Help Center/ Data Admin Service/ User Guide/ Using IAM to Grant Access to DAS/ Identity Policy-based Authorization
Updated on 2025-11-24 GMT+08:00
View PDF
Share

Identity Policy-based Authorization

Identity policy-based authorization provided by Identity and Access Management (IAM) can control access to DAS. With IAM, you can:

  • Create users or user groups for employees in different departments of your enterprise using your Huawei account. Each user will then have their own security credentials to use DAS resources.
  • Grant users only the permissions required to perform a given task based on their job responsibilities.
  • Entrust a Huawei account or a cloud service to perform efficient O&M on your DAS resources.

If your Huawei Cloud account meets your requirements, skip this section.

Figure 1 shows the process flow of identity policy-based authorization.

Prerequisites

Before granting DAS permissions, learn about system-defined identity policies in Role/Policy-based Authorization. To grant permissions for other services, learn about all system-defined permissions supported by IAM.

Process Flow

Figure 1 Process of granting DAS permissions
  1. On the IAM console, create an IAM user or create a user group.

    Create a user or user group on the IAM console.

  2. Attach a system-defined identity policy to the user or user group.

    Attach DASReadOnlyAccessPolicy or an identity policy to the user or user group.

  3. Log in as the IAM user and verify permissions.

    In the authorized region, perform the following operations:

    • Choose Service List > Databases > DAS. Then click Buy DB Instance on the DAS console. If you cannot buy an instance (assume that the current policy includes only DASReadOnlyAccessPolicy), DASReadOnlyAccessPolicy has taken effect.
    • Choose another service from Service List. Assume that the current policy contains only DASReadOnlyAccessPolicy. If a message appears indicating that you have insufficient permissions to access the service, DASReadOnlyAccessPolicy has taken effect.

Examples of DAS Custom Identity Policies

You can create custom identity policies to supplement the system-defined identity policies of DAS. For details about actions supported in custom identity policies, see Actions Supported by Identity Policy-based Authorization.

You can create custom identity policies in either of the following ways:

  • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
  • JSON: Edit JSON policies from scratch or based on an existing policy.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

When creating a custom identity policy, use Resource to specify target resources and use Condition to specify the policy valid period. For details about the supported resource types and condition keys, see Actions Supported by Identity Policy-based Authorization. The following lists examples of common DAS custom identity policies.

  • Example 1: Grant the permission to create and delete a database connection. 
    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "das:instance:createConnection",
                "das:connection:delete"
            ]
        }
    ]
}
  • Example 2: Create a custom identity policy containing multiple actions.

    A custom identity policy can contain the actions of one or multiple services. The following is an example policy containing multiple actions:

    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds:instance:listAll"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "gaussdb:instance:listAll"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "dds:instance:listAll"
            ]
        }
    ]
}