Database Security Service (DBSS)
The Organizations provides Service Control Policies (SCPs) to set access control policies.
SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.
This section describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.
For details about how to use these elements to create a custom SCP, see Creating an SCP.
Actions
Actions are specific operations that are allowed or denied in an SCP.
- The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an SCP policy.
- The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions, and you must specify all resources ("*") in your SCP statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by DBSS, see Resources.
- The Condition Key column includes keys that you can specify in the Condition element of an SCP policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by DBSS, see Conditions.
The following table lists the actions that you can define in SCP statements for DBSS.
|
Item |
Description |
Access Level |
Resource Type (*: required) |
Condition Key |
|---|---|---|---|---|
|
dbss:auditInstance:listSqlInjectRules |
Grant the permission to query SQL injection rules. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listSqls |
Grant the permission to obtain the audit results. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:switchSqlInjectRule |
Grant the permission to enable or disable the SQL injection policy. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:addSqlInjectRule |
Grant the permission to add custom SQL injection rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:orderSqlInjectRule |
Grant the permission to sort SQL rules by priority. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:createReporter |
Grant the permission to generate reports immediately. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listReporters |
Grant the permission to query report information. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:getRiskRuleDetail |
Grant the permission to query specified risk rules. |
read |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listAlarmEmails |
Grant the permission to query alarm notification email. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:downloadReporter |
Grant the permission to download reports. |
read |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listAuditScopeRules |
Grant the permission to query the audit scope policy list. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:addSensitiveRule |
Grant the permission to add privacy data protection rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:editSensitiveRule |
Grant the permission to edit privacy data protection rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:deleteReporter |
Grant the permission to delete reports. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listOperateLog |
Grant the permission to query user operation logs. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listMonitorInfos |
Grant the permission to query the audit instance monitoring information. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listSessionInfo |
Grant the permission to query the audit instance session information. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:switchBackup |
Grant the permission to enable or disable the backup function. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss::downloadLicense |
Grant the permission to download a sales license. |
read |
- |
- |
|
dbss::deleteAuditInstanceJob |
Grant the permission to delete tasks failed to be created for audit instances. |
write |
- |
- |
|
dbss::listRdsDb |
Grant the permission to query RDS databases. |
list |
- |
- |
|
dbss:auditInstance:instanceStart |
Grant the permission to enable the audit instance. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:reboot |
Grant the permission to restart the audit instance. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:stop |
Grant the permission to disable the audit instance. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:upgrade |
Grant the permission to upgrade the audit instance. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss::queryUpgradeStatus |
Grant the permission to query the upgrade status of the audit instance. |
list |
- |
- |
|
dbss:auditInstance:updateSecurityGroup |
Grant the permission to modify the security group of the audit instance. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:modifyAttribute |
Grant the permission to modify the audit attributes of the audit instance. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:downloadAgent |
Grant the permission to download the agent. |
read |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:switchAgent |
Grant the permission to enable or disable the agent. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listAgents |
Grant the permission to query the agent list. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:deleteAgent |
Grant the permission to delete the agent. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:addAgent |
Grant the permission to add the agent. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:previewReporter |
Grant the permission to preview a report. |
read |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:setAlarmConfig |
Grant the permissions to configure alarm information. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:configAlarmEmail |
Grant the permission to configure alarm notification email. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:getAlarmConfig |
Grant the permission to query alarm configurations. |
read |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listRiskRules |
Grant the permission to query risk rules. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:exportInstancesDatabaseConfig |
Grant the permission to export database configurations. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:createOnPeriod |
Grant the permission to create audit instances in yearly/monthly billing mode. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
|
|
dbss:auditInstance:editSqlInjectRule |
Grant the permission to edit custom SQL injection rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:deleteSqlInjectRule |
Grant the permission to delete custom SQL injection rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:deleteSensitiveRule |
Grant the permission to delete privacy data protection rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:deleteAuditScopeRule |
Grant the permission to delete audit scope rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:deleteRiskRule |
Grant the permission to delete risk rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:deleteBackup |
Grant the permission to delete local backup information. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listBackups |
Grant the permission to query backup information. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:getBackupConfig |
Grant the permission to obtain backup configuration information. |
read |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:editAuditScopeRule |
Grant the permission to edit audit scope rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:instanceList |
Grant the permission to query audit instance information. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:createOnDemand |
Grant the permission to create audit instances in the pay-per-use billing mode. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
|
|
dbss::listCommonInfo |
Grant the permission to query public information. |
list |
- |
- |
|
dbss:auditInstance:listInstancesSummaryInfo |
Grant the permission to query the overview of all audit instances. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss::getauditInstancesSummaryTaskStatus |
Grant the permission to query the task status overview. |
read |
- |
- |
|
dbss::updateAuditInstancesSummaryInfo |
Grant the permission to update the overview of all audit instances. |
write |
- |
- |
|
dbss:auditInstance:setReporterConfig |
Grant the permission to edit the scheduled report task configurations. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:getReporterConfig |
Grant the permission to obtain the scheduled report task configurations. |
read |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:addBareDatabase |
Grant the permission to add a user-built database. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listDatabases |
Grant the permission to query the database list. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:switchDatabase |
Grant the permission to enable or disable the database audit function. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:deleteDatabase |
Grant the permission to delete a database. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:addAuditScopeRule |
Grant the permission to add audit scope rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:switchAuditScopeRule |
Grant the permission to enable or disable audit scope rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:addRiskRule |
Grant the permission to add risk rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:switchRiskRule |
Grant the permission to enable or disable risk rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:editRiskRule |
Grant the permission to edit risk rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:setRiskRulePriority |
Grant the permission to set risk rule priorities. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listStatistics |
Grant the permission to query the overview of audit instances. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listSensitiveRules |
Grant the permission to query privacy data masking rules. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:modifySensitiveRuleSaveResultSwitch |
Grant the permission to enable or disable result set storage. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:modifySensitiveRuleAnonymizeSwitch |
Grant the permission to enable or disable privacy data masking. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:switchSensitiveRule |
Grant the permission to enable or disable privacy data protection rules. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:listAlarmItems |
Grant the permission to query alarms. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:markAlarm |
Grant the permission to mark alarms. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:deleteAlarm |
Grant the permission to delete alarms. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:restoreBackup |
Grant the permission to restore backup information. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:retryBackup |
Grant the permission to retry the backup operation. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:getRiskBackupConfigInfo |
Grant the permission to obtain risk export configuration information. |
read |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:switchRiskBackup |
Grant the permission to enable or disable the risk export function. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:getRiskBackupBucketInfo |
Grant the permission to obtain the OBS buckets in risk export. |
read |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:setRiskBackupBucketInfo |
Grant the permission to configure the OBS bucket in risk export. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss:auditInstance:addRdsDatabase |
Grant the permission to add RDS databases. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss::getServerInfo |
Grant the permission to obtain DBSS service information. |
read |
- |
- |
|
dbss::getAuditInstanceJob |
Grant the permission to view the created audit instance tasks. |
read |
- |
- |
|
dbss:auditInstance:listJobs |
Grant the permission to list the created audit instance tasks. |
list |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss::listObsBuckets |
Grant the permission to query the OBS bucket list. |
list |
- |
- |
|
dbss:auditInstance:instanceDelete |
Grant the permission to delete audit instances. |
write |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
- |
|
dbss::listResourcesByTag |
Grant the permission to query audit instances based on tags. |
tagging |
- |
|
|
dbss::tagResource |
Grant the permission to add instance tags in batches. |
tagging |
- |
|
|
dbss::unTagResource |
Grant the permission to delete instance tags in batches. |
tagging |
- |
|
|
dbss::listTags |
Grant the permission to query all tags in a project. |
tagging |
- |
- |
|
dbss::listTagsForResource |
Grant the permission to query instance tags. |
tagging |
- |
- |
Each API of DBSS usually supports one or more actions. Table 2 lists the supported actions and dependencies.
|
API |
Action |
Dependency Item |
|---|---|---|
|
POST /v1/{project_id}/{instance_id}/audit/rule/risk/switch |
dbss:auditInstance:switchRiskRule |
- |
|
POST /v1/{project_id}/{instance_id}/audit/agent/switch |
dbss:auditInstance:switchAgent |
- |
|
GET /v1/{project_id}/dbss/audit/quota |
dbss::listCommonInfo |
- |
|
GET /v1/{project_id}/dbss/audit/specification |
dbss::listCommonInfo |
- |
|
GET /v2/{project_id}/dbss/audit/availability-zone |
dbss::listCommonInfo |
- |
|
POST /v1/{project_id}/{instance_id}/dbss/audit/operate-log |
dbss:auditInstance:listOperateLog |
- |
|
POST /v1/{project_id}/dbss/audit/security-group |
dbss:auditInstance:updateSecurityGroup |
- |
|
GET /v1/{project_id}/dbss/audit/instances |
dbss:auditInstance:instanceList |
- |
|
GET /v1/{project_id}/dbss/audit/jobs/{resource_id} |
dbss:auditInstance:listJobs |
- |
|
POST /v2/{project_id}/dbss/audit/charge/period/order |
dbss:auditInstance:createOnPeriod |
dbss::listCommonInfo |
|
GET /v1/{project_id}/{instance_id}/dbss/audit/databases |
dbss:auditInstance:listDatabases |
- |
|
POST /v1/{project_id}/{instance_id}/dbss/audit/databases/rds |
dbss:auditInstance:addRdsDatabase |
- |
|
GET /v1/{project_id}/{resource_type}/tags |
dbss::listTags |
- |
|
POST /v1/{project_id}/{resource_type}/resource-instances/filter |
dbss::listResourcesByTag |
- |
|
POST /v1/{project_id}/{resource_type}/resource-instances/count |
dbss::listResourcesByTag |
- |
|
POST /v1/{project_id}/{resource_type}/{resource_id}/tags/create |
dbss::tagResource |
- |
|
DELETE /v1/{project_id}/{resource_type}/{resource_id}/tags/delete |
dbss::unTagResource |
- |
|
GET /v1/{project_id}/{instance_id}/dbss/audit/rule/scopes |
dbss:auditInstance:listAuditScopeRules |
- |
|
POST /v1/{project_id}/{instance_id}/dbss/audit/rule/sql-injections |
dbss:auditInstance:listSqlInjectRules |
- |
|
GET /v1/{project_id}/{instance_id}/dbss/audit/rule/risk |
dbss:auditInstance:listRiskRules |
- |
|
GET /v1/{project_id}/{instance_id}/dbss/audit/rule/risk/{risk_id} |
dbss:auditInstance:getRiskRuleDetail |
- |
|
GET /v1/{project_id}/{instance_id}/dbss/audit/sensitive/masks |
dbss:auditInstance:listSensitiveRules |
- |
Resources
DBSS does not support resource-specific permission control in identity policies. If you want to allow access to DBSS, use the wildcard (*) for the Resource element to apply identity policies to all resources.
|
Resource Type |
URN |
Condition Key |
|---|---|---|
|
auditInstance |
dbss:<region>:<account-id>:auditInstance:<instance-id> |
|
Conditions
DBSS does not support service-specific condition keys in identity policies. DBSS can use global condition keys applicable to all services. For details, see Global Condition Keys.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
