Using IAM Identity Policies to Grant Access to GeminiDB Redis API

Prerequisites

Before granting GeminiDB permissions, learn about system-defined identity policies in Identity Policy-based Permissions Management. For other services, see System-defined Permissions.

Process Flow

Figure 1 Process of granting GeminiDB permissions

1. Create a user or user group.

   Create a user or user group on the IAM console.

2. Attach the system-defined identity policy to a user or user group.

   Assign the permissions defined in the system-defined identity policy GeminiDBReadOnlyPolicy to the user or group, or attach the system-defined identity policy to it.

3. Log in to the console and verify permissions.

   In the authorized region, perform the following operations:

   • Choose GeminiDB from the service list. On the GeminiDB console, click Buy DB Instance in the upper right corner to create a GeminiDB instance. If the instance cannot be created (assuming that the current permissions contain only GeminiDBReadOnlyPolicy), the GeminiDBReadOnlyPolicy policy is in effect.
   • Choose another service from the service list. If a message appears indicating that you have insufficient permissions to access the service, the GeminiDBReadOnlyPolicy policy is in effect.

Example Custom Identity Policies

Custom identity policies can be created as a supplement to the system-defined identity policies of GeminiDB. For details about actions supported in custom identity policies, see Actions Supported by Identity Policy-based Authorization.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

When creating a custom identity policy, use the Resource element to specify the resources the identity policy applies to and use the Condition element (service-specific condition keys) to control when the identity policy is in effect. For details about the supported resource types and condition keys, see Identity Policy-based Authorization. The following are examples of common custom identity policies for GeminiDB.

• Example 1: Granting permissions to create and delete GeminiDB instances

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "gaussdbfornosql:instance:create",
                  "gaussdbfornosql:instance:delete"
              ]
          }
      ]
  }

• Example 2: Defining permissions for multiple actions
  A custom identity policy can contain the actions of one or more services. The following is an example policy containing actions of multiple services:

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "gaussdbfornosql:instance:create",
                  "gaussdbfornosql:instance:delete"
  
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "evs:volumes:create",
                  "evs:volumes:list"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "ecs:cloudServers:createServers",
                  "ecs:cloudServers:listServersDetails"
              ]
          }
      ]
  }