Database Security Service (DBSS)

The Organizations provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.

This section describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create a custom SCP, see Creating an SCP in the Organizations User Guide.

Actions

Actions are specific operations that are allowed or denied in an SCP.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an SCP policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions, and you must specify all resources ("*") in your SCP statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by DBSS, see Resources.
The Condition Key column includes keys that you can specify in the Condition element of an SCP policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by DBSS, see Conditions.

The following table lists the actions that you can define in SCP statements for DBSS.

**Table 1** Actions supported by DBSS
Item	Description	Access Level	Resource Type (*: required)	Condition Key
dbss:auditInstance:listSqlInjectRules	Grant the permission to query SQL injection rules.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listSqls	Grant the permission to obtain the audit results.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:switchSqlInjectRule	Grant the permission to enable or disable the SQL injection policy.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:addSqlInjectRule	Grant the permission to add custom SQL injection rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:orderSqlInjectRule	Grant the permission to sort SQL rules by priority.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:createReporter	Grant the permission to generate reports immediately.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listReporters	Grant the permission to query report information.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:getRiskRuleDetail	Grant the permission to query specified risk rules.	read	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listAlarmEmails	Grant the permission to query alarm notification email.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:downloadReporter	Grant the permission to download reports.	read	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listAuditScopeRules	Grant the permission to query the audit scope policy list.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:addSensitiveRule	Grant the permission to add privacy data protection rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:editSensitiveRule	Grant the permission to edit privacy data protection rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:deleteReporter	Grant the permission to delete reports.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listOperateLog	Grant the permission to query user operation logs.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listMonitorInfos	Grant the permission to query the audit instance monitoring information.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listSessionInfo	Grant the permission to query the audit instance session information.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:switchBackup	Grant the permission to enable or disable the backup function.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss::downloadLicense	Grant the permission to download a sales license.	read	-	-
dbss::deleteAuditInstanceJob	Grant the permission to delete tasks failed to be created for audit instances.	write	-	-
dbss::listRdsDb	Grant the permission to query RDS databases.	list	-	-
dbss:auditInstance:instanceStart	Grant the permission to enable the audit instance.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:reboot	Grant the permission to restart the audit instance.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:stop	Grant the permission to disable the audit instance.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:upgrade	Grant the permission to upgrade the audit instance.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss::queryUpgradeStatus	Grant the permission to query the upgrade status of the audit instance.	list	-	-
dbss:auditInstance:updateSecurityGroup	Grant the permission to modify the security group of the audit instance.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:modifyAttribute	Grant the permission to modify the audit attributes of the audit instance.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:downloadAgent	Grant the permission to download the agent.	read	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:switchAgent	Grant the permission to enable or disable the agent.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listAgents	Grant the permission to query the agent list.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:deleteAgent	Grant the permission to delete the agent.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:addAgent	Grant the permission to add the agent.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:previewReporter	Grant the permission to preview a report.	read	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:setAlarmConfig	Grant the permissions to configure alarm information.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:configAlarmEmail	Grant the permission to configure alarm notification email.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:getAlarmConfig	Grant the permission to query alarm configurations.	read	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listRiskRules	Grant the permission to query risk rules.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:exportInstancesDatabaseConfig	Grant the permission to export database configurations.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:createOnPeriod	Grant the permission to create audit instances in yearly/monthly billing mode.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	g:EnterpriseProjectId', 'g:RequestTag/<tag-key>', 'g:TagKeys
dbss:auditInstance:editSqlInjectRule	Grant the permission to edit custom SQL injection rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:deleteSqlInjectRule	Grant the permission to delete custom SQL injection rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:deleteSensitiveRule	Grant the permission to delete privacy data protection rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:deleteAuditScopeRule	Grant the permission to delete audit scope rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:deleteRiskRule	Grant the permission to delete risk rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:deleteBackup	Grant the permission to delete local backup information.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listBackups	Grant the permission to query backup information.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:getBackupConfig	Grant the permission to obtain backup configuration information.	read	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:editAuditScopeRule	Grant the permission to edit audit scope rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:instanceList	Grant the permission to query audit instance information.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:createOnDemand	Grant the permission to create audit instances in the pay-per-use billing mode.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
dbss::listCommonInfo	Grant the permission to query public information.	list	-	-
dbss:auditInstance:listInstancesSummaryInfo	Grant the permission to query the overview of all audit instances.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss::getauditInstancesSummaryTaskStatus	Grant the permission to query the task status overview.	read	-	-
dbss::updateAuditInstancesSummaryInfo	Grant the permission to update the overview of all audit instances.	write	-	-
dbss:auditInstance:setReporterConfig	Grant the permission to edit the scheduled report task configurations.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:getReporterConfig	Grant the permission to obtain the scheduled report task configurations.	read	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:addBareDatabase	Grant the permission to add a user-built database.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listDatabases	Grant the permission to query the database list.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:switchDatabase	Grant the permission to enable or disable the database audit function.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:deleteDatabase	Grant the permission to delete a database.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:addAuditScopeRule	Grant the permission to add audit scope rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:switchAuditScopeRule	Grant the permission to enable or disable audit scope rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:addRiskRule	Grant the permission to add risk rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:switchRiskRule	Grant the permission to enable or disable risk rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:editRiskRule	Grant the permission to edit risk rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:setRiskRulePriority	Grant the permission to set risk rule priorities.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listStatistics	Grant the permission to query the overview of audit instances.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listSensitiveRules	Grant the permission to query privacy data masking rules.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:modifySensitiveRuleSaveResultSwitch	Grant the permission to enable or disable result set storage.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:modifySensitiveRuleAnonymizeSwitch	Grant the permission to enable or disable privacy data masking.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:switchSensitiveRule	Grant the permission to enable or disable privacy data protection rules.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:listAlarmItems	Grant the permission to query alarms.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:markAlarm	Grant the permission to mark alarms.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:deleteAlarm	Grant the permission to delete alarms.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:restoreBackup	Grant the permission to restore backup information.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:retryBackup	Grant the permission to retry the backup operation.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:getRiskBackupConfigInfo	Grant the permission to obtain risk export configuration information.	read	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:switchRiskBackup	Grant the permission to enable or disable the risk export function.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:getRiskBackupBucketInfo	Grant the permission to obtain the OBS buckets in risk export.	read	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:setRiskBackupBucketInfo	Grant the permission to configure the OBS bucket in risk export.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss:auditInstance:addRdsDatabase	Grant the permission to add RDS databases.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss::getServerInfo	Grant the permission to obtain DBSS service information.	read	-	-
dbss::getAuditInstanceJob	Grant the permission to view the created audit instance tasks.	read	-	-
dbss:auditInstance:listJobs	Grant the permission to list the created audit instance tasks.	list	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss::listObsBuckets	Grant the permission to query the OBS bucket list.	list	-	-
dbss:auditInstance:instanceDelete	Grant the permission to delete audit instances.	write	dbss:<region>:<account-id>:auditInstance:<instance-id>	-
dbss::listResourcesByTag	Grant the permission to query audit instances based on tags.	tagging	-	g:RequestTag/<tag-key> g:TagKeys
dbss::tagResource	Grant the permission to add instance tags in batches.	tagging	-	g:RequestTag/<tag-key> g:TagKeys
dbss::unTagResource	Grant the permission to delete instance tags in batches.	tagging	-	g:RequestTag/<tag-key> g:TagKeys
dbss::listTags	Grant the permission to query all tags in a project.	tagging	-	-
dbss::listTagsForResource	Grant the permission to query instance tags.	tagging	-	-

Each API of DBSS usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies of DBSS APIs
API	Action	Dependency Item
POST /v1/{project_id}/{instance_id}/audit/rule/risk/switch	dbss:auditInstance:switchRiskRule	-
POST /v1/{project_id}/{instance_id}/audit/agent/switch	dbss:auditInstance:switchAgent	-
GET /v1/{project_id}/dbss/audit/quota	dbss::listCommonInfo	-
GET /v1/{project_id}/dbss/audit/specification	dbss::listCommonInfo	-
GET /v2/{project_id}/dbss/audit/availability-zone	dbss::listCommonInfo	-
POST /v1/{project_id}/{instance_id}/dbss/audit/operate-log	dbss:auditInstance:listOperateLog	-
POST /v1/{project_id}/dbss/audit/security-group	dbss:auditInstance:updateSecurityGroup	-
GET /v1/{project_id}/dbss/audit/instances	dbss:auditInstance:instanceList	-
GET /v1/{project_id}/dbss/audit/jobs/{resource_id}	dbss:auditInstance:listJobs	-
POST /v2/{project_id}/dbss/audit/charge/period/order	dbss:auditInstance:createOnPeriod	dbss::listCommonInfo
GET /v1/{project_id}/{instance_id}/dbss/audit/databases	dbss:auditInstance:listDatabases	-
POST /v1/{project_id}/{instance_id}/dbss/audit/databases/rds	dbss:auditInstance:addRdsDatabase	-
GET /v1/{project_id}/{resource_type}/tags	dbss::listTags	-
POST /v1/{project_id}/{resource_type}/resource-instances/filter	dbss::listResourcesByTag	-
POST /v1/{project_id}/{resource_type}/resource-instances/count	dbss::listResourcesByTag	-
POST /v1/{project_id}/{resource_type}/{resource_id}/tags/create	dbss::tagResource	-
DELETE /v1/{project_id}/{resource_type}/{resource_id}/tags/delete	dbss::unTagResource	-
GET /v1/{project_id}/{instance_id}/dbss/audit/rule/scopes	dbss:auditInstance:listAuditScopeRules	-
POST /v1/{project_id}/{instance_id}/dbss/audit/rule/sql-injections	dbss:auditInstance:listSqlInjectRules	-
GET /v1/{project_id}/{instance_id}/dbss/audit/rule/risk	dbss:auditInstance:listRiskRules	-
GET /v1/{project_id}/{instance_id}/dbss/audit/rule/risk/{risk_id}	dbss:auditInstance:getRiskRuleDetail	-
GET /v1/{project_id}/{instance_id}/dbss/audit/sensitive/masks	dbss:auditInstance:listSensitiveRules	-

Resources

DBSS does not support resource-specific permission control in identity policies. If you want to allow access to DBSS, use the wildcard (*) for the Resource element to apply identity policies to all resources.