussDB NoSQL

System-defined policy

None

Table 2 lists the common operations supported by each system-defined policy or role of GaussDB NoSQL. Select the policies or roles as required.

Table 2 Common operations supported by each system-defined GaussDB NoSQL policy

Operation

GaussDB NoSQL FullAccess

GaussDB NoSQL ReadOnlyAccess

Creating a DB instance

√

x

Querying DB instances

√

√

Deleting a DB instance

√

x

Restarting a DB instance

√

x

Resetting a password

√

x

Binding or unbinding an EIP

√

x

Scaling up storage space

√

x

Changing instance class

√

x

Adding nodes

√

x

Deleting nodes

√

x

Modifying a backup policy

√

x

Renaming a DB instance

√

x

Creating a manual backup

√

x

Querying the backup list

√

√

Restoring data to a new DB instance

√

x

Deleting a backup

√

x

Creating a parameter template

√

x

Querying a parameter template list

√

√

Modifying a parameter template

√

x

Deleting a parameter template

√

x

Tag list

√

√

Querying enterprise project quota list

√

√

Modifying enterprise project quota

√

x

Table 3 lists common GaussDB NoSQL operations and corresponding actions. You can refer to this table to customize permission policies.

Table 3 Common operations and supported actions

Operation

Actions

Authorization Scope

Remarks

Instance creation page
  • vpc:vpcs:list
  • vpc:subnets:get
  • vpc:securityGroups:get

Supported:

  • IAM projects
  • Enterprise projects

The VPC, subnet, and security group are displayed on the instance creation page.

Creating a DB instance
  • nosql:instance:create
  • vpc:vpcs:list
  • vpc:vpcs:get
  • vpc:subnets:get
  • vpc:securityGroups:get
  • vpc:ports:get

Supported:

  • IAM projects
  • Enterprise projects

If the default VPC, subnet, and security group are used, the vpc:*:create permission must be configured.

To create an encryption DB instance, you need to configure the KMS Administrator permission in the project.

Querying DB instances

nosql:instance:list

Supported:

  • IAM projects
  • Enterprise projects

-

Querying details of a DB instance

nosql:instance:list

Supported:

  • IAM projects
  • Enterprise projects

If the VPC, subnet, and security group need to be displayed on the instance details page, add the vpc:*:get and vpc:*:list actions.

Deleting a DB instance

nosql:instance:delete

Supported:

  • IAM projects
  • Enterprise projects

When deleting a DB instance, you need to delete the IP address on the data side.

Restarting a DB instance

nosql:instance:restart

Supported:

  • IAM projects
  • Enterprise projects

-

Resetting a password

nosql:instance:modifyPasswd

Supported:

  • IAM projects
  • Enterprise projects

-

Binding an EIP

nosql:instance:bindPublicIp

Supported:

  • IAM projects

When binding an EIP, you need to query the created EIP.

  • Not support enterprise project.
  • Not support fine-grained authentication.

For details, see Floating IP Address.

Unbinding an EIP

nosql:instance:unbindPublicIp

Supported:

  • IAM projects
  • Not support enterprise project.
  • Not support fine-grained authentication.

For details, see Floating IP Address.

Scaling up storage space

nosql:instance:modifyStorageSize

Supported:

  • IAM projects
  • Enterprise projects

-

Changing instance class

nosql:instance:modifySpecification

Supported:

  • IAM projects
  • Enterprise projects

-

Adding nodes
  • nosql:instance:extendNode
  • vpc:vpcs:list
  • vpc:vpcs:get
  • vpc:subnets:get
  • vpc:securityGroups:get
  • vpc:ports:get

Supported:

  • IAM projects
  • Enterprise projects

-

Deleting nodes

nosql:instance:reduceNode

Supported:

  • IAM projects
  • Enterprise projects

Delete a node from a cluster.

Modifying a backup policy

nosql:instance:modifyBackupPolicy

Supported:

  • IAM projects
  • Enterprise projects

-

Renaming a DB instance

nosql:instance:rename

Supported:

  • IAM projects
  • Enterprise projects

-

Creating a manual backup

nosql:backup:create

Supported:

  • IAM projects
  • Enterprise projects

-

Querying the backup list

nosql:backup:list

Supported:

  • IAM projects
  • Enterprise projects

-

Restoring data to a new DB instance
  • nosql:backup:restoreToNewInstance
  • vpc:vpcs:list
  • vpc:vpcs:get
  • vpc:subnets:get
  • vpc:securityGroups:get
  • vpc:ports:get

Supported:

  • IAM projects
  • Enterprise projects

The KMS Administrator permission needs to be configured for the encrypted DB instance in the project.

Deleting a backup

nosql:backup:delete

Supported:

  • IAM projects
  • Enterprise projects

-

Creating a parameter template

nosql:param:create

Supported:

  • IAM projects
  • Enterprise projects

-

Querying a parameter template list

nosql:param:list

Supported:

  • IAM projects
  • Enterprise projects

-

Modifying a parameter template

nosql:param:modify

Supported:

  • IAM projects
  • Enterprise projects

-

Deleting a parameter template

nosql:param:delete

Supported:

  • IAM projects
  • Enterprise projects

-

Tag list

nosql:tag:list

Supported:

  • IAM projects
  • Enterprise projects

-

Querying enterprise project quota list

nosql:quota:list

Supported:

  • IAM projects
  • Enterprise projects

-

Modifying enterprise project quota

nosql:quota:modify

Supported:

  • IAM projects
  • Enterprise projects

-

Helpful Links