Help Center/ Distributed Message Service for Kafka/ API Reference/ Permissions Policies and Supported Actions
Updated on 2022-09-15 GMT+08:00

Permissions Policies and Supported Actions

This chapter describes fine-grained permissions management for your DMS for Kafka instances. If your account does not require individual IAM users, you can skip this chapter.

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

You can grant users permissions by using roles and policies. Roles are a type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. Policies define API-based permissions for operations on specific resources under certain conditions, allowing for more fine-grained, secure access control of cloud resources.

Policy-based authorization is useful if you want to allow or deny the access to an API.

An account has all the permissions required to call all APIs, but IAM users must be assigned the permissions to call the required APIs. The permissions required for calling an API are determined by the actions supported by the API. Only users who have been granted permissions allowing the actions can call the API successfully. For example, if an IAM user wants to query Kafka instances using an API, the user must have been granted permissions that allow the dms:instance:create action.

Supported Actions

DMS for Kafka provides system-defined policies that can be directly used in IAM. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:

  • Permission: a statement in a policy that allows or denies certain operations.
  • APIs: REST APIs that can be called by a user who has been granted specific permissions.
  • Action: Specific operations that are allowed or denied.
  • IAM projects or enterprise projects: A custom policy can be applied to IAM projects or enterprise projects or both. Policies that contain actions for both IAM and enterprise projects can be used and take effect for both IAM and Enterprise Management. Policies that only contain actions for IAM projects can be used and only take effect for IAM.

DMS for Kafka supports the following actions that can be defined in custom policies. Permissions must be obtained before calling DMS APIs. For details on how to obtain permissions, visit the Identity and Access Management help center.

Table 1 DMS for Kafka actions

Permissions

APIs

Actions

IAM Projects

Enterprise Projects

Creating an Instance

POST /v2/{project_id}/instances

dms:instance:create

Querying an Instance

GET /v2/{project_id}/instances/{instance_id}

dms:instance:get

Modifying Instance Information

PUT /v2/{project_id}/instances/{instance_id}

dms:instance:modify

Deleting an Instance

DELETE /v2/{project_id}/instances/{instance_id}

dms:instance:delete

Listing All Instances

GET /v2/{project_id}/instances

dms:instance:list

Batch Restarting or Deleting Instances

POST /v2/{project_id}/instances/action

Restart: dms:instance:modifyStatus

Delete: dms:instance:delete

Resetting Kafka Manager Password

PUT /v2/{project_id}/instances/{instance_id}/kafka-manager-password

dms:instance:resetAuthInfo

Resetting the Password

POST /v2/{project_id}/instances/{instance_id}/password

dms:instance:resetAuthInfo

Restarting Kafka Manager

PUT /v2/{project_id}/instances/{instance_id}/restart-kafka-manager

dms:instance:modifyStatus

Configuring Automatic Topic Creation

POST /v2/{project_id}/instances/{instance_id}/autotopic

dms:instance:modify

Modifying the Private IP Address for Cross-VPC Access

POST /v2/{project_id}/instances/{instance_id}/crossvpc/modify

dms:instance:modify

Modifying Instance Specifications

POST /v2/{project_id}/instances/{instance_id}/extend

dms:instance:scale

Batch Deleting Topics of a Kafka Instance

POST /v2/{project_id}/instances/{instance_id}/topics/delete

dms:instance:modify

Creating a Topic for a Kafka Instance

POST /v2/{project_id}/instances/{instance_id}/topics

dms:instance:modify

Listing Topics of a Kafka Instance

GET /v2/{project_id}/instances/{instance_id}/topics

dms:instance:get

Modifying Topics of a Kafka Instance

PUT /v2/{project_id}/instances/{instance_id}/topics

dms:instance:modify

Deleting Users in Batches

PUT /v2/{project_id}/instances/{instance_id}/users

dms:instance:modify

Creating a User

POST /v2/{project_id}/instances/{instance_id}/users

dms:instance:modify

Resetting a User Password

PUT /v2/{project_id}/instances/{instance_id}/users/{user_name}

dms:instance:get

Querying the User List

GET /v2/{project_id}/instances/{instance_id}/users

dms:instance:get

Querying User Permissions

GET /v1/{project_id}/instances/{instance_id}/topics/{topic_name}/accesspolicy

dms:instance:get

Granting User Permissions

POST /v1/{project_id}/instances/{instance_id}/topics/accesspolicy

dms:instance:modify

Querying Messages

GET /v2/{project_id}/instances/{instance_id}/messages

dms:instance:get

Deleting a Background Task

DELETE /v2/{project_id}/instances/{instance_id}/tasks/{task_id}

dms:instance:deleteBackgroundTask

Listing Background Tasks

GET /v2/{project_id}/instances/{instance_id}/tasks

dms:instance:getBackgroundTask

Querying a Background Task

GET /v2/{project_id}/instances/{instance_id}/tasks/{task_id}

dms:instance:getBackgroundTask

Batch Adding or Deleting Tags

POST /v2/{project_id}/kafka/{instance_id}/tags/action

dms:instance:modify

Listing Tags of a Project

GET /v2/{project_id}/kafka/tags

dms:instance:get

Listing Tags of an Instance

GET /v2/{project_id}/kafka/{instance_id}/tags

dms:instance:get

Enabling or Disabling Public Access

This operation is supported only by using the console and not by calling APIs.

dms:instance:modify