Help Center/ Relational Database Service/ API Reference/ Permissions and Supported Actions/ Actions Supported by Policy-based Authorization
Updated on 2026-09-20 GMT+08:00

Actions Supported by Policy-based Authorization

This section describes the actions supported by RDS in policy-based authorization.

Supported Actions

RDS provides system-defined policies that can be directly used in IAM. You can also create custom policies to supplement system-defined policies for more refined access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:

  • Permissions: statements that allow or deny certain operations.
  • APIs: REST APIs that can be called by a user who has been granted specific permissions
  • Actions: specific operations that are allowed or denied in a custom policy
  • Dependencies: actions which a specific action depends on. When allowing an action for a user, you also need to allow any existing action dependencies for that user.
  • IAM projects/Enterprise projects: the authorization scope of a custom policy. A custom policy can be applied to IAM projects or enterprise projects or both. Policies that contain actions for both IAM and enterprise projects can be used and applied for both IAM and Enterprise Management. Policies that contain actions only for IAM projects can be used and applied to IAM only. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. For details about the differences between IAM and enterprise management, see Differences Between IAM and Enterprise Management.

RDS supports the following actions in custom policies:

Table 1 Common query actions

Permission

API

Action

IAM Project

Enterprise Project

Querying the DB engine version

GET /v3/{projectId}/datastores/{database_name}

rds:instance:listDatabaseVersion

√

√

Querying the database minor version

GET /v3/{project_id}/datastores/{database_name}/small-version

rds:instance:list

√

√

Querying database specifications

GET /v3/{project_id}/flavors/{database_name}?version_name={version_name}

rds:instance:listFlavors

√

√

Querying the storage type

GET /v3/{project_id}/storage-type/{database_name}?version_name={version_name}

rds:instance:listStorageType

√

√

Querying the features supported by an edition (RDS for SQL Server)

GET /v3/{project_id}/major-version-feature

rds:instance:listAll

√

√

Table 2 v3.1 APIs

Permission

API

Action

IAM Project

Enterprise Project

Applying a parameter template

PUT /v3.1/{project_id}/configurations/{config_id}/apply

rds:param:apply

√

√

Modifying parameters of a specified DB instance

PUT /v3.1/{project_id}/instances/{instance_id}/configurations

rds:param:modify

√

√

Restoring data to an existing or original DB instance

POST /v3.1/{project_id}/instances/recovery

rds:instance:restoreInPlace

√

√

Restoring tables to a point in time (RDS for MySQL)

POST /v3.1/{project_id}/instances/{instance_id}/restore/tables

rds:instance:tableRestore

√

√

Deleting a database (RDS for SQL Server)

DELETE /v3.1/{project_id}/instances/{instance_id}/database/{db_name}

rds:database:drop

√

√

Querying slow query log statistics

POST /v3.1/{project_id}/instances/{instance_id}/slow-logs/statistics

rds:log:list

√

√

Table 3 Instance management actions

Permission

API

Action

IAM Project

Enterprise Project

Creating a DB instance

POST /v3/{project_id}/instances

rds:instance:create

(To create an encrypted DB instance, you need to configure the KMS Administrator permission in the project.)

√

√

Stopping a DB instance

POST /v3/{project_id}/instances/{instance_id}/action/shutdown

rds:instance:operateServer

√

√

Starting a DB instance

POST /v3/{project_id}/instances/{instance_id}/action/startup

rds:instance:operateServer

√

√

Changing a DB instance name

PUT /v3/{project_id}/instances/{instance_id}/name

rds:instance:modify

√

√

Changing a DB instance description

PUT /v3/{project_id}/instances/{instance_id}/alias

rds:instance:modify

√

√

Applying for a private domain name

POST /v3/{project_id}/instances/{instance_id}/create-dns

rds:instance:createDns

√

√

Modifying a private domain name

PUT /v3/{project_id}/instances/{instance_id}/modify-dns

rds:instance:modifyDns

√

√

Querying the domain name of a DB instance

GET /v3/{project_id}/instances/{instance_id}/dns

rds:instance:list

√

√

Querying the IPv6 domain name of a DB instance

GET /v3/{project_id}/instances/{instance_id}/dns-ipv6

rds:instance:list

√

√

Obtaining the replication status of a DB instance

GET /v3/{project_id}/instances/{instance_id}/replication/status

rds:instance:list

√

√

Changing DB instance specifications

POST /v3/{project_id}/instances/{instance_id}/action

rds:instance:modifySpec

√

√

Batch changing instance specifications

POST /v3/{project_id}/instances/batch/resize

rds:instance:modifySpec

√

√

Scaling up storage space

POST /v3/{project_id}/instances/{instance_id}/action

rds:instance:extendSpace

√

√

Configuring an autoscaling policy

PUT /v3/{project_id}/instances/{instance_id}/disk-auto-expansion

rds:instance:extendSpace

√

√

Querying an autoscaling policy

GET /v3/{project_id}/instances/{instance_id}/disk-auto-expansion

rds:instance:list

√

√

Changing a DB instance type from single to primary/standby

POST /v3/{project_id}/instances/{instance_id}/action

rds:instance:singleToHa

(The KMS Administrator permission needs to be configured for the encrypted DB instance in the project.)

√

√

Rebooting a DB instance

POST /v3/{project_id}/instances/{instance_id}/action

rds:instance:restart

√

√

Deleting a DB instance

DELETE /v3/{project_id}/instances/{instance_id}

rds:instance:delete

√

√

Choosing whether to retain automated backups when deleting an instance (RDS for SQL Server)

POST /v3/{project_id}/instances/{instance_id}/backups/delete-selection

rds:backup:delete

√

√

Batch deleting DB instances

POST /v3/{project_id}/instances/batch-delete

rds:instance:delete

√

√

Querying DB instances

GET /v3/{project_id}/instances

rds:instance:list

√

√

Binding or unbinding an EIP

PUT /v3/{project_id}/instances/{instance_id}/public-ip

rds:instance:modifyPublicAccess

√

√

Changing the failover priority

PUT /v3/{project_id}/instances/{instance_id}/failover/strategy

rds:instance:modifyStrategy

√

√

Switching between the primary and standby DB instances

PUT /v3/{project_id}/instances/{instance_id}/failover

rds:instance:switchover

√

√

Changing the data replication mode

PUT /v3/{project_id}/instances/{instance_id}/failover/mode

rds:instance:modifySynchronizeModel

√

√

Changing read/write permissions

PUT /v3/{project_id}/instances/{instance_id}/readonly-status

rds:instance:openReadonly

√

√

Migrating a standby DB instance

POST /v3/{project_id}/instances/{instance_id}/migrateslave

rds:instance:create

√

√

Configuring a maintenance window

PUT /v3/{project_id}/instances/{instance_id}/ops-window

rds:instance:modify

√

√

Upgrading the minor version of a DB instance

POST /v3/{project_id}/instances/{instance_id}/db-upgrade

rds:instance:modify

√

√

Configuring a Monitoring by Seconds policy

PUT /v3/{project_id}/instances/{instance_id}/second-level-monitor

rds:log:switch

√

√

Querying a Monitoring by Seconds policy

GET /v3/{project_id}/instances/{instance_id}/second-level-monitor

rds:log:list

√

√

Replacing read replicas with standby nodes

POST /v3/{project_id}/instances/{instance_id}/replace-node

rds:instance:update

√

√

Querying top SQL information

GET /v3/{project_id}/instances/{instance_id}/top-sqls

rds:instance:listAll

√

√

Querying the auto scaling policy of a DB instance

GET /v3/{project_id}/instances/{instance_id}/auto-scaling/policy

rds:instance:list

√

√

Rebuilding a standby instance

PUT /v3/{project_id}/instances/{instance_id}/rebuild

rds:instance:modify

√

√

Querying the status of a rebuilt standby instance

GET /v3/{project_id}/instances/{instance_id}/rebuild

rds:instance:list

√

√

Table 4 DR instance actions

Permission

API

Action

IAM Project

Enterprise Project

Configuring DR capabilities for a primary DB instance

POST

/v3/{project_id}/instances/{instance_id}/action

rds:instance:buildDrRelation

√

√

Configuring DR capabilities for a DR instance

POST

/v3/{project_id}/instances/{instance_id}/action

rds:instance:buildDrRelation

√

√

Promoting a DR instance to primary

POST

/v3/{project_id}/instances/{instance_id}/action

rds:instance:modifyDRRole

√

√

Querying the DR replication status

GET /v3/{project_id}/instances/{instance_id}/disaster-recovery

rds:instance:list

√

√

Querying DR instances in batches

GET /v3/{project_id}/instances/disaster-recovery-relation

rds:instance:list

√

√

Querying primary or DR instances available for setting up disaster recovery

GET /v3/{project_id}/instances/disaster-recovery-instance?type={type}

rds:instance:list

√

√

Table 5 Hot and cold data separation actions

Permission

API

Action

IAM Project

Enterprise Project

Querying the status of hot and cold data separation

GET /v3/{project_id}/instances/{instance_id}/hot-cold-separation/status

rds:coldTable:query

√

√

Table 6 Historical session analysis actions

Permission

API

Action

IAM Project

Enterprise Project

Querying historical sessions

GET /v3/{project_id}/instances/{instance_id}/history-session?start_time={start_time}&end_time={end_time}

rds:instance:list

√

√

Querying historical wait events

GET /v3/{project_id}/instances/{instance_id}/history-wait-event?start_time={start_time}&end_time={end_time}

rds:instance:list

√

√

Querying historical top SQL (instantaneous)

GET /v3/{project_id}/instances/{instance_id}/history-top-sql?start_time={start_time}&end_time={end_time}

rds:instance:list

√

√

Querying download information about historical session analysis

GET /v3/{project_id}/instances/{instance_id}/history-session-analyse-upload?type={type}

rds:instance:list

√

√

Uploading historical session analysis

POST /v3/{project_id}/instances/{instance_id}/history-session-analyse-upload

rds:instance:list

√

√

Table 7 Data migration actions

Permission

API

Action

IAM Project

Enterprise Project

Creating a DRS synchronization task

POST /v3/{project_id}/instances/{instance_id}/drs-job/create

rds:database:create

√

√

Query ongoing DRS synchronization tasks of a DB instance

GET /v3/{project_id}/instances/{instance_id}/drs-job/name

rds:database:list

√

√

Table 8 Database security actions

Permission

API

Action

IAM Project

Enterprise Project

Configuring SSL

PUT /v3/{project_id}/instances/{instance_id}/ssl

rds:instance:modifySSL

√

√

Obtaining the SSL certificate download address

GET /v3/{project_id}/instances/{instance_id}/ssl-cert/download-link

rds:instance:modifySSL

√

√

Changing a database port

PUT /v3/{project_id}/instances/{instance_id}/port

rds:instance:modifyPort

√

√

Changing a security group

PUT /v3/{project_id}/instances/{instance_id}/security-group

rds:instance:modifySecurityGroup

√

√

Changing a floating IP address

PUT /v3/{project_id}/instances/{instance_id}/ip

rds:instance:modifyIp

√

√

Verifying weak passwords

POST /v3/{project_id}/weakpwd

rds:password:verify

√

√

Table 9 Session killing actions

Permission

API

Action

IAM Project

Enterprise Project

Killing sessions

PUT /v3/{project_id}/instances/{instance_id}/ops/intelligent-kill-session

rds:instance:modify

√

√

Querying the killing history

GET /v3/{project_id}/instances/{instance_id}/ops/intelligent-kill-session/history

rds:instance:list

√

√

Querying real-time statistics of killing sessions (RDS for MySQL)

GET /v3/{project_id}/instances/{instance_id}/ops/intelligent-kill-session/statistic

rds:instance:list

√

√

Table 10 Backup and restoration actions

Permission

API

Action

IAM Project

Enterprise Project

Configuring an automated backup policy

PUT /v3/{project_id}/instances/{instance_id}/backups/policy

rds:instance:modifyBackupPolicy

√

√

Configuring a cross-region backup policy

PUT /v3/{project_id}/instances/{instance_id}/backups/offsite-policy

rds:instance:modifyBackupPolicy

√

√

Querying an automated backup policy

GET /v3/{project_id}/instances/{instance_id}/backups/policy

rds:instance:list

√

√

Querying a cross-region backup policy

GET /v3/0483b6b16e954cb88930a360d2c4e663/instances/dsfae23fsfdsae3435in01/backups/offsite-policy

rds:instance:list

√

√

Modifying a sparse backup policy of a DB instance

POST /v3/{project_id}/instances/{instance_id}/backups/sparse-policy

rds:instance:modifyBackupPolicy

√

√

Querying sparse backup policies

GET /v3/{project_id}/instances/{instance_id}/backups/sparse-policy

rds:instance:list

√

√

Creating a manual backup

POST /v3/{project_id}/backups

rds:backup:create

√

√

Query the backup method of a DB instance

GET /v3/{project_id}/instances/{instance_id}/backups/config

rds:instance:getBackupConfiguration

√

√

Changing the backup method of a DB instance (RDS for PostgreSQL)

PUT /v3/{project_id}/instances/{instance_id}/backups/config

rds:instance:modifyBackupPolicy

√

√

Obtaining backups

GET /v3/{project_id}/backups?instance_id={instance_id}&backup_id={backup_id}&backup_type={backup_type}&offset={offset}&limit={limit}&begin_time={begin _time}&end_time={end_time}

rds:backup:list

√

√

Querying cross-region backups

GET /v3/{project_id}/offsite-backups?instance_id={instance_id}&backup_id={backup_id}&backup_type={backup_type}&offset={offset}&limit={limit}&begin_time={begin _time}&end_time={end_time}

rds:backup:list

√

√

Querying DB instances for which cross-region backups are created

GET /v3/backups/offsite-backup-instance?offset={offset}&limit={limit}

rds:instance:list

√

√

Obtaining the link for downloading a backup

GET /v3/{project_id}/backup-files?backup_id={backup_id}

rds:backup:download

√

√

Deleting a manual backup

DELETE /v3/{project_id}/backups/{backup_id}

rds:backup:delete

√

√

Querying the restoration time range

GET /v3/{project_id}/instances/{instance_id}/restore-time?date=2020-12-26

rds:instance:list

√

√

Querying the restoration time range of a cross-region backup

GET /v3/{project_id}/instances/{instance_id}/offsite-restore-time?date=2020-12-26

rds:instance:list

√

√

Restoring data to a new DB instance

POST /v3/{project_id}/instances

rds:instance:create

(The KMS Administrator permission needs to be configured for the encrypted DB instance in the project.)

√

√

Checking whether fast restoration can be used for restoring databases or tables (RDS for MySQL)

POST /v3/{project_id}/instances/fast-restore

rds:instance:tableRestore

√

√

Querying databases that can be restored to a specified point in time (RDS for MySQL)

POST /v3/{project_id}/{engine}/instances/history/databases

rds:backup:list

√

√

Restoring databases to a specified point in time (RDS for MySQL)

POST /v3/{project_id}/instances/batch/restore/databases

rds:instance:tableRestore

√

√

Querying merged binlog files for download

GET /v3/{project_id}/instances/{instance_id}/packlog/infos

rds:binlog:get

√

√

Querying the backup usage overview

GET

/v3/{project_id}/backups/backup-usage

rds:instance:list

√

√

Querying instance backup statistics

GET

/v3/{project_id}/instances/backups/summary

rds:instance:list

√

√

Querying shared backups

GET /v3/{project_id}/share-backups

rds:backup:listSharedResources

√

√

Modifying an incremental backup policy

PUT /v3/{project_id}/instances/{instance_id}/incre-backup/policy

rds:instance:modifyBackupPolicy

√

√

Obtaining an incremental backup policy

GET /v3/{project_id}/instances/{instance_id}/incre-backup/policy

rds:instance:getBackupPolicy

√

√

Table 11 Major version upgrade actions

Permission

API

Action

IAM Project

Enterprise Project

Querying the target version to which a DB instance can be upgraded (RDS for PostgreSQL)

GET /v3/{project_id}/instances/{instance_id}/major-version/available-version

rds:instance:list

√

√

Performing a major version upgrade pre-check for a DB instance (RDS for PostgreSQL)

POST /v3/{project_id}/instances/{instance_id}/major-version/inspection

rds:instance:list

√

√

Querying the major version check status or upgrade status of a DB instance (RDS for PostgreSQL)

GET /v3/{project_id}/instances/{instance_id}/major-version/status?action={current_action}

rds:instance:list

√

√

Querying the major version upgrade check history of a DB instance (RDS for PostgreSQL)

GET /v3/{project_id}/instances/{instance_id}/major-version/inspection-histories?offset={offset}&limit={limit}&order={order}&sort_field={sort_field}&target_version={target_version}&is_available={is_available}

rds:instance:list

√

√

Upgrading a major version of a DB instance (RDS for PostgreSQL)

POST /v3/{project_id}/instances/{instance_id}/major-version/upgrade

rds:instance:modify

√

√

Querying the major version upgrade history of a DB instance (RDS for PostgreSQL)

GET /v3/{project_id}/instances/{instance_id}/major-version/upgrade-histories?offset={offset}&limit={limit}&order={order}&sort_field={sort_field}

rds:instance:list

√

√

Table 12 Log query actions

Permission

API

Action

IAM Project

Enterprise Project

Querying slow query logs

POST /v3/{project_id}/instances/{instance_id}/slow-logs

rds:log:list

√

√

Querying error logs

POST /v3/{project_id}/instances/{instance_id}/error-logs

rds:log:list

√

√

Showing original logs

PUT /v3/{project_id}/instances/{instance_id}/slowlog-sensitization/{status}

rds:log:switch

√

√

Querying slow query log files (RDS for SQL Server)

GET /v3/{project_id}/instances/{instance_id}/slowlog-files

rds:log:list

√

√

Querying extended logs (RDS for SQL Server)

GET /v3/{project_id}/instances/{instance_id}/xellog-files

rds:log:list

√

√

Obtaining links for downloading extended logs (RDS for SQL Server)

POST /v3/{project_id}/instances/{instance_id}/xellog-download

rds:log:download

√

√

Obtaining the link for downloading slow query logs

POST /v3/{project_id}/instances/{instance_id}/slowlog-download

rds:log:download

√

√

Setting a policy for audit logs

PUT /v3/{project_id}/instances/{instance_id}/auditlog-policy

rds:auditlog:operate

√

√

Querying the policy for audit logs

GET /v3/{project_id}/instances/{instance_id}/auditlog-policy

rds:auditlog:list

√

√

Obtaining audit logs

GET /v3/{project_id}/instances/{instance_id}/auditlog?start_time={start_time}&end_time={end_time}&offset={offset}&limit={limit}

rds:auditlog:list

√

√

Obtaining the links for downloading audit logs

POST /v3/{project_id}/instances/{instance_id}/auditlog-links

rds:auditlog:download

√

√

Forcing rotation for audit logs

POST /v3/{project_id}/instances/{instance_id}/auditlog-rotate

rds:auditlog:rotate

√

√

Setting the local retention period of binlogs

PUT /v3/{project_id}/instances/{instance_id}/binlog/clear-policy

rds:binlog:setPolicy

√

√

Obtaining the local retention period of binlogs

GET /v3/{project_id}/instances/{instance_id}/binlog/clear-policy

rds:binlog:get

√

√

Querying LTS configurations

GET /v3/{project_id}/{engine}/instances/logs/lts-configs

rds:instance:listAll

√

√

Table 13 Monitoring and alarm reporting actions

Permission

API

Action

IAM Project

Enterprise Project

Querying the automatic alarm configuration of the current user

GET /v3/{project_id}/auto-ces-alarm

rds:instance:list

√

√

Table 14 Instance diagnosis actions

Permission

API

Action

IAM Project

Enterprise Project

Obtaining the number of instances after diagnosis

GET /v3/{project_id}/instances/diagnosis

rds:instance:list

√

√

Obtaining the result of a specific diagnosis item

GET /v3/{project_id}/instances/diagnosis/info

rds:instance:list

√

√

Table 15 Database proxy actions (RDS for MySQL)

Permission

API

Action

IAM Project

Enterprise Project

Enabling database proxy

POST /v3/{project_id}/instances/{instance_id}/proxy/open

rds:instance:modifyProxy

√

√

Querying database proxies

GET /v3/{project_id}/instances/{instance_id}/proxy-list

rds:instance:list

√

√

Querying database proxy specifications

GET /v3/{project_id}/instances/{instance_id}/proxy/flavors

rds:instance:list

√

√

Disabling database proxy

DELETE /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}

rds:instance:modifyProxy

√

√

Table 16 Database and account management actions (RDS for MySQL)

Permission

API

Action

IAM Project

Enterprise Project

Creating a database

POST /v3/{project_id}/instances/{instance_id}/database

rds:database:create

√

√

Querying databases

GET /v3/{project_id}/instances/{instance_id}/database/detail?page={page}&limit={limit}

rds:database:list

√

√

Modifying the database remarks of a DB instance

POST /v3/{project_id}/instances/{instance_id}/database/update

rds:database:create

√

√

Deleting a database

DELETE /v3/{project_id}/instances/{instance_id}/database/{db_name}

rds:database:drop

√

√

Creating a database account

POST /v3/{project_id}/instances/{instance_id}/db_user

rds:databaseUser:create

√

√

Querying database users

GET /v3/{project_id}/instances/{instance_id}/db_user/detail?page={page}&limit={limit}

rds:databaseUser:list

√

√

Querying authorized users of a specified database

GET /v3/{project_id}/instances/{instance_id}/database/db_user?db-name={db-name}&page={page}&limit={limit}

rds:databaseUser:list

√

√

Modifying remarks of a database user

PUT /v3/{project_id}/instances/{instance_id}/db-users/{user_name}/comment

rds:databaseUser:update

√

√

Deleting a database account

DELETE /v3/{project_id}/instances/{instance_id}/db_user/{user_name}

rds:databaseUser:drop

√

√

Configuring a password for a database account

POST /v3/{project_id}/instances/{instance_id}/db_user/resetpwd

rds:password:update

√

√

Authorizing a database account

POST /v3/{project_id}/instances/{instance_id}/db_privilege

rds:databasePrivilege:grant

√

√

Revoking permissions of a database account

DELETE /v3/{project_id}/instances/{instance_id}/db_privilege

rds:databasePrivilege:revoke

√

√

Resetting the password for user root

POST /v3/{project_id}/instances/{instance_id}/password

rds:password:update

√

√

Table 17 Database and account management actions (RDS for PostgreSQL)

Permission

API

Action

IAM Project

Enterprise Project

Creating a database

POST /v3/{project_id}/instances/{instance_id}/database

rds:database:create

√

√

Creating a database account

POST /v3/{project_id}/instances/{instance_id}/db_user

rds:databaseUser:create

√

√

Creating a database schema

POST /v3/{project_id}/instances/{instance_id}/schema

rds:database:create

√

√

Granting read or write permissions to a database account

POST /v3/{project_id}/instances/{instance_id}/db_privilege

rds:databasePrivilege:grant

√

√

Granting operation permissions to a database account

POST /v3/{project_id}/instances/{instance_id}/db-user-privilege

rds:databasePrivilege:grant

√

√

Revoking permissions of a database account

DELETE /v3/{project_id}/instances/{instance_id}/db_privilege

rds:databasePrivilege:revoke

√

√

Resetting the password for a database account

POST /v3/{project_id}/instances/{instance_id}/db_user/resetpwd

rds:password:update

√

√

Querying databases

GET /v3/{project_id}/instances/{instance_id}/database/detail?page={page}&limit={limit}

rds:database:list

√

√

Querying database users

GET /v3/{project_id}/instances/{instance_id}/db_user/detail?page={page}&limit={limit}

rds:databaseUser:list

√

√

Querying database schemas

GET /v3/{project_id}/instances/{instance_id}/schema/detail?db_name={name}&page={page}&limit={limit}

rds:database:list

√

√

Configuring account permissions

POST /v3/{project_id}/instances/{instance_id}/user-privilege

rds:databasePrivilege:grant

√

√

Modifying the database remarks of a DB instance

POST /v3/{project_id}/instances/{instance_id}/database/update

rds:database:create

√

√

Modifying remarks of a database user

PUT /v3/{project_id}/instances/{instance_id}/db-users/{user_name}/comment

rds:databaseUser:update

√

√

Deleting a database

DELETE /v3/{project_id}/instances/{instance_id}/database/{db_name}

rds:database:drop

√

√

Deleting a database account

DELETE /v3/{project_id}/instances/{instance_id}/db_user/{user_name}

rds:databaseUser:drop

√

√

Querying the pg_hba.conf file configurations of a DB instance

GET /v3/{project_id}/instances/{instance_id}/hba-info

rds:databaseUser:list

√

√

Modifying or adding one or more records in the pg_hba.conf file

PUT /v3/{project_id}/instances/{instance_id}/hba-info

rds:databaseUser:update

√

√

Overwriting the pg_hba.conf file

POST /v3/{project_id}/instances/{instance_id}/hba-info

rds:databaseUser:create

√

√

Deleting one or more records from the pg_hba.conf file

DELETE /v3/{project_id}/instances/{instance_id}/hba-info

rds:databaseUser:drop

√

√

Querying the pg_hba.conf change history of a DB instance

GET /v3/{project_id}/instances/{instance_id}/hba-info/history

rds:databaseUser:list

√

√

Table 18 Database and account management actions (RDS for SQL Server)

Permission

API

Action

IAM Project

Enterprise Project

Querying available SQL Server character sets

GET /v3/{project_id}/collations

rds:database:list

√

√

Changing the character set of a DB instance

PUT /v3/{project_id}/instances/{instance_id}/collations

rds:instance:modify

√

√

Changing the time zone of a DB instance

POST /v3/{project_id}/instances/{instance_id}/timezone/modify

rds:instance:modify

√

√

Creating a database

POST /v3/{project_id}/instances/{instance_id}/database

rds:database:create

√

√

Querying databases

GET /v3/{project_id}/instances/{instance_id}/database/detail?page={page}&limit={limit}&db-name={db-name}&recover_model={recover_model}

rds:database:list

√

√

Creating a database account

POST /v3/{project_id}/instances/{instance_id}/db_user

rds:databaseUser:create

√

√

Configuring a password for a database account

POST /v3/{project_id}/instances/{instance_id}/db_user/resetpwd

rds:password:update

√

√

Querying database users

GET /v3/{project_id}/instances/{instance_id}/db_user/detail?page={page}&limit={limit}

rds:databaseUser:list

√

√

Querying authorized users of a specified database

GET /v3/{project_id}/instances/{instance_id}/database/db_user?db-name={db-name}&page={page}&limit={limit}

rds:databaseUser:list

√

√

Deleting a database account

DELETE /v3/{project_id}/instances/{instance_id}/db_user/{user_name}

rds:databaseUser:drop

√

√

Authorizing a database account

POST /v3/{project_id}/instances/{instance_id}/db_privilege

rds:databasePrivilege:grant

√

√

Revoking permissions of a database account

DELETE /v3/{project_id}/instances/{instance_id}/db_privilege

rds:databasePrivilege:revoke

√

√

Obtaining MSDTC local host information

GET /v3/{project_id}/instances/{instance_id}/msdtc/local-host

rds:instance:getMsdtcHosts

√

√

Adding host addresses for MSDTC

POST /v3/{project_id}/instances/{instance_id}/msdtc/host

rds:instance:modify

√

√

Querying MSDTC hosts

GET /v3/{project_id}/instances/{instance_id}/msdtc/hosts?offset={offset}&limit={limit}

rds:instance:list

√

√

Deleting MSDTC

DELETE /v3/{project_id}/instances/{instance_id}/msdtc/host

rds:instance:modify

√

√

Querying top objects

GET /v3/{project_id}/instances/{instance_id}/ops/top/objects

rds:instance:get

√

√

Table 19 Parameter management actions

Permission

API

Action

IAM Project

Enterprise Project

Obtaining parameter templates

GET /v3/{project_id}/configurations

rds:param:list

√

√

Creating a parameter template

POST /v3/{project_id}/configurations

rds:param:create

√

√

Modifying parameters in a parameter template

PUT /v3/{project_id}/configurations/{config_id}

rds:param:modify

√

√

Replicating a parameter template

POST /v3/{project_id}/configurations/{config_id}/copy

rds:param:create

√

√

Querying change history of instance parameters

GET /v3/{project_id}/instances/{instance_id}/configuration-histories?offset={offset}&limit={limit}&start_time={start_time}&end_time={end_time}&param_name={param_name}

rds:param:list

√

√

Obtaining the parameter template of a specified DB instance

GET /v3/{project_id}/instances/{instance_id}/configurations

rds:param:list

√

√

Obtaining parameters of a specified parameter template

GET /v3/{project_id}/configurations/{config_id}

rds:param:list

√

√

Deleting a parameter template

DELETE /v3/{project_id}/configurations/{config_id}

rds:param:delete

√

√

Applying a parameter template

PUT /v3/{project_id}/configurations/{config_id}/apply

rds:param:apply

√

√

Querying application records of a parameter template

GET /v3/{project_id}/configurations/{config_id}/apply-histories

rds:param:list

√

√

Querying instances that a parameter template is applied to

GET /v3/{project_id}/configurations/{config_id}/query-instances

rds:instance:list

√

√

Modifying parameters of a specified DB instance

PUT /v3/{project_id}/instances/{instance_id}/configurations

rds:param:modify

√

√

Comparing parameter templates

PUT /v3/{project_id}/configurations/difference

rds:param:list

√

√

Resetting a custom parameter template

PUT /v3/{project_id}/configurations/{config_id}/reset

rds:param:reset

√

√

Table 20 Extension management actions (RDS for PostgreSQL)

Permission

API

Action

IAM Project

Enterprise Project

Creating an extension

POST /v3/{project_id}/instances/{instance_id}/extensions

rds:database:create

√

√

Querying extensions

GET /v3/{project_id}/instances/{instance_id}/extensions?database_name={database_name}&offset={offset}&limit={limit}

rds:database:list

√

√

Deleting an extension

DELETE /v3/{project_id}/instances/{instance_id}/extensions

rds:database:drop

√

√

Modifying the value of a specified parameter for an instance

PUT /v3/{project_id}/instances/{instance_id}/parameter/{name}

rds:param:modify

√

√

Obtaining the value of a specified parameter for an instance

GET /v3/{project_id}/instances/{instance_id}/parameter/{name}

rds:param:list

√

√

Table 21 Publication and subscription actions (RDS for SQL Server)

Permission

API

Action

IAM Project

Enterprise Project

Querying subscriber instances

GET /v3/{project_id}/instances/{instance_id}/replication/subscribers

rds:instance:modify

√

√

Creating subscriptions

POST /v3/{project_id}/instances/{instance_id}/replication/subscriptions

rds:instance:modify

√

√

Querying publications of a DB instance

GET /v3/{project_id}/instances/{instance_id}/replication/publications

rds:instance:modify

√

√

Deleting publications

DELETE /v3/{project_id}/instances/{instance_id}/replication/publications

rds:instance:modify

√

√

Querying distributors

GET /v3/{project_id}/instances/{instance_id}/replication/distribution

rds:instance:modify

√

√

Modifying a publication

PUT /v3/{project_id}/instances/{instance_id}/replication/publications/{publication_id}

rds:instance:modify

√

√

Querying distributor instances

GET /v3/{project_id}/instances/{instance_id}/replication/distributors

rds:instance:modify

√

√

Deleting subscriptions

DELETE /v3/{project_id}/instances/{instance_id}/replication/subscriptions

rds:instance:modify

√

√

Deleting distributors of a DB instance

DELETE /v3/{project_id}/instances/{instance_id}/replication/distribution

rds:instance:modify

√

√

Querying monitoring information of a publication

GET /v3/{project_id}/instances/{instance_id}/replication/publications/{publication_id}/monitor

rds:instance:modify

√

√

Querying monitoring information of a subscription

GET /v3/{project_id}/instances/{instance_id}/replication/subscriptions/{subscription_id}/monitor

rds:instance:modify

√

√

Testing connectivity

POST /v3/{project_id}/instances/{instance_id}/replication/login-test

rds:instance:modify

√

√

Querying subscriptions of a DB instance

GET /v3/{project_id}/instances/{instance_id}/replication/subscriptions?offset={offset}&limit={limit}&publication_id={publication_id}&is_cloud={is_cloud}&publication_name={publication_name}&subscription_db_name={subscription_db_name}

rds:instance:modify

√

√

Querying publication and subscription profiles of a DB instance

GET /v3/{project_id}/instances/{instance_id}/replication/profiles?offset={offset}&limit={limit}&agent_type={agent_type}

rds:instance:modify

√

√

Batch modifying subscriptions

PUT /v3/{project_id}/instances/{instance_id}/replication/subscriptions

rds:instance:modify

√

√

Querying available publications for a DB instance

POST /v3/{project_id}/instances/{instance_id}/replication/publication-candidates

rds:instance:modify

√

√

Querying agent jobs

GET

/v3/{project_id}/instances/{instance_id}/db-jobs?offset={offset}&limit={limit}&job_type={job_type}

rds:instance:modify

√

√

Querying the execution history of an agent job

GET

/v3/{project_id}/instances/{instance_id}/db-jobs/{job_id}/histories?offset={offset}&limit={limit}&run_status={run_status}

rds:instance:modify

√

√

Regenerating a publication snapshot

POST /v3/{project_id}/instances/{instance_id}/replication/publications/{publication_id}/reinitialize

rds:instance:modify

√

√

Regenerating a subscription

POST /v3/{project_id}/instances/{instance_id}/replication/subscriptions/{subscription_id}/reinitialize

rds:instance:modify

√

√

Synchronizing publication and subscription metadata

POST /v3/{project_id}/instances/{instance_id}/replication/metadata/sync

rds:instance:modify

√

√

Querying the historical execution steps of an agent job

GET

/v3/{project_id}/instances/{instance_id}/db-jobs/histories/{history_id}/steps?offset={offset}&limit={limit}

rds:instance:modify

√

√

Modifying an agent job

PUT

/v3/{project_id}/instances/{instance_id}/db-jobs/{job_id}

rds:instance:modify

√

√

Restarting an agent job

POST

/v3/{project_id}/instances/{instance_id}/db-jobs/{job_id}/restart

rds:instance:modify

√

√

Disabling an agent job

POST

/v3/{project_id}/instances/{instance_id}/db-jobs/{job_id}/switch

rds:instance:modify

√

√

Table 22 Recycle bin actions

Permission

API

Action

IAM Project

Enterprise Project

Modifying the recycling policy

PUT /v3/{project_id}/instances/recycle-policy

rds:instance:setRecycleBin

√

√

Querying the recycling policy

GET /v3/{project_id}/instances/recycle-policy

rds:instance:list

√

√

Querying instances in the recycle bin

GET /v3/{project_id}/recycle-instances?offset={offset}&limit={limit}

rds:instance:list

√

√

Table 23 Tag management actions

Permission

API

Action

IAM Project

Enterprise Project

Adding tags in batches

POST /v3/{project_id}/instances/{instance_id}/tags/action

rds:instance:dealTag

√

√

Deleting tags in batches

POST /v3/{project_id}/instances/{instance_id}/tags/action

rds:instance:dealTag

√

√

Querying project tags

GET /v3/{project_id}/tags

rds:tag:list

√

√

Table 24 Quota management actions

Permission

API

Action

IAM Project

Enterprise Project

Querying resource quotas

GET /v3/{project_id}/quotas

rds:instance:list

√

√

Table 25 Task management action

Permission

API

Action

IAM Project

Enterprise Project

Querying scheduled tasks

GET /v3/{project_id}/schedule-tasks

rds:task:listAll

√

√

Querying instant tasks

GET /v3/{project_id}/tasklist

rds:task:listAll

√

√

Obtaining information about a task with a specified ID

GET /v3/{project_id}/jobs?id={id}

rds:task:list

√

√

Obtaining task information of a specified DB instance in a specified time range (RDS for SQL Server)

GET /v3/{project_id}/instances/{instance_id}/tasklist/detail?start_time={start_time}&end_time={end_time}

rds:task:list

√

√

Deleting an instant task

DELETE /v3/{project_id}/jobs

rds:task:delete

√

√