Permissions

If you need to assign different permissions to personnel in your enterprise to access your TaurusDB resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you securely manage access to your resources.

With IAM, you can create IAM users and assign permissions to control their access to specific resources. For example, if you want some software developers in your enterprise to use TaurusDB resources but do not want them to delete TaurusDB resources or perform any other high-risk operations, you can create IAM users for the software developers and grant them only the permissions required for using TaurusDB resources.

If your account does not require individual IAM users for permissions management, you can skip this section.

TaurusDB Permissions

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

TaurusDB is a project-level service deployed in specific physical regions. To assign TaurusDB permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will be granted to the user group in all region-specific projects. When accessing TaurusDB, the users need to switch to a region where they have been authorized to use this service.

You can grant permissions by using roles and policies.

Roles: A coarse-grained authorization strategy provided by IAM to assign permissions based on users' job responsibilities. Only a limited number of service-level roles are available for authorization. Cloud services depend on each other. When you grant permissions using roles, you also need to attach any existing role dependencies. Roles are not ideal for fine-grained authorization and least privilege access.

Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for least permission access.

Table 1 lists all the system-defined permissions for TaurusDB.

**Table 1** System-defined roles and policies supported by TaurusDB
Policy	Description	Type
GaussDB FullAccess	Full permissions for TaurusDB	System-defined policy
GaussDB ReadOnlyAccess	Read-only permissions for TaurusDB	System-defined policy

Table 2 lists the common operations supported by each system-defined policy or role of TaurusDB. Choose appropriate system policies based on this table.

**Table 2** Common operations supported by each system-defined policy or role of TaurusDB
Operation	GaussDB FullAccess	GaussDB ReadOnlyAccess
Creating an instance	Supported	Not supported
Deleting an instance	Supported	Not supported
Querying an instance list	Supported	Supported

**Table 3** Common operations and supported actions
Operation	Action	Description
Modifying parameters in a parameter template	taurusdb:param:modify	-
Changing DB instance specifications	taurusdb:instance:modifySpec	-
Creating a DB instance	taurusdb:instance:create	To select a VPC, subnet, and security group, configure the following actions: vpc:vpcs:list vpc:vpcs:get vpc:subnets:get vpc:securityGroups:get To create an encrypted instance, configure the KMS Administrator permission for the project.
Creating a manual backup	taurusdb:backup:create	-
Querying backups	taurusdb:backup:list	-
Querying error logs	taurusdb:log:list	-
Rebooting a DB instance	taurusdb:instance:restart	-
Querying DB instances	taurusdb:instance:list	-
Creating a parameter template	taurusdb:param:create	-
Deleting a parameter template	taurusdb:param:delete	-
Modifying a backup policy	taurusdb:instance:modifyBackupPolicy	-
Viewing parameter templates	taurusdb:param:list	-
Deleting a DB instance	taurusdb:instance:delete	-
Deleting a manual backup	taurusdb:backup:delete	-
Querying project tags	taurusdb:tag:list	-
Applying a parameter template	taurusdb:param:apply	-
Adding or deleting project tags in batches	taurusdb:instance:dealTag	-
Changing quotas	taurusdb:quota:modify	-
Upgrading a DB instance version	taurusdb:instance:upgrade	-
Promoting a read replica to the primary node	taurusdb:instance:switchover	-
Changing a database port	taurusdb:instance:modifyPort	-
Changing a security group	taurusdb:instance:modifySecurityGroup	-
Changing the private IP address	taurusdb:instance:modifyIp	To select an IP address, configure the following actions: vpc:vpcs:list vpc:vpcs:get
Enabling or disabling SSL	taurusdb:instance:modifySSL	-
Changing an instance name	taurusdb:instance:rename	-
Adding read replicas	taurusdb:instance:addNodes	-
Deleting read replicas	taurusdb:instance:deleteNodes	-
Scaling storage space	taurusdb:instance:modifyStorageSize	-
Changing a DB instance password	taurusdb:instance:modifyPassword	-
Binding an EIP to a DB instance	taurusdb:instance:bindPublicIp	To display EIPs on the console, configure: vpc:publicIps:get vpc:publicIps:list
Unbinding an EIP from a DB instance	taurusdb:instance:unbindPublicIp	-
Modifying a monitoring policy	taurusdb:instance:modifyMonitorPolicy	-
Changing a failover priority	taurusdb:instance:modifySwitchoverPriority	-
Changing the maintenance window	taurusdb:instance:modifyMaintenanceWindow	-
Isolating nodes	taurusdb:instance:isolateNodes	-
Creating database users	taurusdb:user:create	-
Deleting database users	taurusdb:user:delete	-
Changing the password of a database user	taurusdb:user:modify	-
Querying database users	taurusdb:user:list	-
Authorizing database permissions to users	taurusdb:user:grantPrivilege	-
Revoking database permissions from users	taurusdb:user:revokePrivilege	-
Creating databases	taurusdb:database:create	-
Deleting databases	taurusdb:database:delete	-
Querying databases	taurusdb:database:list	-
Querying predefined tags	-	To query predefined tags, configure the following action: tms:resourceTags:list