Permissions Management

If you need to assign different permissions to employees in your enterprise to access your DDS resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your Huawei Cloud resources.

With IAM, you can use your Huawei Cloud account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use DDS resources but must not delete them or perform any high-risk operations. To achieve this result, you can create IAM users for the software developers and grant them only the permissions required for using DDS resources.

If your Huawei Cloud account does not need individual IAM users for permissions management, you may skip over this topic.

IAM can be used free of charge. You pay only for the resources in your account.

DDS Permissions

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

DDS is a project-level service deployed and accessed in specific physical regions. To assign GaussDB NoSQL permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing DDS, users need to switch to a region where they have been authorized to use DDS.

You can grant users permissions by using roles and policies.

Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. This mechanism provides only a limited number of service-level roles for authorization. When using roles to grant permissions, you need to also assign other roles on which the permissions depend to take effect. However, roles are not an ideal choice for fine-grained authorization and secure access control.
Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, you can grant DDS users only the permissions for managing a certain type of resources.

Table 1 lists all the system-defined roles and policies supported by DDS.

**Table 1** System-defined roles and policies supported by DDS
Policy Name/System Role	Description	Type	Dependency
DDS FullAccess	All operations on DDS.	System-defined policy	None
DDS ReadOnlyAccess	Read-only permissions for DDS resources. Users granted these permissions can only view DDS data.	System-defined policy	None
DDS ManageAccess	DBA permissions on DDS except the DDS DB instance deletion operations.	System-defined policy	None
DDS Administrator	DDS administrator, who has all permissions of the service.	System-defined role	The Tenant Guest and Tenant Administrator roles need to be assigned in the same project.

Table 2 lists the common operations supported by each system-defined policy or role of DDS. Select the policies or roles as required.

**Table 2** Common operations supported by the DDS system policy
Operation	DDS FullAccess	DDS ReadOnlyAccess	DDS ManageAccess	DDS Administrator
Creating an instance	√	x	√	√
Querying DB instances	√	√	√	√
Deleting a DB instance	√	x	x	√
Restarting a DB instance	√	x	√	√
Performing a primary/secondary switchover	√	x	√	√
Modifying the port	√	x	√	√
Resetting a password	√	x	√	√
Modified SSL	√	x	√	√
Modifying a security group	√	x	√	√
Binding and unbinding an EIP	√	x	√	√
Scaling up storage space	√	x	√	√
Changing DB instance classes	√	x	√	√
Adding nodes	√	x	√	√
Deleting the node that fails to be added	√	x	×	√
Modifying an automated backup policy	√	x	√	√
Renaming a DB instance	√	x	√	√
Changing a private IP address	√	x	√	√
Changing the parameter template associated with the node in a DB instance	√	x	√	√
Showing original slow logs	√	x	√	√
Enabling or disabling local log auditing	√	x	√	√
Downloading audit logs	√	x	√	√
Deleting audit logs	√	x	×	√
Downloading a backup file	√	x	√	√
Changing the billing mode from pay-per-use to yearly/monthly	√	x	√	√
Creating a manual backup	√	x	√	√
Querying the backup list	√	√	√	√
Restoring data to a new DB instance	√	x	√	√
Restoring to an existing DB instance	√	x	√	√
Deleting a backup	√	x	×	√
Creating a parameter template	√	x	√	√
Viewing parameter templates	√	√	√	√
Modifying a parameter template	√	x	√	√
Deleting a parameter template	√	x	×	√
Task Center list	√	x	√	√

Table 3 lists common DDS operations and corresponding actions. You can refer to this table to customize permission policies.

**Table 3** Common Operations and actions
Operation	Actions	Authorization Scope	Description
Instance creation page	vpc:vpcs:list vpc:subnets:get vpc:securityGroups:get	Supported: IAM projects Enterprise projects	The VPC, subnet, and security group are displayed on the instance creation page.
Creating an instance	dds:instance:create vpc:vpcs:list vpc:vpcs:get vpc:subnets:get vpc:securityGroups:get vpc:ports:get	Supported: IAM projects Enterprise projects	If the default VPC, subnet, and security group are used, the vpc:*:create permission must be configured. To create an encrypted instance, configure the KMS Administrator permission for the project.
Querying DB instances	dds:instance:list	Supported: IAM projects Enterprise projects	-
Querying details of a DB instance	dds:instance:list	Supported: IAM projects Enterprise projects	If the VPC, subnet, and security group need to be displayed on the instance details page, add the vpc::get and vpc::list actions.
Exporting DB instance lists	dds:instance:list	Supported: IAM projects Enterprise projects	If the VPC, subnet, and security group are required, add the vpc::get and vpc::list actions.
Deleting a DB instance	dds:instance:deleteInstance	Supported: IAM projects Enterprise projects	When deleting a DB instance, delete the IP address on the data side.
Restarting a DB instance	dds:instance:reboot	Supported: IAM projects Enterprise projects	-
Performing a primary/secondary switchover	dds:instance:switchover	Supported: IAM projects Enterprise projects	-
Changing a port	dds:instance:modifyPort	Supported: IAM projects Enterprise projects	-
Resetting a password	dds:instance:resetPasswd	Supported: IAM projects Enterprise projects	-
Modified SSL	dds:instance:modifySSL	Supported: IAM projects Enterprise projects	-
Modifying a security group	dds:instance:modifySecurityGroup	Supported: IAM projects Enterprise projects	-
Binding an EIP	dds:instance:bindPublicIp	Supported: IAM projects	When binding an EIP, you need to query the created EIP. Enterprise projects are not supported. Fine-grained authentication is not supported.
Unbinding an EIP	dds:instance:unbindPublicIp	Supported: IAM projects	Enterprise projects are not supported. Fine-grained authentication is not supported.
Scaling up storage space	dds:instance:extendVolume	Supported: IAM projects Enterprise projects	-
Changing DB instance classes	dds:instance:modifySpec	Supported: IAM projects Enterprise projects	-
Adding nodes	dds:instance:extendNode vpc:vpcs:list vpc:vpcs:get vpc:subnets:get vpc:securityGroups:get vpc:ports:get	Supported: IAM projects Enterprise projects	-
Deleting the node that fails to be added	dds:instance:extendNode	Supported: IAM projects Enterprise projects	If the IP address has been created but the subsequent procedure fails, delete the IP address on the data side.
Modifying an automated backup policy	dds:instance:modifyBackupPolicy	Supported: IAM projects Enterprise projects	-
Renaming a DB instance	dds:instance:modify	Supported: IAM projects Enterprise projects	-
Changing a private IP address	dds:instance:modifyVIP vpc:subnets:get vpc:ports:get	Supported: IAM projects Enterprise projects	Before changing the private IP address, query available IP addresses.
Changing the parameter template associated with the node in a DB instance	dds:instance:modifyParameter	Supported: IAM projects Enterprise projects	-
Showing original slow logs	dds:instance:modifySlowLogPlaintextSwitch	Supported: IAM projects Enterprise projects	-
Enabling or disabling local log auditing	dds:instances:modifyAuditLogSwitch	Supported: IAM projects Enterprise projects	-
Downloading audit logs	dds:instances:downloadAuditLog	Supported: IAM projects Enterprise projects	-
Deleting audit logs	dds:instance:deleteAuditLog	Supported: IAM projects Enterprise projects	-
Downloading a backup file	dds:backup:download	Supported: IAM projects Enterprise projects	-
Changing the billing mode from pay-per-use to yearly/monthly	dds:instances:renew	Supported: IAM projects Enterprise projects	-
Creating a Manual Backup	dds:instance:createManualBackup	Supported: IAM projects Enterprise projects	-
Querying the backup list	dds:backup:list	Supported: IAM projects Enterprise projects	-
Restoring data to a new DB instance	dds:backup:createInstanceFromBackup vpc:vpcs:list vpc:vpcs:get vpc:subnets:get vpc:securityGroups:get vpc:ports:get	Supported: IAM projects Enterprise projects	The KMS Administrator permission needs to be configured for the encrypted instance in the project.
Restoring to an existing DB instance	dds:backup:refreshInstanceFromBackup	Supported: IAM projects Enterprise projects	-
Deleting a backup	dds:backup:delete	Supported: IAM projects Enterprise projects	-
Creating a parameter template	dds:param:create	Supported: IAM projects Enterprise projects	-
Viewing parameter templates	dds:param:list	Supported: IAM projects Enterprise projects	-
Modifying a parameter template	dds:param:modify	Supported: IAM projects Enterprise projects	-
Deleting a parameter template	dds:param:delete	Supported: IAM projects Enterprise projects	-
Task Center list	dds:task:list	Supported: IAM projects Enterprise projects	-