DAS

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policy (SCP) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM policies are different from Organizations SCPs, see What Are the Differences in Access Control Between IAM and Organizations?

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by DAS, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by DAS, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for DAS.

**Table 1** Actions supported by DAS
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
das:instance:createConnection	Grants the permission to add database connections.	Write	Instance	-	das:connections:create
das:connection:login	Grants the permission to connect to a DB instance.	Write	Connection	-	das:connections:login
das:instance:dbsLogin	Grants the permission to connect to a DB instance from DBS.	Write	Instance	-	das:connections:login
das:connection:modify	Grants the permission to modify database connection information.	Write	Connection	-	das:connections:modify
das:connection:delete	Grants the permission to delete database connection information.	Write	Connection	-	das:connections:delete
das:connection:list	Grants the permission to obtain the connection information list.	List	Connection	-	das:connections:list
das:connection:createShareConnections	Grants the permission to create shared connections.	Write	Connection	das:TargetOrgPath das:TargetOrgId das:TargetAccountId	-
das:connection:cancelShareConnections	Grants the permission to delete shared connections.	Write	Connection	-	-
das:clouddba:getDbUser	Grants the permission to obtain database user information.	Read	Instance	-	-
das:clouddba:registerDbUser	Grants the permission to add database connections.	Write	Instance	-	-
das:clouddba:listDbUser	Grants permission to query database users.	List	Instance	-	-
das:clouddba:modifyDbUser	Grants permission to change permissions of a database user.	Write	Instance	-	-
das:clouddba:deleteDbUser	Grants permission to delete a database user.	Write	Instance	-	-
das:clouddba:listInnodbLock	Grants the permission to display InnoDB lock waits.	List	Instance	-	-
das:clouddba:listMetadataLock	Grants the permission to query metadata locks.	List	Instance	-	-
das:clouddba:deleteProcess	Grants the permission to delete an instance session.	Write	Instance	-	-
das:clouddba:listSlowSql	Grants the permission to query the slow query logs.	List	Instance	-	das:clouddba:slowSqlList
das:clouddba:slowSqlExport	Grants the permission to export slow query logs.	List	Instance	-	-
das:clouddba:listFullSql	Grants the permission to query the all query logs.	List	Instance	-	das:clouddba:fullSqlList
das:clouddba:fullSqlExport	Grants the permission to export all query logs.	List	Instance	-	-
das:clouddba:listTopSql	Grants the permission to query the top SQL list.	List	Instance	-	das:clouddba:topSqlList
das:clouddba:listProcess	Grants the permission to query sessions of an instance.	List	Instance	-	-
das:clouddba:changePaymentMode	Grants the permission to set the payment mode.	Write	Instance	-	-
das:clouddba:dailyReportsSubscribe	Grants the permission to subscribe to daily reports.	Write	Instance	-	-
das:clouddba:listDailyReports	Grants the permission to query daily reports.	List	Instance	-	das:clouddba:dailyReportsList
das:clouddba:listSpaceAnalysis	Grants the permission to query space diagnosis tasks.	List	Instance	-	-
das:clouddba:listSqlLimitRules	Grants the permission to query SQL throttling rules.	List	Instance	-	-
das:clouddba:showSqlExecutionPlan	Grants the permission to display SQL execution plans.	Read	Connection Instance	-	das:clouddba:getSqlExecutionPlan
das:clouddba:sqlDiagnosis	Grants the permission to perform SQL diagnosis.	Write	Connection Instance	-	-
das:clouddba:showSqlLimitJobInfo	Grants permission to query SQL throttling task information.	Read	Instance	-	-
das:clouddba:showSqlLimitSwitchStatus	Grants the permission to query the SQL throttling status.	Read	Instance	-	-
das:clouddba:showSqlSwitchStatus	Grants the permission to query the status of Collect All Query Logs and Collect Slow Query Logs.	Read	Instance	-	-
das:clouddba:deleteSqlLimitRules	Grants the permission to delete SQL throttling rules.	Write	Instance	-	-
das:clouddba:modifySqlLimitRules	Grants the permission to modify SQL throttling rules.	Write	Instance	-	-
das:clouddba:changeSqlLimitSwitchStatus	Grants the permission to modify the status of SQL throttling.	Write	Instance	-	-
das:clouddba:changeSqlSwitch	Grants the permission to configure Collect All Query Logs and Collect Slow Query Logs.	Write	Instance	-	-
das:clouddba:createSpaceAnalysisTask	Grants the permission to create space diagnosis tasks.	Write	Instance	-	-
das:clouddba:createSqlLimitRules	Grants the permission to create SQL throttling rules.	Write	Instance	-	-
das:clouddba:executeSql	Grants the permission to execute SQL statements.	Write	Instance	-	-
das:clouddba:listBinlog	Grants the permission to view binlogs.	List	Instance	-	-
das:clouddba:createBinlogAnalysisTask	Grants the permission to create a binlog parsing task.	Write	Instance	-	-
das::addQuota	Grants the permission to add quotas.	Write	-	-	das:clouddba:changePaymentMode
das::showQuotas	Grants the permission to query resource quotas.	Read	-	-	das:clouddba:menuList
das::getSupported	Grants the permission to query the engine types supported in the current region.	Read	-	-	das:connections:list
das::getWhitelist	Grants the permission to query the function whitelist supported in the current region.	Read	-	-	das:connections:list
das::listInstances	Grants the permission to query all types of DB instances.	List	-	-	das:connections:list
das:instance:executeTestConnection	Grants the permission to execute a test connection.	Write	Instance	-	das:connections:login
das:connection:getSharedList	Grants the permission to obtain the share list of a connection.	List	Connection	-	das:connections:list
das:connection:updateSharedInfo	Grants the permission to update a shared connection.	Write	Connection	-	das:connections:modify
das:connection:getConnection	Grants the permission to view connection information.	Read	Connection	-	das:connections:list
das::getGlobalPrivacy	Grants the permission to view the privacy statement.	Read	-	-	das:connections:list
das::putGlobalPrivacy	Grants the permission to update the privacy description.	Write	-	-	das:connections:list
das::showCloudDBAInfo	Grants the permission to view Intelligent O&M information.	Read	-	-	-
das:clouddba:showKillTaskSwitch	Grants the permission to view the switch for continuously killing sessions.	Read	Instance	-	-
das:clouddba:changeKillTaskSwitch	Grants the permission to modify a task of continuously killing sessions.	Write	Instance	-	-
das:clouddba:listKillTaskRecord	Grants the permission to view tasks of continuously killing sessions.	List	Instance	-	-
das:clouddba:createKillTask	Grants the permission to create a task of continuously killing sessions.	Write	Instance	-	-
das:clouddba:stopKillTask	Grants the permission to stop a task of continuously killing sessions.	Write	Instance	-	-

Each API of DAS usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by DAS APIs
API	Action	Dependencies
GET /v3/{project_id}/instances/{instance_id}/db-users	das:clouddba:listDbUser	-
POST /v3/{project_id}/instances/{instance_id}/db-users	das:clouddba:registerDbUser	-
GET /v3/{project_id}/instances/{instance_id}/db-users/{db_user_id}	das:clouddba:getDbUser	-
PUT /v3/{project_id}/instances/{instance_id}/db-users/{db_user_id}	das:clouddba:modifyDbUser	-
DELETE /v3/{project_id}/instances/{instance_id}/db-users/{db_user_id}	das:clouddba:deleteDbUser	-
GET /v3/{project_id}/instances/{instance_id}/sql/explain	das:clouddba:showSqlExecutionPlan	-
POST /v3/{project_id}/instances/{instance_id}/sql/explain	das:clouddba:showSqlExecutionPlan	-
GET /v3/{project_id}/instances/{instance_id}/processes	das::showCloudDBAInfo	-
DELETE /v3/{project_id}/instances/{instance_id}/process	das:clouddba:deleteProcess	-
GET /v3/{project_id}/instances/{instance_id}/metadata-locks	das:clouddba:listMetadataLock	-
GET /v3/{project_id}/instances/{instance_id}/innodb-locks	das:clouddba:listInnodbLock	-
GET /v3/{project_id}/instances/{instance_id}/slow-query-logs	das:clouddba:slowSqlExport	-
GET /v3/{project_id}/instances/{instance_id}/sql-statements	das:clouddba:fullSqlExport	-
GET /v3/{project_id}/instances/{instance_id}/full-sql-tasks	das:clouddba:listFullSql	-
GET /v3/{project_id}/instances/{instance_id}/full-sql-search	das:clouddba:listFullSql	-
GET /v3/{project_id}/instances/{instance_id}/sql/switch	das:clouddba:showSqlSwitchStatus	-
POST /v3/{project_id}/instances/{instance_id}/sql/switch	das:clouddba:changeSqlSwitch	-
GET /v3/{project_id}/instances/{instance_id}/transaction/switch	das::showCloudDBAInfo	-
POST /v3/{project_id}/instances/{instance_id}/transaction/switch	das:clouddba:changeTransactionSwitch	-
GET /v3/{project_id}/instances/{instance_id}/transaction	das::showCloudDBAInfo	-
GET /v3/{project_id}/instances/{instance_id}/space-analysis	das:clouddba:listSpaceAnalysis	-
POST /v3/{project_id}/instances/{instance_id}/space-analysis	das:clouddba:createSpaceAnalysisTask	-
GET /v3/{project_id}/instances/{instance_id}/sql-limit/switch	das:clouddba:showSqlLimitSwitchStatus	-
POST /v3/{project_id}/instances/{instance_id}/sql-limit/switch	das:clouddba:changeSqlLimitSwitchStatus	-
GET /v3/{project_id}/instances/{instance_id}/sql-limit/job	das:clouddba:showSqlLimitJobInfo	-
GET /v3/{project_id}/instances/{instance_id}/sql-limit/rules	das:clouddba:listSqlLimitRules	-
POST /v3/{project_id}/instances/{instance_id}/sql-limit/rules	das:clouddba:createSqlLimitRules	-
DELETE /v3/{project_id}/instances/{instance_id}/sql-limit/rules	das:clouddba:deleteSqlLimitRules	-
PUT /v3/{project_id}/instances/{instance_id}/sql-limit/rules	das:clouddba:updateSqlLimitRules	-
POST /v3/{project_id}/instances/{instance_id}/sql-limit/parse	das:clouddba:createSqlLimitRules	-
GET /v3/{project_id}/quotas	das::showQuotas	-
GET /v3/{project_id}/instances/{instance_id}/top-sql-templates	das:clouddba:listTopSql	-
GET /v3/{project_id}/instances/{instance_id}/top-sql-trend	das:clouddba:listTopSql	-
GET /v3/{project_id}/instances/{instance_id}/slow-sql-templates	das:clouddba:slowSqlExport	-
GET /v3/{project_id}/instances/{instance_id}/slow-sql-trend	das:clouddba:slowSqlExport	-
POST /v3/{project_id}/instances/{instance_id}/slow-sql-statistics	das::showCloudDBAInfo	-
POST /v3/{project_id}/connections/{connectionId}/tuning/create-tuning	das:clouddba:sqlDiagnosis	-
GET /v3/{project_id}/connections/{connectionId}/tuning/{messageId}/show-tuning-result	das:clouddba:sqlDiagnosis	-
GET /v3/{project_id}/instances/top-risk	das::showCloudDBAInfo	-
GET /v3/{project_id}/instances/risk-trend	das::showCloudDBAInfo	-
GET /v3/{project_id}/instances/distribution	das::showCloudDBAInfo	-
GET /v3/{project_id}/instances/top-slow-log	das::showCloudDBAInfo	-
GET /v3/{project_id}/instances/{instance_id}/top-slow-log	das::showCloudDBAInfo	-
GET /v3/{project_id}/metric-names/support	das::showCloudDBAInfo	-
GET /v3/{project_id}/instance/nodes-info	das::showCloudDBAInfo	-
POST /v3/{project_id}/multi-nodes/single-metric	das::showCloudDBAInfo	-
GET /v3/{project_id}/get-risk-items	das::showCloudDBAInfo	-
POST /v3/{project_id}/set-metric-threshold	das::setMetricThreshold	-
GET /v3/{project_id}/instances	das::listInstances	-
POST /v3/{project_id}/instances/{instance_id}/create-instance-health-report-task	das:clouddba:dailyReportsSubscribe	-
GET /v3/{project_id}/instances/{instance_id}/get-instance-health-report-task-list	das:clouddba:listDailyReports	-
GET /v3/{project_id}/instances/{instance_id}/get-instance-health-report	das:clouddba:listDailyReports	-
POST /v3/{project_id}/instances/synchronize-instance-list	das::showCloudDBAInfo	-
POST /v3/{project_id}/cloud-dba/change-payment-mode	das:clouddba:changePaymentMode	-
POST /v3/{project_id}/instances/{instance_id}/full-sql/add-task	das:clouddba:listFullSql	-
POST /v3/{project_id}/connections/share	das:connection:createShareConnections	-
DELETE /v3/{project_id}/connections/share	das:connection:cancelShareConnections	-
POST /v3/{project_id}/instances/{instance_id}/create-connection	das:instance:createConnection	-
GET /v3/{project_id}/list-connections	das::showCloudDBAInfo	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for DAS.

**Table 3** Resource types supported by DAS
Resource Type	URN	Condition Key
Instance	das:<region>:<account-id>:instance:<instance-id>	-
Connection	das:<region>:<account-id>:connection:<connection-id>	-

Conditions

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

A key in the Condition element of a statement can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, DAS:) apply only to operations of DAS. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can only be applied when its request conditions are met. For supported condition operators, see condition operators.

The following table lists the condition keys that you can define in custom policies for DAS. You can use these condition keys to specify additional conditions under which the policy is applied.

**Table 4** Service-specific condition keys supported by DAS
Service-specific Condition Key	Type	Description
das:TargetOrgPath	String	Controls permissions of target shared accounts based on their organization paths.
das:TargetOrgId	String	Controls permissions of target shared accounts based on their organization IDs.
das:TargetAccountId	String	Controls permissions of target shared accounts based on their IDs.