Permissions

If you need to assign different permissions to personnel in your enterprise to access your GaussDB(for MySQL) resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you securely access your Huawei Cloud resources.

With IAM, you can create IAM users and assign permissions to control their access to specific resources. For example, if you want some software developers in your enterprise to use GaussDB(for MySQL) resources but do not want them to delete GaussDB(for MySQL) resources or perform any other high-risk operations, you can create IAM users for the software developers and grant them only the permissions required for using GaussDB(for MySQL) resources.

If your Huawei Cloud account does not require individual IAM users for permissions management, you can skip this section.

IAM is free of charge. You pay only for the resources in your account. For more information about IAM, see IAM Service Overview.

GaussDB(for MySQL) Permissions

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

GaussDB(for MySQL) is a project-level service deployed in specific physical regions. If you set Scope to Region-specific projects and select the specified projects in the specified regions, the users only have permissions for GaussDB(for MySQL) instances in the selected projects. If you set Scope to All projects, the users have permissions for GaussDB(for MySQL) instances in all region-specific projects. When accessing GaussDB(for MySQL) instances, the users need to switch to the authorized region.

You can grant permissions by using roles and policies.

Roles: A coarse-grained authorization strategy provided by IAM to assign permissions based on users' job responsibilities. Only a limited number of service-level roles are available for authorization. Cloud services depend on each other. When you grant permissions using roles, you also need to attach any existing role dependencies. Roles are not ideal for fine-grained authorization and least privilege access.

Policies: A fine-grained authorization strategy that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for least privilege access. For example, you can grant users only permissions to manage database resources of a certain type. A majority of fine-grained policies contain permissions for specific APIs, and permissions are defined using API actions. For the API actions supported by GaussDB(for MySQL), see Permissions Policies and Supported Actions.

Table 1 lists all the system-defined permissions for GaussDB(for MySQL).

**Table 1** System-defined permissions for GaussDB(for MySQL)
Role/Policy Name	Description	Type
GaussDB FullAccess	Full permissions for GaussDB(for MySQL)	System-defined policy
GaussDB ReadOnlyAccess	Read-only permissions for GaussDB(for MySQL)	System-defined policy

Table 2 lists common operations supported by each system-defined permission of GaussDB(for MySQL).

**Table 2** Common operations supported by system-defined permissions
Operation	GaussDB FullAccess	GaussDB ReadOnlyAccess
Creating a GaussDB(for MySQL) instance	Supported	Not supported
Deleting a GaussDB(for MySQL) instance	Supported	Not supported
Querying GaussDB(for MySQL) instances	Supported	Supported

**Table 3** Common operations and supported actions
Operation	Action	Description
Modifying parameters in a parameter template	gaussdb:param:modify	-
Changing DB instance specifications	gaussdb:instance:modifySpec	-
Creating a DB instance	gaussdb:instance:create	To select a VPC, subnet, and security group, configure the following actions: vpc:vpcs:list vpc:vpcs:get vpc:subnets:get vpc:securityGroups:get To create an encrypted instance, configure the KMS Administrator permission for the project. To create yearly/monthly instances, configure the following CBC actions: bss:renewal:view bss:renewal:update bss:balance:view bss:order:view bss:order:update bss:order:pay To configure TDE during instance creation, configure the following action: iam:agencies:createServiceLinkedAgencyV5
Creating a manual backup	gaussdb:backup:create	-
Querying backups	gaussdb:backup:list	-
Querying error logs	gaussdb:log:list	-
Rebooting a DB instance	gaussdb:instance:restart	-
Querying DB instances	gaussdb:instance:list	-
Creating a parameter template	gaussdb:param:create	-
Deleting a parameter template	gaussdb:param:delete	-
Modifying a backup policy	gaussdb:instance:modifyBackupPolicy	-
Viewing parameter templates	gaussdb:param:list	-
Deleting a DB instance	gaussdb:instance:delete	To unsubscribe from a yearly/monthly instance, configure the following action: bss:unsubscribe:update
Deleting a manual backup	gaussdb:backup:delete	-
Querying project tags	gaussdb:tag:list	-
Applying a parameter template	gaussdb:param:apply	-
Adding or deleting project tags in batches	gaussdb:instance:dealTag	-
Changing quotas	gaussdb:quota:modify	-
Upgrading a DB instance version	gaussdb:instance:upgrade	-
Promoting a read replica to the primary node	gaussdb:instance:switchover	-
Changing a database port	gaussdb:instance:modifyPort	-
Changing a security group	gaussdb:instance:modifySecurityGroup	-
Changing the private IP address	gaussdb:instance:modifyIp	To select an IP address, configure the following actions: vpc:vpcs:list vpc:vpcs:get
Enabling or disabling SSL	gaussdb:instance:modifySSL	-
Changing an instance name	gaussdb:instance:rename	-
Adding read replicas	gaussdb:instance:addNodes	-
Deleting read replicas	gaussdb:instance:deleteNodes	-
Scaling storage space	gaussdb:instance:modifyStorageSize	-
Changing a DB instance password	gaussdb:instance:modifyPassword	-
Binding an EIP to a DB instance	gaussdb:instance:bindPublicIp	To display EIPs on the console, configure: vpc:publicIps:get vpc:publicIps:list
Unbinding an EIP from a DB instance	gaussdb:instance:unbindPublicIp	-
Modifying a monitoring policy	gaussdb:instance:modifyMonitorPolicy	-
Changing a failover priority	gaussdb:instance:modifySwitchoverPriority	-
Changing the maintenance window	gaussdb:instance:modifyMaintenanceWindow	-
Isolating nodes	gaussdb:instance:isolateNodes	-
Enabling or disabling SQL Explorer	gaussdb:instance:modifyTraceSQLPolicy	-
Querying HTAP instances	gaussdb:htapInstance:list	-
Creating an HTAP instance	gaussdb:htapInstance:create	-
Modifying a GaussDB HTAP instance.	gaussdb:htapInstance:modify	-
Deleting an HTAP instance	gaussdb:htapInstance:delete	-
Changing an HTAP instance name	gaussdb:htapInstance:rename	-
Rebooting an HTAP instance	gaussdb:htapInstance:restart	-
Upgrading an HTAP instance version	gaussdb:htapInstance:upgrade	-
Promoting a read replica of an HTAP instance to primary	gaussdb:htapInstance:switchover	-
Changing the specifications of an HTAP Instance	gaussdb:htapInstance:modifySpec	-
Scaling up storage of an HTAP instance	gaussdb:htapInstance:modifyStorageSize	-
Binding an EIP for an HTAP instance	gaussdb:htapInstance:bindPublicIp	-
Unbinding an EIP from an HTAP instance	gaussdb:htapInstance:unbindPublicIp	-
Changing the port of an HTAP instance	gaussdb:htapInstance:modifyPort	-
Changing the HTAP instance password	gaussdb:htapInstance:modifyPassword	-
Creating an HTAP Data Synchronization Task	gaussdb:htapInstance:createDataSync	-
Modifying an HTAP Data Synchronization Task	gaussdb:htapInstance:modifyDataSync	-
Deleting an HTAP Data Synchronization Task	gaussdb:htapInstance:deleteDataSync	-
Creating a database proxy instance	gaussdb:proxy:create	-
Changing the IP address of a proxy instance	gaussdb:proxy:modifyIp	-
Modifying the read weights of a proxy instance	gaussdb:proxy:modifyWeight	-
Changing the database proxy port	gaussdb:proxy:modifyPort	-
Modifying database proxy access control	gaussdb:proxy:modifyAccess	-
Deleting a proxy instance	gaussdb:proxy:delete	-
Querying proxy Instances	gaussdb:proxy:list	-
Upgrading a proxy instance version	gaussdb:proxy:upgrade	-
Changing a proxy instance name	gaussdb:proxy:rename	-
Adding database proxy nodes	gaussdb:proxy:addNodes	-
Deleting database proxy nodes	gaussdb:proxy:deleteNodes	-
Changing specifications of a proxy instance	gaussdb:proxy:modifySpec	-
Applying for a private domain name for a database proxy instance	gaussdb:proxy:createDns	-
Changing the domain name of proxy instance	gaussdb:proxy:modifyDns	-
Deleting the domain name of a proxy instance	gaussdb:proxy:deleteDns	-
Changing the routing policy of a proxy instance	gaussdb:proxy:modifyRouteMode	-
Enabling or disabling SSL for a proxy instance	gaussdb:proxy:modifySSL	-
Creating database users	gaussdb:user:create	-
Deleting database users	gaussdb:user:delete	-
Changing the password of a database user	gaussdb:user:modify	-
Querying database users	gaussdb:user:list	-
Authorizing database permissions to users	gaussdb:user:grantPrivilege	-
Revoking database permissions from users	gaussdb:user:revokePrivilege	-
Creating databases	gaussdb:database:create	-
Deleting databases	gaussdb:database:delete	-
Querying databases	gaussdb:database:list	-
Querying predefined tags	-	To query predefined tags, configure the following action: tms:resourceTags:list
Querying configured log groups	-	To query configured log groups, configure the following action: lts:groups:get
Querying configured log streams	-	To query configured log streams, configure the following action: lts:topics:get
Modifying auto scaling policies	gaussdb:autoscaling:createPolicy	To modify auto scaling policies, configure the following action: iam:agencies:listAgencies