Actions Supported by Identity Policy-based Authorization

IAM provides system-defined policies to define common actions supported by cloud services. You can also create custom policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM policies are different from Organizations SCPs, see What Are the Differences in Access Control Between IAM and Organizations?

This section describes the elements used by IAM custom policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create an IAM custom policy, see Creating a Custom Policy.
For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in a policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource type defined by TaurusDB, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by TaurusDB, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in custom policy statements for TaurusDB.

**Table 1** Actions supported by TaurusDB
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
gaussdbformysql:backup:modifyPolicy	Grants permission to configure an automated backup policy.	Permission_management	-	gaussdbformysql:ReplicationTargetRegion	gaussdb:instance:modifyBackupPolicy
gaussdbformysql:param:delete	Grants permission to delete a parameter template.	Permission_management	-	-	gaussdb:param:delete
gaussdbformysql:instance:switchover	Grants permission to promote a read replica to primary.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:switchover
gaussdbformysql:htapInstance:createDataSync	Grants permission to create a data synchronization task for an instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:createDataSync
gaussdbformysql:auditlog:list	Grants permission to query audit logs.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:list
gaussdbformysql:autoscaling:createPolicy	Grants permission to configure auto scaling.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:autoscaling:createPolicy
gaussdbformysql:autoscaling:modifyPolicy	Grants permission to configure an auto scaling policy.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:serverless:modifyPolicy
gaussdbformysql:autoscaling:listHistory	Grants permission to query historical records of auto scaling.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:autoscaling:list
gaussdbformysql:autoscaling:listPolicy	Grants permission to query auto scaling policies.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:autoscaling:list
gaussdbformysql:backup:create	Grants permission to create a manual backup.	Write	-	-	gaussdb:backup:create
gaussdbformysql:backup:delete	Grants permission to delete a backup.	Write	-	-	gaussdb:backup:delete
gaussdbformysql:backup:getRestoreTime	Grants permission to query the restoration time range.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:list gaussdb:backup:list
gaussdbformysql:backup:list	Grants permission to query backups.	List	-	-	gaussdb:instance:list gaussdb:backup:list
gaussdbformysql:backup:listPolicy	Grants permission to query backup policies.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:backup:list
gaussdbformysql:database:create	Grants permission to create a database.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:database:create
gaussdbformysql:database:delete	Grants permission to delete a database.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:database:delete
gaussdbformysql:database:list	Grants permission to query databases.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:list gaussdb:database:list
gaussdbformysql:database:modify	Grants permission to modify database information.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:database:modify
gaussdbformysql:user:modifyHost	Grants permission to change a host IP address.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:user:modify
gaussdbformysql:proxy:queryElb	Grants permission to query ELB information of a proxy instance.	Read	-	-	gaussdb:elb:query
gaussdbformysql:instance:getSecondLevelMonitoringConfig	Grants permission to query the configuration of Monitoring by Seconds.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:list
gaussdbformysql:htapInstance:bindPublicIp	Grants permission to bind an EIP to an HTAP instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:bindPublicIp
gaussdbformysql:htapInstance:create	Grants permission to create an HTAP instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:create
gaussdbformysql:htapInstance:delete	Grants permission to delete an HTAP instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:delete
gaussdbformysql:htapInstance:deleteDataSync	Grants permission to disable data synchronization between an HTAP instance and a DB instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:deleteDataSync
gaussdbformysql:htapInstance:listDatabases	Grants permission to query databases of an HTAP instance.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:list
gaussdbformysql:htapInstance:listDbParameter	Grants permission to query database parameters of an HTAP instance.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:list
gaussdbformysql:htapInstance:getReplication	Grants permission to query data synchronization information of an HTAP instance.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:list
gaussdbformysql:htapInstance:getReplicationConfig	Grants permission to query data synchronization configurations of an HTAP instance.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:list
gaussdbformysql:htapInstance:getTask	Grants permission to query task details of an HTAP instance.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:list
gaussdbformysql:htapInstance:getTaskList	Grants permission to query task records of an HTAP instance.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:list
gaussdbformysql:htapInstance:list	Grants permission to query HTAP instances.	List	-	-	gaussdb:htapInstance:list
gaussdbformysql:htapInstance:modifyDataSync	Grants permission to modify a comparison task of an HTAP instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:modifyDataSync
gaussdbformysql:htapInstance:modifyPassword	Grants permission to change the password of an HTAP instance database.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:modifyPassword
gaussdbformysql:htapInstance:modifySpec	Grants permission to change specifications of an HTAP instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:modifySpec
gaussdbformysql:htapInstance:modifyStorageSize	Grants permission to scale up storage of an HTAP instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:modifyStorageSize
gaussdbformysql:htapInstance:restart	Grants permission to reboot an HTAP instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:restart
gaussdbformysql:htapInstance:tablesConfigCheck	Grants permission to check table configurations of an HTAP instance.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:list
gaussdbformysql:htapInstance:unbindPublicIp	Grants permission to unbind an EIP from an HTAP instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:unbindPublicIp
gaussdbformysql:htapInstance:get	Grants permission to query HTAP instance details.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:list
gaussdbformysql:htapInstance:createUser	Grants permission to create a database user for an HTAP instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:user:create
gaussdbformysql:htapInstance:deleteUser	Grants permission to delete a database user of an HTAP instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:user:delete
gaussdbformysql:htapInstance:grantUser	Grants permission to authorize database user permissions for an HTAP instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:user:grantPrivilege
gaussdbformysql:htapInstance:listUser	Grants permission to query database users of an HTAP instance.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:list
gaussdbformysql:htapInstance:dbConfigCheck	Grants permission to check database configurations of an HTAP instance.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:htapInstance:list
gaussdbformysql:instance:addReadOnlyNodes	Grants permission to add read replicas.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:addNodes
gaussdbformysql:instance:create	Grants permission to create a DB instance.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys gaussdbformysql:FlavorType gaussdbformysql:SubnetId gaussdbformysql:VpcId	gaussdb:instance:create gaussdb:instance:modify
gaussdbformysql:instance:delete	Grants permission to delete a DB instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:delete
gaussdbformysql:instance:deleteRecycleBin	Grants permission to delete table records in the recycle bin.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify
gaussdbformysql:instance:deleteSqlFilterRules	Grants permission to delete SQL throttling rules.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:param:modify
gaussdbformysql:instance:get	Grants permission to query DB instance details.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:list
gaussdbformysql:instance:getDcc	Grants permission to query the details about a dedicated resource pool.	Read	-	-	gaussdb:instance:list
gaussdbformysql:instance:getPublicIp	Grants permission to obtain an EIP.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:list
gaussdbformysql:instance:getSqlFilterRule	Grants permission to query SQL throttling rules.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:param:list
gaussdbformysql:instance:getSqlFilterStatus	Grants permission to query whether SQL throttling is enabled.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:param:list
gaussdbformysql:instance:killProcess	Grants permission to kill sessions.	Write	-	-	gaussdb:tag:list
gaussdbformysql:instance:list	Grants permission to query DB instances.	List	-	-	gaussdb:instance:list
gaussdbformysql:proxy:list	Grants permission to query proxy instances.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:list gaussdb:proxy:list
gaussdbformysql:proxy:listSpec	Grants permission to query proxy instance specifications.	List	-	-	gaussdb:instance:list gaussdb:proxy:list
gaussdbformysql:instance:listDcc	Grants permission to query dedicated resources.	List	-	-	gaussdb:instance:list
gaussdbformysql:instance:listDccSpec	Grants permission to query dedicated resource specifications.	List	-	-	gaussdb:instance:list
gaussdbformysql:instance:listEngine	Grants permission to query the DB engine information.	List	-	-	gaussdb:instance:list
gaussdbformysql:instance:listProcess	Grants permission to query process sessions.	List	-	-	gaussdb:tag:list
gaussdbformysql:instance:listSpec	Grants permission to query specifications.	List	-	-	gaussdb:instance:list
gaussdbformysql:instance:metering	Grants permission to query metering information.	List	-	-	gaussdb:instance:metering
gaussdbformysql:instance:modify	Grants permission to modify instance information.	Permission_management	-	-	gaussdb:instance:modify
gaussdbformysql:auditlog:operate	Grants permission to enable or disable audit log.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:modifyTraceSQLPolicy
gaussdbformysql:instance:bindPublicIp	Grants permission to bind an EIP to a DB instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:bindPublicIp
gaussdbformysql:instance:deleteReadOnlyNodes	Grants permission to delete a read replica.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:deleteNodes
gaussdbformysql:instance:modifyVip	Grants permission to change a private IP address.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:modifyIp
gaussdbformysql:instance:modifyMaintenanceWindow	Grants permission to change the maintenance window of a DB instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:modifyMaintenanceWindow
gaussdbformysql:instance:modifySecondLevelMonitorPolicy	Grants permission to change the collection period of Monitoring by Seconds.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:modifyMonitorPolicy
gaussdbformysql:instance:modifyPassword	Grants permission to change a DB instance password.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:modifyPassword
gaussdbformysql:instance:modifyPort	Grants permission to change a DB instance port.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:modifyPort
gaussdbformysql:instance:modifySecurityGroup	Grants permission to change a security group.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:modifySecurityGroup
gaussdbformysql:instance:modifySSL	Grants permission to enable or disable SSL.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:modifySSL
gaussdbformysql:instance:modifyStorageSize	Grants permission to scale up or down the storage of a DB instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:modifyStorageSize
gaussdbformysql:instance:modifySwitchoverPriority	Grants permission to change the failover priority of a read replica.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:modifySwitchoverPriority
gaussdbformysql:instance:rename	Grants permission to change a DB instance name.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:rename
gaussdbformysql:instance:unbindPublicIp	Grants permission to unbind an EIP from a DB instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:unbindPublicIp
gaussdbformysql:instance:upgrade	Grants permission to upgrade the kernel version of a DB instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:upgrade
gaussdbformysql:instance:createDns	Grants permission to apply for a private domain name for a DB instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:createDns
gaussdbformysql:instance:modifyDns	Grants permission to change the private domain name of a DB instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyDns
gaussdbformysql:user:create	Grants permission to create a database account.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:user:create
gaussdbformysql:proxy:addNodes	Grants permission to add proxy nodes.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:addNodes
gaussdbformysql:proxy:changeElb	Grants permission to modify ELB information of a proxy instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:changeElb
gaussdbformysql:proxy:createDns	Grants permission to apply for a private domain name for a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:createDns
gaussdbformysql:proxy:create	Grants permission to create a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:create
gaussdbformysql:proxy:delete	Grants permission to delete a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:delete
gaussdbformysql:proxy:modifyAccess	Grants the access control permission to a proxy instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:modifyAccess
gaussdbformysql:proxy:modifyIp	Grants permission to change the IP address of a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:modifyIp
gaussdbformysql:proxy:modifySpec	Grants permission to change specifications of a proxy instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:modifySpec
gaussdbformysql:proxy:modifyWeight	Grants permission to change read weights of nodes for a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:modifyWeight
gaussdbformysql:proxy:rename	Grants permission to rename a proxy instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:rename
gaussdbformysql:proxy:restart	Grants permission to reboot a proxy instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:restart
gaussdbformysql:proxy:switchConnectionPoolType	Grants permission to change the connection pool type of a proxy instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:switchConnectionPoolType
gaussdbformysql:proxy:updateConfigurations	Grants permission to modify the kernel parameters of a proxy instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:updateConfigurations
gaussdbformysql:instance:modifyRecycleBin	Grants permission to modify a recycling policy.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify
gaussdbformysql:instance:modifySpec	Grants permission to change DB instance specifications.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify gaussdb:instance:modifySpec
gaussdbformysql:instance:modifySpec	Grants permission to change DB instance specifications.	Permission_management	-	gaussdbformysql:FlavorType	gaussdb:instance:modify gaussdb:instance:modifySpec
gaussdbformysql:instance:restart	Grants permission to reboot a DB instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:restart
gaussdbformysql:instance:restoreInPlace	Grants permission to restore data to an existing DB instance using a backup.	Permission_management	-	-	gaussdb:instance:restoreInPlace
gaussdbformysql:instance:setRecycleBin	Grants permission to configure a recycling policy.	Permission_management	-	-	gaussdb:instance:modify
gaussdbformysql:instance:setSqlFilterRules	Grants permission to configure SQL throttling rules.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:param:modify
gaussdbformysql:instance:setSqlFilterStatus	Grants permission to enable or disable SQL throttling.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:param:modify
gaussdbformysql:instance:tableRestore	Grants permission to restore tables to a point in time.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:tableRestore
gaussdbformysql:tag:deal	Grants permission to add or delete resource tags.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:dealTag
gaussdbformysql:tag:deal	Grants permission to add or delete resource tags.	Write	-	g:RequestTag/<tag-key> g:TagKeys	gaussdb:instance:dealTag
gaussdbformysql:log:createLtsConfig	Grants permission to create LTS configurations.	Write	-	-	gaussdb:log:createLtsConfig
gaussdbformysql:log:deleteLtsConfig	Grants permission to delete LTS configurations.	Write	-	-	gaussdb:log:deleteLtsConfig
gaussdbformysql:log:getErrorLogs	Grants permission to query error logs.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:log:list
gaussdbformysql:log:getSlowLogs	Grants permission to query slow query logs.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:log:list gaussdb:instance:list
gaussdbformysql:log:list	Grants permission to query log information.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:log:list
gaussdbformysql:log:listLtsConfig	Grants permission to query LTS configurations.	List	-	-	gaussdb:log:listLtsConfig
gaussdbformysql:log:operate	Grants permission to operate logs.	Write	-	-	gaussdb:tag:list
gaussdbformysql:log:operateBinLog	Grants permission to enable or disable Binlog.	Write	-	-	gaussdb:tag:list
gaussdbformysql:log:setSlowLogSensitiveStatus	Grants permission to enable or disable Show Original Log.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify
gaussdbformysql:param:apply	Grants permission to apply a parameter template.	Permission_management	-	-	gaussdb:param:apply
gaussdbformysql:param:create	Grants permission to create a parameter template.	Write	-	-	gaussdb:param:create
gaussdbformysql:param:get	Grants permission to query parameter template details.	Read	-	-	gaussdb:param:list
gaussdbformysql:param:getParameter	Grants permission to query parameter details of a DB instance.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:param:list
gaussdbformysql:param:list	Grants permission to query parameter templates.	List	-	-	gaussdb:param:list
gaussdbformysql:param:reset	Grants permission to reset a parameter template.	Write	-	-	gaussdb:param:modify
gaussdbformysql:param:save	Grants permission to save a parameter template.	Write	-	-	gaussdb:param:modify
gaussdbformysql:param:update	Grants permission to modify parameters in a parameter template.	Write	-	-	gaussdb:param:modify
gaussdbformysql:proxy:modifyConsistency	Grants permission to change session consistency of a proxy instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:modifyConsistency
gaussdbformysql:proxy:modifyTransactionSplit	Grants permission to enable or disable transaction splitting for a proxy instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:modifyTransactionSplit
gaussdbformysql:proxy:queryConfigurations	Grants permission to query the kernel parameters of a proxy instance.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:queryConfigurations
gaussdbformysql:proxy:upgrade	Grants permission to upgrade the kernel version of a proxy instance.	Permission_management	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:upgrade
gaussdbformysql:quota:list	Grants permission to query quotas.	Read	-	-	gaussdb:instance:list
gaussdbformysql:quota:modify	Grants permission to modify quotas.	Write	-	-	gaussdb:quota:modify
gaussdbformysql:tag:delete	Grants permission to delete a tag.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modify
gaussdbformysql:tag:list	Grants permission to query tags.	List	-	-	gaussdb:instance:list gaussdb:tag:list
gaussdbformysql:task:delete	Grants permission to delete a task record.	Write	-	-	gaussdb:instance:delete
gaussdbformysql:task:get	Grants permission to query the execution progress of a task.	Read	-	-	gaussdb:instance:list
gaussdbformysql:task:list	Grants permission to query task records.	List	-	-	gaussdb:instance:list
gaussdbformysql:user:delete	Grants permission to delete a database account.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:user:delete
gaussdbformysql:user:grantPrivilege	Grants permission to change permissions of a database user.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:user:grantPrivilege
gaussdbformysql:user:list	Grants permission to query database users.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:user:list
gaussdbformysql:user:modify	Grants permission to query the description of a database user.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:user:modify
gaussdbformysql:user:revokePrivilege	Grants permission to delete permissions of a database user.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:user:revokePrivilege
gaussdbformysql:user:updatePassWord	Grants permission to change the password of a database user.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:user:modify
gaussdbformysql:backup:encrypt	Grants permission to enable or disable encrypted backup for a DB instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:backup:encrypt
gaussdbformysql:proxy:modifyPort	Grants permission to change the port of a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:modifyPort
gaussdbformysql:proxy:modifyRouteMode	Grants permission to configure a routing policy for a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:modifyRouteMode
gaussdbformysql:proxy:modifyDns	Grants permission to change the private domain name of a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:modifyDns
gaussdbformysql:proxy:deleteDns	Grants permission to delete the private domain name of a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:deleteDns
gaussdbformysql:proxy:modifySSL	Grants permission to enable or disable SSL for a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:modifySSL
gaussdbformysql:proxy:modifySlowLog	Grants permission to enable or disable slow query log reporting for a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:modifySlowLog
gaussdbformysql:proxy:modifyAlt	Grants permission to enable or disable ALT for a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:modifyAlt
gaussdbformysql:instance:listProcesses	Grants permission to query user session threads on an instance node.	List	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:listProcesses
gaussdbformysql:instance:deleteProcesses	Grants permission to terminate user session threads on an instance node.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:deleteProcesses
gaussdbformysql:proxy:deleteNodes	Grants permission to delete proxy nodes.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyProxy gaussdb:proxy:deleteNodes
gaussdbformysql:serverless:getComputeAbilityPolicy	Grants permission to query a serverless compute policy.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:serverless:getComputeAbilityPolicy
gaussdbformysql:serverless:updateComputeAbilityPolicy	Grants permission to configure a serverless compute policy.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:serverless:updateComputeAbilityPolicy
gaussdbformysql:serverless:getScalingPolicy	Grants permission to query custom scale-up policies of a serverless instance.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:serverless:getScalingPolicy
gaussdbformysql:serverless:updateScalingPolicy	Grants permission to configure custom scale-up policies for a serverless instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:serverless:updateScalingPolicy
gaussdbformysql:coldTable:operate	Grants permission to separate hot and cold data.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:coldTable:operate
gaussdbformysql:coldTable:query	Grants permission to query hot and cold data separation.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:coldTable:query
gaussdbformysql:instance:modifyIp	Grants permission to change the private IP address for read of a read replica.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:instance:modifyIp
gaussdbformysql:proxy:modifyBinlogPull	Grants permission to enable or disable binlog pull for a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:modifyBinlogPull
gaussdbformysql:proxy:bindEip	Grants permission to bind an EIP to or unbind an EIP from a proxy instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	gaussdb:proxy:bindEip

Each API of TaurusDB usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by TaurusDB APIs
API	Action	Dependency
GET /v3/{project_id}/datastores/{database_name}	gaussdbformysql:instance:listEngine	-
GET /v3/{project_id}/flavors/{database_name}	gaussdbformysql:instance:listSpec	-
POST /v3/{project_id}/instances	gaussdbformysql:instance:create	-
POST /v3/{project_id}/instances/{instance_id}/restart	gaussdbformysql:instance:restart	-
DELETE /v3/{project_id}/instances/{instance_id}	gaussdbformysql:instance:delete	-
POST /v3/{project_id}/instances/{instance_id}/nodes/enlarge	gaussdbformysql:instance:addReadOnlyNodes	-
DELETE /v3/{project_id}/instances/{instance_id}/nodes/{node_id}	gaussdbformysql:instance:deleteReadOnlyNodes	-
POST /v3/{project_id}/instances/{instance_id}/volume/extend	gaussdbformysql:instance:modifyStorageSize	-
PUT /v3/{project_id}/instances/{instance_id}/backups/policy/update	gaussdbformysql:backup:modifyPolicy	-
PUT /v3/{project_id}/instances/{instance_id}/name	gaussdbformysql:instance:rename	-
POST /v3/{project_id}/instances/{instance_id}/password	gaussdbformysql:instance:modifyPassword	-
POST /v3/{project_id}/instances/{instance_id}/action	gaussdbformysql:instance:modifySpec	-
GET /v3/{project_id}/dedicated-resources	gaussdbformysql:instance:listDcc	-
GET /v3/{project_id}/dedicated-resource/{dedicated_resource_id}	gaussdbformysql:instance:getDcc	-
POST /v3/{project_id}/instances/{instance_id}/proxy	gaussdbformysql:proxy:create	-
DELETE /v3/{project_id}/instances/{instance_id}/proxy	gaussdbformysql:proxy:delete	-
GET /v3/{project_id}/instances/{instance_id}/proxies	gaussdbformysql:proxy:list	-
GET /v3/{project_id}/instances/{instance_id}/proxy/flavors	gaussdbformysql:proxy:listSpec	-
POST /v3/{project_id}/instances/{instance_id}/proxy/enlarge	gaussdbformysql:proxy:addNodes	-
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/flavor	gaussdbformysql:proxy:modifySpec	-
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/weight	gaussdbformysql:proxy:modifyWeight	-
POST /v3/{project_id}/instances/{instance_id}/proxy/transaction-split	gaussdbformysql:proxy:modifyTransactionSplit	-
POST /v3.1/{project_id}/instances/{instance_id}/error-logs	gaussdbformysql:log:getErrorLogs	-
POST /v3.1/{project_id}/instances/{instance_id}/slow-logs	gaussdbformysql:log:getSlowLogs	-
GET /v3/{project_id}/project-quotas	gaussdbformysql:quota:list	-
GET /v3/{project_id}/quotas	gaussdbformysql:quota:list	-
POST /v3/{project_id}/quotas	gaussdbformysql:quota:modify	-
PUT /v3/{project_id}/quotas	gaussdbformysql:quota:modify	-
POST /v3/{project_id}/backups/create	gaussdbformysql:backup:create	-
GET /v3/{project_id}/backups	gaussdbformysql:backup:list	-
GET /v3/{project_id}/instances/{instance_id}/backups/policy	gaussdbformysql:backup:listPolicy	-
GET /v3/{project_id}/configurations	gaussdbformysql:param:list	-
POST /v3/{project_id}/configurations	gaussdbformysql:param:create	-
DELETE /v3/{project_id}/configurations/{configuration_id}	gaussdbformysql:param:delete	-
GET /v3/{project_id}/configurations/{configuration_id}	gaussdbformysql:param:get	-
PUT /v3/{project_id}/configurations/{configuration_id}	gaussdbformysql:param:update	-
PUT /v3/{project_id}/configurations/{configuration_id}/apply	gaussdbformysql:param:apply	-
GET /v3/{project_id}/instances/{instance_id}/tags	gaussdbformysql:tag:list	-
GET /v3/{project_id}/tags	gaussdbformysql:tag:list	-
POST /v3/{project_id}/instances/{instance_id}/tags/action	gaussdbformysql:tag:deal	-
PUT /v3/{project_id}/instances/{instance_id}/monitor-policy	gaussdbformysql:instance:modifySecondLevelMonitorPolicy	-
GET /v3/{project_id}/instances/{instance_id}/monitor-policy	gaussdbformysql:instance:getSecondLevelMonitoringConfig	-
POST /v3/{project_id}/instances/{instance_id}/nodes/{node_id}/restart	gaussdbformysql:instance:restart	-
POST /v3/{project_id}/instance/{instance_id}/audit-log/switch	gaussdbformysql:auditlog:operate	-
GET /v3/{project_id}/instance/{instance_id}/audit-log/switch-status	gaussdbformysql:auditlog:list	-
GET /v3/{project_id}/jobs	gaussdbformysql:task:list	-
POST /v3/{project_id}/instances/{instance_id}/db-users	gaussdbformysql:user:create	-
GET /v3/{project_id}/instances/{instance_id}/db-users	gaussdbformysql:user:list	-
DELETE /v3/{project_id}/instances/{instance_id}/db-users	gaussdbformysql:user:delete	-
PUT /v3/{project_id}/instances/{instance_id}/db-users/comment	gaussdbformysql:user:modify	-
PUT /v3/{project_id}/instances/{instance_id}/db-users/password	gaussdbformysql:user:updatePassWord	-
POST /v3/{project_id}/instances/{instance_id}/db-users/privilege	gaussdbformysql:user:grantPrivilege	-
DELETE /v3/{project_id}/instances/{instance_id}/db-users/privilege	gaussdbformysql:user:revokePrivilege	-
GET /v3/{project_id}/instances/{instance_id}/databases/charsets	gaussdbformysql:database:list	-
POST /v3/{project_id}/instances/{instance_id}/databases	gaussdbformysql:database:create	-
GET /v3/{project_id}/instances/{instance_id}/databases	gaussdbformysql:database:list	-
DELETE /v3/{project_id}/instances/{instance_id}/databases	gaussdbformysql:database:delete	-
PUT /v3/{project_id}/instances/{instance_id}/databases/comment	gaussdbformysql:database:modify	-
POST /v3/{project_id}/instances/{instance_id}/sql-filter/switch	gaussdbformysql:instance:setSqlFilterStatus	-
GET /v3/{project_id}/instances/{instance_id}/sql-filter/switch	gaussdbformysql:instance:getSqlFilterStatus	-
PUT /v3/{project_id}/instances/{instance_id}/sql-filter/rules	gaussdbformysql:instance:setSqlFilterRules	-
GET /v3/{project_id}/instances/{instance_id}/sql-filter/rules	gaussdbformysql:instance:getSqlFilterRule	-
DELETE /v3/{project_id}/instances/{instance_id}/sql-filter/rules	gaussdbformysql:instance:deleteSqlFilterRules	-
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/session-consistence	gaussdbformysql:proxy:modifyConsistency	-
GET /v3/{project_id}/immediate-jobs	gaussdbformysql:task:list	-
GET /v3/{project_id}/scheduled-jobs	gaussdbformysql:task:list	-
DELETE /v3/{project_id}/scheduled-jobs	gaussdbformysql:task:delete	-
DELETE /v3/{project_id}/jobs/{job_id}	gaussdbformysql:task:delete	-
POST /v3/{project_id}/instances/{instance_id}/db-upgrade	gaussdbformysql:instance:upgrade	-
PUT /v3/{project_id}/instances/{instance_id}/ssl-option	gaussdbformysql:instance:modifySSL	-
PUT /v3/{project_id}/instances/{instance_id}/public-ips/bind	gaussdbformysql:instance:bindPublicIp	-
PUT /v3/{project_id}/instances/{instance_id}/public-ips/unbind	gaussdbformysql:instance:unbindPublicIp	-
PUT /v3/{project_id}/instances/{instance_id}/switchover	gaussdbformysql:instance:switchover	-
PUT /v3/{project_id}/instances/{instance_id}/ops-window	gaussdbformysql:instance:modifyMaintenanceWindow	-
PUT /v3/{project_id}/instances/{instance_id}/security-group	gaussdbformysql:instance:modifySecurityGroup	-
PUT /v3/{project_id}/instances/{instance_id}/internal-ip	gaussdbformysql:instance:modifyVip	-
PUT /v3/{project_id}/instances/{instance_id}/port	gaussdbformysql:instance:modifyPort	-
PUT /v3/{project_id}/instances/{instance_id}/alias	gaussdbformysql:instance:rename	-
DELETE /v3/{project_id}/backups/{backup_id}	gaussdbformysql:backup:delete	-
POST /v3/{project_id}/instances/restore	gaussdbformysql:instance:restoreInPlace	-
POST /v3/{project_id}/instances/{instance_id}/backups/encryption	gaussdbformysql:backup:encrypt	-
GET /v3/{project_id}/instances/{instance_id}/restore-time	gaussdbformysql:backup:getRestoreTime	-
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/connection-pool-type	gaussdbformysql:proxy:switchConnectionPoolType	-
POST /v3/{project_id}/instances/{instance_id}/dns	gaussdbformysql:instance:createDns	-
PUT /v3/{project_id}/instances/{instance_id}/dns	gaussdbformysql:instance:modifyDns	-
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/port	gaussdbformysql:proxy:modifyPort	-
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/route-mode	gaussdbformysql:proxy:modifyRouteMode	-
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/dns	gaussdbformysql:proxy:modifyDns	-
DELETE /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/dns	gaussdbformysql:proxy:deleteDns	-
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/ssl	gaussdbformysql:proxy:modifySSL	-
PUT /v3/{project_id}/instances/{instance_id}/serverless/policy	gaussdbformysql:autoscaling:modifyPolicy	-
GET /v3/{project_id}/instances/{instance_id}/nodes/{node_id}/processes	gaussdbformysql:instance:listProcesses	-
DELETE /v3/{project_id}/instances/{instance_id}/nodes/{node_id}/processes	gaussdbformysql:instance:deleteProcesses	-
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/reduce	gaussdbformysql:proxy:deleteNodes	-
GET /v3/{project_id}/instances/{instance_id}/serverless/policy	gaussdbformysql:serverless:getComputeAbilityPolicy	-
PUT /v3.1/{project_id}/instances/{instance_id}/serverless/policy	gaussdbformysql:serverless:updateComputeAbilityPolicy	-
GET /v3/{project_id}/instances/{instance_id}/serverless/scaling-policy	gaussdbformysql:serverless:getScalingPolicy	-
PUT /v3/{project_id}/instances/{instance_id}/serverless/scaling-policy	gaussdbformysql:serverless:updateScalingPolicy	-
POST /v3/{project_id}/instances/{instance_id}/backups/restore/tables	gaussdbformysql:instance:tableRestore	-
GET /v3/{project_id}/instances/{instance_id}/backups/encryption	gaussdbformysql:backup:encrypt	-
GET /v3/{project_id}/instances/{instance_id}/incremental-backups	gaussdbformysql:backup:list	-
GET /v3.1/{project_id}/instances/{instance_id}/backups/restore/tables	gaussdbformysql:backup:list	-
-	gaussdbformysql:backup:list	-
PUT /v3/{project_id}/instances/{instance_id}/backups/offsite-policy	gaussdbformysql:backup:modifyPolicy	-
POST /v3/{project_id}/instances/database-version/upgrade	gaussdbformysql:instance:upgrade	-
POST /v3/{project_id}/resource-check	gaussdbformysql:instance:list	-
GET /v3.1/{project_id}/instances/details	gaussdbformysql:instance:get	-
GET /v3.1/{project_id}/instances	gaussdbformysql:instance:list	-
GET /v3/{project_id}/instances/recycle-info	gaussdbformysql:instance:list	-
PUT /v3/{project_id}/instances/{instance_id}/storage/auto-expand-policy	gaussdbformysql:instance:modifyStorageSize	-
PUT /v3/{project_id}/instances/{instance_id}/nodes/{node_id}/priority	gaussdbformysql:instance:modifySwitchoverPriority	-
PUT /v3/{project_id}/instances/{instance_id}/nodes/name	gaussdbformysql:instance:rename	-
PUT /v3/{project_id}/instances/recycle-policy	gaussdbformysql:instance:setRecycleBin	-
GET /v3/{project_id}/instances/{instance_id}/storage/auto-expand-policy	gaussdbformysql:instance:get	-
GET /v3/{project_id}/instances/{instance_id}/auto-scaling/history	gaussdbformysql:autoscaling:listHistory	-
GET /v3/{project_id}/instances/{instance_id}/auto-scaling/policy	gaussdbformysql:autoscaling:listPolicy	-
GET /v3.1/{project_id}/instances/{instance_id}	gaussdbformysql:instance:get	-
GET /v3/{project_id}/instances/{instance_id}/eip	gaussdbformysql:instance:getPublicIp	-
GET /v3/{project_id}/instances/recycle-policy	gaussdbformysql:instance:setRecycleBin	-
GET /v3/{project_id}/instances/{instance_id}/table-info	gaussdbformysql:instance:get	-
PUT /v3/{project_id}/instances/{instance_id}/auto-scaling/policy	gaussdbformysql:autoscaling:createPolicy	-
GET /v3/{project_id}/instances/diagnosis-instance-count	gaussdbformysql:instance:list	-
GET /v3/{project_id}/instances/diagnosis-instance-infos	gaussdbformysql:instance:list	-
POST /v3/{project_id}/logs/lts-configs	gaussdbformysql:log:createLtsConfig	-
DELETE /v3/{project_id}/logs/lts-configs	gaussdbformysql:log:deleteLtsConfig	-
POST /v3/{project_id}/instances/{instance_id}/{node_id}/slowlog-download	gaussdbformysql:log:getSlowLogs	-
GET /v3/{project_id}/instance/{instance_id}/auditlog/download-link	gaussdbformysql:auditlog:list	-
GET /v3/{project_id}/instances/{instance_id}/audit-logs	gaussdbformysql:auditlog:list	-
PUT /v3/{project_id}/instances/{instance_id}/audit-log-policy	gaussdbformysql:auditlog:operate	-
POST /v3/{project_id}/instances/{instance_id}/{node_id}/errorlog-download	gaussdbformysql:log:getErrorLogs	-
GET /v3/{project_id}/logs/lts-configs	gaussdbformysql:log:listLtsConfig	-
GET /v3/{project_id}/instances/{instance_id}/slowlog/query	gaussdbformysql:log:getSlowLogs	-
POST /v3/{project_id}/instances/{instance_id}/slow-logs/statistics	gaussdbformysql:log:getSlowLogs	-
POST /v3/{project_id}/instances/{instance_id}/slowlog/modify	gaussdbformysql:log:setSlowLogSensitiveStatus	-
GET /v3/{project_id}/instances/{instance_id}/multi-tenant	gaussdbformysql:instance:get	-
PUT /v3/{project_id}/instances/{instance_id}/multi-tenant	gaussdbformysql:instance:modify	-
POST /v3/{project_id}/configurations/{configuration_id}/copy	gaussdbformysql:param:create	-
POST /v3/{project_id}/instances/{instance_id}/configurations/{configuration_id}/copy	gaussdbformysql:param:save	-
POST /v3/{project_id}/configurations/comparison	gaussdbformysql:param:get	-
GET /v3/{project_id}/configurations/{configuration_id}/applicable-instances	gaussdbformysql:param:list	-
GET /v3/{project_id}/instances/{instance_id}/configurations	gaussdbformysql:param:getParameter	-
GET /v3/{project_id}/configurations/{configuration_id}/modify-history	gaussdbformysql:param:list	-
GET /v3/{project_id}/configurations/{config_id}/apply-history	gaussdbformysql:param:list	-
PUT /v3/{project_id}/instances/{instance_id}/configurations	gaussdbformysql:param:update	-
POST /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/access-control	gaussdbformysql:proxy:modifyAccess	-
POST /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/dns	gaussdbformysql:proxy:createDns	-
POST /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/restart	gaussdbformysql:proxy:restart	-
GET /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/configurations	gaussdbformysql:proxy:queryConfigurations	-
GET /v3/{project_id}/proxy/flavors	gaussdbformysql:proxy:list	-
GET /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/ipgroup	gaussdbformysql:proxy:modifyAccess	-
GET /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/{engine_name}/proxy-version	gaussdbformysql:proxy:list	-
POST /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/access-control-switch	gaussdbformysql:proxy:modifyAccess	-
POST /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/new-node-auto-add	gaussdbformysql:proxy:create	-
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/rename	gaussdbformysql:proxy:rename	-
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/configurations	gaussdbformysql:proxy:updateConfigurations	-
POST /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/upgrade-version	gaussdbformysql:proxy:upgrade	-
GET /v3/{project_id}/enterprise-projects	gaussdbformysql:instance:list	-
DELETE /v3/{project_id}/instance/{instance_id}/scheduled-jobs	gaussdbformysql:task:delete	-
POST /v3/{project_id}/instances/{instance_id}/starrocks/databases/replication/database-config-check	gaussdbformysql:htapInstance:dbConfigCheck	-
POST /v3/{project_id}/configurations/starrocks/comparison	gaussdbformysql:param:get	-
POST /v3/{project_id}/starrocks/resource-check	gaussdbformysql:instance:list	-
POST /v3/{project_id}/instances/{instance_id}/starrocks/databases/replication/table-config-check	gaussdbformysql:htapInstance:tablesConfigCheck	-
POST /v3/{project_id}/instances/{instance_id}/starrocks/users	gaussdbformysql:htapInstance:createUser	-
POST /v3/{project_id}/instances/{instance_id}/starrocks/databases/replication	gaussdbformysql:htapInstance:createDataSync	-
POST /v3/{project_id}/instances/{instance_id}/starrocks	gaussdbformysql:htapInstance:create	-
DELETE /v3/{project_id}/instances/{instance_id}/starrocks/users	gaussdbformysql:htapInstance:deleteUser	-
DELETE /v3/{project_id}/instances/{instance_id}/starrocks/databases/replication	gaussdbformysql:htapInstance:deleteDataSync	-
DELETE /v3/{project_id}/instances/{instance_id}/starrocks/{starrocks_instance_id}	gaussdbformysql:htapInstance:delete	-
GET /v3/{project_id}/htap/datastores/{engine_name}	gaussdbformysql:instance:listEngine	-
GET /v3/{project_id}/htap/flavors/{engine_name}	gaussdbformysql:instance:listSpec	-
GET /v3/{project_id}/instances/{instance_id}/htap	gaussdbformysql:htapInstance:get	-
GET /v3/{project_id}/htap/storage-type/{database}	gaussdbformysql:htapInstance:list	-
GET /v3/{project_id}/instances/{instance_id}/starrocks/nodes	gaussdbformysql:log:list	-
GET /v3/{project_id}/instances/{instance_id}/starrocks/databases	gaussdbformysql:htapInstance:listDatabases	-
GET /v3/{project_id}/instances/{instance_id}/starrocks/databases/replication/configuration	gaussdbformysql:htapInstance:getReplicationConfig	-
GET /v3/{project_id}/instances/{instance_id}/starrocks/databases/replication	gaussdbformysql:htapInstance:getReplication	-
GET /v3/{project_id}/instances/{instance_id}/starrocks/databases/replication/database-parameters	gaussdbformysql:htapInstance:listDbParameter	-
GET /v3/{project_id}/instances/{instance_id}/starrocks/{starrocks_instance_id}	gaussdbformysql:htapInstance:get	-
PUT /v3/{project_id}/instances/{instance_id}/starrocks/security-group	gaussdbformysql:instance:modifySecurityGroup	-
POST /v3/{project_id}/instances/{instance_id}/starrocks/databases/replication/pause	gaussdbformysql:htapInstance:modifyDataSync	-
POST /v3/{project_id}/instances/{instance_id}/starrocks/resize-flavor	gaussdbformysql:htapInstance:modifySpec	-
PUT /v3/{project_id}/instances/{starrocks_instance_id}/starrocks/restart	gaussdbformysql:htapInstance:restart	-
PUT /v3/{project_id}/instances/{starrocks_instance_id}/starrocks/{starrocks_node_id}/restart	gaussdbformysql:htapInstance:restart	-
POST /v3/{project_id}/instances/{instance_id}/starrocks/databases/replication/resume	gaussdbformysql:htapInstance:modifyDataSync	-
POST /v3/{project_id}/instances/{instance_id}/starrocks/error-logs	gaussdbformysql:log:getErrorLogs	-
POST /v3/{project_id}/instances/{instance_id}/htap/databases	gaussdbformysql:htapInstance:listDatabases	-
POST /v3/{project_id}/instances/{instance_id}/htap/tables	gaussdbformysql:htapInstance:listDatabases	-
GET /v3/{project_id}/starrocks/instances/logs/lts-configs	gaussdbformysql:log:listLtsConfig	-
GET /v3/{project_id}/instances/{instance_id}/starrocks/users	gaussdbformysql:htapInstance:listUser	-
GET /v3/{project_id}/instances/{instance_id}/starrocks/configurations	gaussdbformysql:param:getParameter	-
POST /v3/{project_id}/instances/{instance_id}/starrocks/users/sync	gaussdbformysql:htapInstance:createUser	-
PUT /v3/{project_id}/instances/{instance_id}/starrocks/users/password	gaussdbformysql:htapInstance:modifyPassword	-
PUT /v3/{project_id}/instances/{instance_id}/starrocks/users/permission	gaussdbformysql:htapInstance:grantUser	-
PUT /v3/{project_id}/instances/{instance_id}/starrocks/configurations	gaussdbformysql:param:update	-
POST /v3/{project_id}/instances/{instance_id}/starrocks/db-upgrade	gaussdbformysql:instance:upgrade	-
POST /v3/{project_id}/instances/{instance_id}/htap/template	gaussdbformysql:htapInstance:listDatabases	-
GET /v3/{project_id}/instances/{instance_id}/database-version	gaussdbformysql:instance:get	-
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/bind	gaussdbformysql:proxy:bindEip	-
GET /v3/{project_id}/instances/{instance_id}/audit-log-policy	gaussdbformysql:auditlog:list	-
POST /v3/{project_id}/instances/{instance_id}/audit-log-link	gaussdbformysql:auditlog:list	-
GET /v3/{project_id}/instances/{instance_id}/task-center-detail	gaussdbformysql:task:list	-
PUT /v3/{project_id}/instances/{instance_id}/starrocks/databases/replication	gaussdbformysql:htapInstance:modifyDataSync	-
GET /v3/{project_id}/instances/{instance_id}/starrocks/databases/replication/configuration/{database}	gaussdbformysql:htapInstance:getReplicationConfig	-
PUT /v3/{project_id}/instances/{instance_id}/query-queue/rules	gaussdbformysql:param:update	-
GET /v3/{project_id}/instances/{instance_id}/query-queue/rules	gaussdbformysql:param:get	-
POST /v3/{project_id}/instances/{instance_id}/htap/query-queue/switch	gaussdbformysql:param:update	-
POST /v3/{project_id}/instances/{instance_id}/starrocks/slow-logs	gaussdbformysql:log:getSlowLogs	-
GET /v3/{project_id}/instances/{instance_id}/starrocks/slowlog-sensitive	gaussdbformysql:log:getSlowLogs	-
PUT /v3/{project_id}/instances/{instance_id}/starrocks/slowlog-sensitive	gaussdbformysql:log:setSlowLogSensitiveStatus	-

Resources

A resource type indicates the resources that a policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the policy statements using that action, and the policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the policy applies to all resources. You can also set condition keys in a policy to define resource types.

The following table lists the resource type that you can define in custom policies for TaurusDB.

**Table 3** Resource type supported by TaurusDB
Resource Type	URN
instance	gaussdbformysql:<region>:<account-id>:instance:<instance-id>

Conditions

Condition Key Overview

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, gaussdbformysql:) apply only to operations of the TaurusDB service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can only be applied when its request conditions are met. For supported condition operators, see Condition operators.

Service-specific Condition Keys Supported by TaurusDB

The following table lists the condition keys that you can define in identity policies for TaurusDB. You can include these condition keys to specify conditions for when your identity policy is in effect.

**Table 4** Service-specific condition keys supported by TaurusDB
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
gaussdbformysql:FlavorType	String	Single-valued	Filters access by the specification type tag key that is passed in the request.
gaussdbformysql:SubnetId	String	Single-valued	Filters access by the subnet ID tag key that is passed in the request.
gaussdbformysql:VpcId	String	Single-valued	Filters access by the VPC ID tag key that is passed in the request.
gaussdbformysql:ReplicationTargetRegion	String	Single-valued	Filters access by the tag key that specifies the region a backup is to be replicated to in the request.

Examples of Condition Keys

gaussdbformysql:FlavorType

For example, only Arm instances can be created.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "gaussdbformysql:instance:create"
            ],
            "Condition": {
                "StringEquals": {
                    "gaussdbformysql:FlavorType": [
                        "ARM"
                    ]
                }
            }
        }
    ]
}

gaussdbformysql:SubnetId

For example, only instances whose SubnetId is SubnetId-a can be created.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "gaussdbformysql:instance:create"
            ],
            "Condition": {
                "StringEquals": {
                    "gaussdbformysql:SubnetId": [
                        "SubnetId-a"
                    ]
                }
            }
        }
    ]
}

gaussdbformysql:VpcId

For example, only instances whose VPC is vpcId-a can be created.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "gaussdbformysql:instance:create"
            ],
            "Condition": {
                "StringEquals": {
                    "gaussdbformysql:VpcId": [
                        "vpcId-a"
                    ]
                }
            }
        }
    ]
}

gaussdbformysql:ReplicationTargetRegion

For example, cross-region backups can only be stored in the destination region-a.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "gaussdbformysql:backup:modifyPolicy"
            ],
            "Condition": {
                "StringEquals": {
                    "gaussdbformysql:ReplicationTargetRegion": [
                        "region-a"
                    ]
                }
            }
        }
    ]
}

Parent topic: Permissions and Supported Actions

Previous topic: Actions Supported by Policy-based Authorization

Next topic: Appendix