Permission Management

If you need to assign different permissions to employees in your enterprise to access your DAS resources, IAM is a good choice for fine-grained permission management. IAM provides identity authentication, permission assignment, and access control, helping you securely manage access to your Huawei Cloud resources. If your account does not require IAM for permission management, you can skip this section.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can control access to specific Huawei Cloud resources. For example, some of your employees are responsible for software development. To grant them the permission to use DAS but not the permission to delete DAS resources, you can use IAM.

IAM supports role/policy-based authorization and identity policy-based authorization.

The following table describes the differences between these two authorization models.

**Table 1** Differences between two authorization models
Authorization Model	Core Relationship	Permission	Authorization Method	Scenario
Role/Policy	User-permission-authorization scope	System-defined role System-defined policy Custom policy	Assigning roles or policies to principals	To authorize a user, you need to add it to a user group first and then specify the scope of authorization. It provides a limited number of condition keys and cannot meet the requirements of fine-grained permissions control. This method is suitable for small- and medium-sized enterprises.
Identity policy	User-policy	System-defined policy Custom identity policies	Assigning identity policies to principals Attaching identity policies to principals	You can authorize a user by attaching an identity policy to it. User-specific authorization and a variety of key conditions allow for more fine-grained permissions control. However, this model can be hard to set up. It requires a certain amount of expertise and is suitable for medium- and large-sized enterprises.

Assume that you want to grant IAM users the permissions needed to create ECS instances in CN North-Beijing4 and OBS buckets in CN South-Guangzhou. With role/policy-based authorization, the administrator needs to create two custom policies and attach both to the IAM users. With identity policy-based authorization, the administrator only needs to create one custom policy, configure the condition key g:RequestedRegion for the policy, and then attach the policy to the users or grant the users the access permissions to the specified regions. Identity policy-based authorization is more flexible than role/policy-based authorization.

Policies/identity policies and actions in the two authorization models are not interoperable. You are advised to use the identity policy-based authorization model. Role/Policy-based Authorization and Identity Policy-based Authorization describe system-defined permissions in the two authorization models.

For more information about IAM, see IAM Service Overview.

Role/Policy-based Authorization

DAS supports role/policy-based authorization. New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and then attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services.

DAS is a project-level service deployed in specific physical regions. When you set Scope to Region-specific projects and select the specified projects (for example, ap-southeast-2) in the specified regions (for example, AP-Bangkok), the users only have permissions for resources in the selected projects. If you set Scope to All resources, the users have permissions for resources in all region-specific projects. When accessing DAS, you need to switch to a region where you have been authorized to use this service.

Table 2 lists all the system-defined permissions of DAS. System-defined policies in role/policy-based authorization are not interoperable with those in identity policy-based authorization.

**Table 2** DAS system-defined permissions
Policy Name/System Role	Description	Type	Dependency
DAS Administrator	DAS administrator with all permissions on DAS	System-defined role	This role depends on the Tenant Guest role. The DAS Administrator and Tenant Guest roles must be assigned in the same project.
DAS FullAccess	All permissions on DAS	System-defined policy	None
DAS ReadOnlyAccess	Read-only permission on DAS	System-defined policy	None

Table 3 lists common operations supported by system-defined permissions of DAS.

**Table 3** Common operations and system-defined permissions
Operation	DAS Administrator	DAS FullAccess	DAS ReadOnlyAccess
Logging in to a database	Supported	Supported	Not supported
Adding a database connection	Supported	Supported	Not supported
Modifying a database connection	Supported	Supported	Not supported
Deleting a database connection	Supported	Supported	Not supported
Viewing the database connection list in Development Tool	Supported	Supported	Supported
Using Intelligent O&M	Supported	Supported	Supported
Executing a SQL diagnosis task	Supported	Supported	Not supported
Exporting all query logs	Supported	Supported	Supported
Subscribing to daily reports	Supported	Supported	Not supported
Exporting slow query logs	Supported	Supported	Supported
Querying all query logs	Supported	Supported	Supported
Querying slow query logs	Supported	Supported	Supported
Viewing the Intelligent O&M page	Supported	Supported	Supported
Querying top SQL statements	Supported	Supported	Supported
Querying the daily report list	Supported	Supported	Supported
Querying a SQL execution plan	Supported	Supported	Not supported

Identity Policy-based Authorization

DAS supports authorization with identity policies. Table 4 lists all the system-defined identity policies for DAS. System-defined policies in identity policy-based authorization are not interoperable with those in role/policy-based authorization.

**Table 4** DAS system-defined identity policies
Identity Policy Name	Description	Type
DASFullAccessPolicy	All permissions on DAS	System-defined identity policy
DASReadOnlyPolicy	Read-only permission on DAS	System-defined identity policy

Table 5 lists the common operations supported by system policies for DAS.

**Table 5** Common operations supported by system policies
Operation	DASFullAccessPolicy	DASReadOnlyPolicy
Logging in to a database	Supported	Not supported
Adding a database connection	Supported	Not supported
Modifying a database connection	Supported	Not supported
Deleting a database connection	Supported	Not supported
Viewing the database connection list in Development Tool	Supported	Supported
Using Intelligent O&M	Supported	Supported
Executing a SQL diagnosis task	Supported	Not supported
Exporting all query logs	Supported	Supported
Subscribing to daily reports	Supported	Not supported
Exporting slow query logs	Supported	Supported
Querying all query logs	Supported	Supported
Querying slow query logs	Supported	Supported
Viewing the Intelligent O&M page	Supported	Supported
Querying top SQL statements	Supported	Supported
Querying the daily report list	Supported	Supported
Querying a SQL execution plan	Supported	Not supported