Updated on 2022-09-16 GMT+08:00

Permissions Management

If you need to assign different permissions to employees in your enterprise to access your DDS resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your Huawei Cloud resources.

With IAM, you can use your Huawei Cloud account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, some software developers in your enterprise need to use DDS resources but must not delete them or perform any high-risk operations. To achieve this result, you can create IAM users for the software developers and grant them only the permissions required for using DDS resources.

If your Huawei Cloud account does not need individual IAM users for permissions management, you may skip over this topic.

IAM can be used free of charge. You pay only for the resources in your account.

DDS Permissions

By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.

DDS is a project-level service deployed and accessed in specific physical regions. To assign GaussDB NoSQL permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing DDS, users need to switch to a region where they have been authorized to use DDS.

You can grant users permissions by using roles and policies.

  • Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. This mechanism provides only a limited number of service-level roles for authorization. When using roles to grant permissions, you need to also assign other roles on which the permissions depend to take effect. However, roles are not an ideal choice for fine-grained authorization and secure access control.
  • Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, you can grant DDS users only the permissions for managing a certain type of resources.

Table 1 lists all the system-defined roles and policies supported by DDS.

Table 1 System-defined roles and policies supported by DDS

Policy Name/System Role

Description

Type

Dependency

DDS FullAccess

All operations on DDS.

System-defined policy

None

DDS ReadOnlyAccess

Read-only permissions for DDS resources. Users granted these permissions can only view DDS data.

System-defined policy

None

DDS ManageAccess

DBA permissions on DDS except the DDS DB instance deletion operations.

System-defined policy

None

DDS Administrator

DDS administrator, who has all permissions of the service.

System-defined role

The Tenant Guest and Tenant Administrator roles need to be assigned in the same project.

Table 2 lists the common operations supported by each system-defined policy or role of DDS. Select the policies or roles as required.

Table 2 Common operations supported by the DDS system policy

Operation

DDS FullAccess

DDS ReadOnlyAccess

DDS ManageAccess

DDS Administrator

Creating an instance

x

Querying DB instances

Deleting a DB instance

x

x

Restarting a DB instance

x

Performing a primary/secondary switchover

x

Modifying the port

x

Resetting a password

x

Modified SSL

x

Modifying a security group

x

Binding and unbinding an EIP

x

Scaling up storage space

x

Changing DB instance classes

x

Adding nodes

x

Deleting the node that fails to be added

x

×

Modifying an automated backup policy

x

Renaming a DB instance

x

Changing a private IP address

x

Changing the parameter template associated with the node in a DB instance

x

Showing original slow logs

x

Enabling or disabling local log auditing

x

Downloading audit logs

x

Deleting audit logs

x

×

Downloading a backup file

x

Changing the billing mode from pay-per-use to yearly/monthly

x

Creating a manual backup

x

Querying the backup list

Restoring data to a new DB instance

x

Restoring to an existing DB instance

x

Deleting a backup

x

×

Creating a parameter template

x

Viewing parameter templates

Modifying a parameter template

x

Deleting a parameter template

x

×

Task Center list

x

Table 3 lists common DDS operations and corresponding actions. You can refer to this table to customize permission policies.

Table 3 Common Operations and actions

Operation

Actions

Authorization Scope

Description

Instance creation page

  • vpc:vpcs:list
  • vpc:subnets:get
  • vpc:securityGroups:get

Supported:

  • IAM projects
  • Enterprise projects

The VPC, subnet, and security group are displayed on the instance creation page.

Creating an instance

  • dds:instance:create
  • vpc:vpcs:list
  • vpc:vpcs:get
  • vpc:subnets:get
  • vpc:securityGroups:get
  • vpc:ports:get

Supported:

  • IAM projects
  • Enterprise projects

If the default VPC, subnet, and security group are used, the vpc:*:create permission must be configured.

To create an encrypted instance, configure the KMS Administrator permission for the project.

Querying DB instances

dds:instance:list

Supported:

  • IAM projects
  • Enterprise projects

-

Querying details of a DB instance

dds:instance:list

Supported:

  • IAM projects
  • Enterprise projects

If the VPC, subnet, and security group need to be displayed on the instance details page, add the vpc:*:get and vpc:*:list actions.

Exporting DB instance lists

dds:instance:list

Supported:

  • IAM projects
  • Enterprise projects

If the VPC, subnet, and security group are required, add the vpc:*:get and vpc:*:list actions.

Deleting a DB instance

dds:instance:deleteInstance

Supported:

  • IAM projects
  • Enterprise projects

When deleting a DB instance, delete the IP address on the data side.

Restarting a DB instance

dds:instance:reboot

Supported:

  • IAM projects
  • Enterprise projects

-

Performing a primary/secondary switchover

dds:instance:switchover

Supported:

  • IAM projects
  • Enterprise projects

-

Changing a port

dds:instance:modifyPort

Supported:

  • IAM projects
  • Enterprise projects

-

Resetting a password

dds:instance:resetPasswd

Supported:

  • IAM projects
  • Enterprise projects

-

Modified SSL

dds:instance:modifySSL

Supported:

  • IAM projects
  • Enterprise projects

-

Modifying a security group

dds:instance:modifySecurityGroup

Supported:

  • IAM projects
  • Enterprise projects

-

Binding an EIP

dds:instance:bindPublicIp

Supported:

  • IAM projects

When binding an EIP, you need to query the created EIP.

  • Enterprise projects are not supported.
  • Fine-grained authentication is not supported.

Unbinding an EIP

dds:instance:unbindPublicIp

Supported:

  • IAM projects
  • Enterprise projects are not supported.
  • Fine-grained authentication is not supported.

Scaling up storage space

dds:instance:extendVolume

Supported:

  • IAM projects
  • Enterprise projects

-

Changing DB instance classes

dds:instance:modifySpec

Supported:

  • IAM projects
  • Enterprise projects

-

Adding nodes

  • dds:instance:extendNode
  • vpc:vpcs:list
  • vpc:vpcs:get
  • vpc:subnets:get
  • vpc:securityGroups:get
  • vpc:ports:get

Supported:

  • IAM projects
  • Enterprise projects

-

Deleting the node that fails to be added

dds:instance:extendNode

Supported:

  • IAM projects
  • Enterprise projects

If the IP address has been created but the subsequent procedure fails, delete the IP address on the data side.

Modifying an automated backup policy

dds:instance:modifyBackupPolicy

Supported:

  • IAM projects
  • Enterprise projects

-

Renaming a DB instance

dds:instance:modify

Supported:

  • IAM projects
  • Enterprise projects

-

Changing a private IP address

  • dds:instance:modifyVIP
  • vpc:subnets:get
  • vpc:ports:get

Supported:

  • IAM projects
  • Enterprise projects

Before changing the private IP address, query available IP addresses.

Changing the parameter template associated with the node in a DB instance

dds:instance:modifyParameter

Supported:

  • IAM projects
  • Enterprise projects

-

Showing original slow logs

dds:instance:modifySlowLogPlaintextSwitch

Supported:

  • IAM projects
  • Enterprise projects

-

Enabling or disabling local log auditing

dds:instances:modifyAuditLogSwitch

Supported:

  • IAM projects
  • Enterprise projects

-

Downloading audit logs

dds:instances:downloadAuditLog

Supported:

  • IAM projects
  • Enterprise projects

-

Deleting audit logs

dds:instance:deleteAuditLog

Supported:

  • IAM projects
  • Enterprise projects

-

Downloading a backup file

dds:backup:download

Supported:

  • IAM projects
  • Enterprise projects

-

Changing the billing mode from pay-per-use to yearly/monthly

dds:instances:renew

Supported:

  • IAM projects
  • Enterprise projects

-

Creating a Manual Backup

dds:instance:createManualBackup

Supported:

  • IAM projects
  • Enterprise projects

-

Querying the backup list

dds:backup:list

Supported:

  • IAM projects
  • Enterprise projects

-

Restoring data to a new DB instance

  • dds:backup:createInstanceFromBackup
  • vpc:vpcs:list
  • vpc:vpcs:get
  • vpc:subnets:get
  • vpc:securityGroups:get
  • vpc:ports:get

Supported:

  • IAM projects
  • Enterprise projects

The KMS Administrator permission needs to be configured for the encrypted instance in the project.

Restoring to an existing DB instance

dds:backup:refreshInstanceFromBackup

Supported:

  • IAM projects
  • Enterprise projects

-

Deleting a backup

dds:backup:delete

Supported:

  • IAM projects
  • Enterprise projects

-

Creating a parameter template

dds:param:create

Supported:

  • IAM projects
  • Enterprise projects

-

Viewing parameter templates

dds:param:list

Supported:

  • IAM projects
  • Enterprise projects

-

Modifying a parameter template

dds:param:modify

Supported:

  • IAM projects
  • Enterprise projects

-

Deleting a parameter template

dds:param:delete

Supported:

  • IAM projects
  • Enterprise projects

-

Task Center list

dds:task:list

Supported:

  • IAM projects
  • Enterprise projects

-