GaussDB(for MySQL)
The Organizations service provides Service Control Policies (SCPs) to set access control policies.
SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.
This section describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.
For details about how to use these elements to create a custom SCP, see Creating an SCP.
Actions
Actions are specific operations that are allowed or denied in an SCP.
- The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an SCP.
- The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by GaussDB(for MySQL), see Resources.
- The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by GaussDB(for MySQL), see Conditions.
The following table lists the actions that you can define in SCP statements for GaussDB(for MySQL).
|
Action |
Description |
Access Level |
Resource Type (*: required) |
Condition Key |
|---|---|---|---|---|
|
gaussdbformysql:backup:modifyPolicy |
Grants permission to configure an automated backup policy. |
Permissions management |
- |
- |
|
gaussdbformysql:param:delete |
Grants permission to delete a parameter template. |
Permissions management |
- |
- |
|
gaussdbformysql:instance:switchover |
Grants permission to promote a read replica to primary. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:auditlog:list |
Grants permission to query audit logs. |
List |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:backup:create |
Grants permission to create a manual backup. |
Write |
- |
- |
|
gaussdbformysql:backup:delete |
Grants permission to delete a backup. |
Write |
- |
- |
|
gaussdbformysql:backup:getRestoreTime |
Grants permission to query the restoration time range. |
Read |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:backup:list |
Grants permission to query backups. |
List |
- |
- |
|
gaussdbformysql:backup:listPolicy |
Grants permission to query backup policies. |
List |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:database:create |
Grants permission to create a database. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:database:delete |
Grants permission to delete a database. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:database:list |
Grants permission to query databases. |
List |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:database:modify |
Grants permission to modify database information. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:getSecondLevelMonitoringConfig |
Grants permission to query the configuration of Monitoring by Seconds. |
Read |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:addReadOnlyNodes |
Grants permission to add read replicas. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:create |
Grants permission to create a DB instance. |
Write |
- |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:delete |
Grants permission to delete a DB instance. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:deleteSqlFilterRules |
Grants permission to delete concurrency control rules of SQL statements. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:get |
Grants permission to obtain the details about a DB instance. |
Read |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:getDcc |
Grants permission to query the details about a dedicated resource pool. |
Read |
- |
- |
|
gaussdbformysql:instance:getSqlFilterRule |
Grants permission to query concurrency control rules of SQL statements. |
Read |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:getSqlFilterStatus |
Grants permission to query whether SQL Statement Concurrency Control is enabled. |
Read |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:list |
Grants permission to query DB instances. |
List |
- |
- |
|
gaussdbformysql:proxy:list |
Grants permission to query proxy instances. |
List |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:proxy:listSpec |
Grants permission to query proxy instance specifications. |
List |
- |
- |
|
gaussdbformysql:instance:listDcc |
Grants permission to query dedicated resources. |
List |
- |
- |
|
gaussdbformysql:instance:listEngine |
Grants permission to query the DB engine information. |
List |
- |
- |
|
gaussdbformysql:instance:listSpec |
Grants permission to query specifications. |
List |
- |
- |
|
gaussdbformysql:auditlog:operate |
Grants permission to enable or disable SQL Explorer. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:bindPublicIp |
Grants permission to bind an EIP. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:deleteReadOnlyNodes |
Grants permission to delete a read replica. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:modifyVip |
Grants permission to change private IP address. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:modifyMaintenanceWindow |
Grants permission to change a maintenance window of a DB instance. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:modifySecondLevelMonitorPolicy |
Grants permission to change the collection period of Monitoring by Seconds. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:modifyPassword |
Grants permission to change the password of a DB instance. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:modifyPort |
Grants permission to change a DB instance port. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:modifySecurityGroup |
Grants permission to change a security group. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:modifySSL |
Grants permission to enable or disable SSL. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:modifyStorageSize |
Grants permission to scale down storage of a DB instance. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:rename |
Grants permission to change a DB instance name. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:unbindPublicIp |
Grants permission to unbind an EIP. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:upgrade |
Grants permission to upgrade the kernel version of a DB instance. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:user:create |
Grants permission to create a database account. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:proxy:addNodes |
Grants permission to add proxy nodes. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:proxy:create |
Grants permission to create a proxy instance. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:proxy:delete |
Grants permission to delete a proxy instance. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:proxy:modifySpec |
Grants permission to change specifications of a proxy instance. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:proxy:modifyWeight |
Grants permission to change read weights of nodes for a proxy instance. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:modifySpec |
Grants permission to change instance specifications. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:restart |
Grants permission to reboot a DB instance. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:restoreInPlace |
Grants permission to restore data to an existing instance. |
Permissions management |
- |
- |
|
gaussdbformysql:instance:setSqlFilterRules |
Grants permission to configure concurrency control rules of SQL statements. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:setSqlFilterStatus |
Grants permission to enable or disable SQL statement concurrency control. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:instance:tableRestore |
Grants permission to restore tables to a specific point of time. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:tag:deal |
Grants permission to add or delete resource tags. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:log:getErrorLogs |
Grants permission to query error logs. |
Read |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:log:getSlowLogs |
Grants permission to query slow query logs. |
Read |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:param:apply |
Grants permission to apply a parameter template. |
Permissions management |
- |
- |
|
gaussdbformysql:param:create |
Grants permission to create a parameter template. |
Write |
- |
- |
|
gaussdbformysql:param:get |
Grants permission to obtain details about a parameter template. |
Read |
- |
- |
|
gaussdbformysql:param:list |
Grants permission to query parameter templates. |
List |
- |
- |
|
gaussdbformysql:param:update |
Grants permission to modify parameters in a parameter template. |
Write |
- |
- |
|
gaussdbformysql:proxy:modifyConsistency |
Grants permission to change session consistency of a proxy instance. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:proxy:modifyTransactionSplit |
Grants permission to enable or disable transaction splitting of a proxy instance. |
Permissions management |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:quota:list |
Grants permission to query quotas. |
Read |
- |
- |
|
gaussdbformysql:quota:modify |
Grants permission to modify quotas. |
Write |
- |
- |
|
gaussdbformysql:tag:list |
Grants permission to query tags. |
List |
- |
- |
|
gaussdbformysql:task:delete |
Grants permission to delete a task record. |
Write |
- |
- |
|
gaussdbformysql:task:list |
Grants permission to obtain tasks. |
List |
- |
- |
|
gaussdbformysql:user:delete |
Grants permission to delete a database user. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:user:grantPrivilege |
Grants permission to change permissions of a database user. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:user:list |
Grants permission to query database users. |
List |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:user:modify |
Grants permission to query remarks of a database user. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:user:revokePrivilege |
Grants permission to delete permissions of a database user. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:user:updatePassWord |
Grants permission to change password of a database user. |
Write |
instance * |
g:EnterpriseProjectId |
|
gaussdbformysql:proxy:switchConnectionPoolType |
Grants permission to change the connection pool type of a proxy instance. |
Permissions management |
instance * |
g:EnterpriseProjectId |
Each API of GaussDB(for MySQL) usually supports one or more actions. Table 2 lists the supported actions and dependencies.
|
API |
Action |
Dependencies |
|---|---|---|
|
GET /v3/{project_id}/datastores/{database_name} |
gaussdbformysql:instance:listEngine |
- |
|
GET /v3/{project_id}/flavors/{database_name} |
gaussdbformysql:instance:listSpec |
- |
|
POST /v3/{project_id}/instances |
gaussdbformysql:instance:create |
- |
|
GET /v3.1/{project_id}/instances |
gaussdbformysql:instance:list |
- |
|
POST /v3/{project_id}/instances/{instance_id}/restart |
gaussdbformysql:instance:restart |
- |
|
DELETE /v3/{project_id}/instances/{instance_id} |
gaussdbformysql:instance:delete |
- |
|
GET /v3.1/{project_id}/instances/{instance_id} |
gaussdbformysql:instance:get |
- |
|
GET /v3.1/{project_id}/instances/details |
gaussdbformysql:instance:get |
- |
|
POST /v3/{project_id}/instances/{instance_id}/nodes/enlarge |
gaussdbformysql:instance:addReadOnlyNodes |
- |
|
DELETE /v3/{project_id}/instances/{instance_id}/nodes/{node_id} |
gaussdbformysql:instance:deleteReadOnlyNodes |
- |
|
POST /v3/{project_id}/instances/{instance_id}/volume/extend |
gaussdbformysql:instance:modifyStorageSize |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/backups/policy/update |
gaussdbformysql:backup:modifyPolicy |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/name |
gaussdbformysql:instance:rename |
- |
|
POST /v3/{project_id}/instances/{instance_id}/password |
gaussdbformysql:instance:modifyPassword |
- |
|
POST /v3/{project_id}/instances/{instance_id}/action |
gaussdbformysql:instance:modifySpec |
- |
|
GET /v3/{project_id}/dedicated-resources |
gaussdbformysql:instance:listDcc |
- |
|
GET /v3/{project_id}/dedicated-resource/{dedicated_resource_id} |
gaussdbformysql:instance:getDcc |
- |
|
POST /v3/{project_id}/instances/{instance_id}/proxy |
gaussdbformysql:proxy:create |
- |
|
DELETE /v3/{project_id}/instances/{instance_id}/proxy |
gaussdbformysql:proxy:delete |
- |
|
GET /v3/{project_id}/instances/{instance_id}/proxies |
gaussdbformysql:proxy:list |
- |
|
GET /v3/{project_id}/instances/{instance_id}/proxy/flavors |
gaussdbformysql:proxy:listSpec |
- |
|
POST /v3/{project_id}/instances/{instance_id}/proxy/enlarge |
gaussdbformysql:proxy:addNodes |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/flavor |
gaussdbformysql:proxy:modifySpec |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/weight |
gaussdbformysql:proxy:modifyWeight |
- |
|
POST /v3/{project_id}/instances/{instance_id}/proxy/transaction-split |
gaussdbformysql:proxy:modifyTransactionSplit |
- |
|
POST /v3.1/{project_id}/instances/{instance_id}/error-logs |
gaussdbformysql:log:getErrorLogs |
- |
|
POST /v3.1/{project_id}/instances/{instance_id}/slow-logs |
gaussdbformysql:log:getSlowLogs |
- |
|
GET /v3/{project_id}/project-quotas |
gaussdbformysql:quota:list |
- |
|
GET /v3/{project_id}/quotas |
gaussdbformysql:quota:list |
- |
|
POST /v3/{project_id}/quotas |
gaussdbformysql:quota:modify |
- |
|
PUT /v3/{project_id}/quotas |
gaussdbformysql:quota:modify |
- |
|
POST /v3/{project_id}/backups/create |
gaussdbformysql:backup:create |
- |
|
GET /v3/{project_id}/backups |
gaussdbformysql:backup:list |
- |
|
GET /v3/{project_id}/instances/{instance_id}/backups/policy |
gaussdbformysql:backup:listPolicy |
- |
|
GET /v3/{project_id}/configurations |
gaussdbformysql:param:list |
- |
|
POST /v3/{project_id}/configurations |
gaussdbformysql:param:create |
- |
|
DELETE /v3/{project_id}/configurations/{configuration_id} |
gaussdbformysql:param:delete |
- |
|
GET /v3/{project_id}/configurations/{configuration_id} |
gaussdbformysql:param:get |
- |
|
PUT /v3/{project_id}/configurations/{configuration_id} |
gaussdbformysql:param:update |
- |
|
PUT /v3/{project_id}/configurations/{configuration_id}/apply |
gaussdbformysql:param:apply |
- |
|
GET /v3/{project_id}/instances/{instance_id}/tags |
gaussdbformysql:tag:list |
- |
|
GET /v3/{project_id}/tags |
gaussdbformysql:tag:list |
- |
|
POST /v3/{project_id}/instances/{instance_id}/tags/action |
gaussdbformysql:tag:deal |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/monitor-policy |
gaussdbformysql:instance:modifySecondLevelMonitorPolicy |
- |
|
GET /v3/{project_id}/instances/{instance_id}/monitor-policy |
gaussdbformysql:instance:getSecondLevelMonitoringConfig |
- |
|
POST /v3/{project_id}/instances/{instance_id}/nodes/{node_id}/restart |
gaussdbformysql:instance:restart |
- |
|
POST /v3/{project_id}/instance/{instance_id}/audit-log/switch |
gaussdbformysql:auditlog:operate |
- |
|
GET /v3/{project_id}/instance/{instance_id}/audit-log/switch-status |
gaussdbformysql:auditlog:list |
- |
|
GET /v3/{project_id}/jobs |
gaussdbformysql:task:list |
- |
|
POST /v3/{project_id}/instances/{instance_id}/db-users |
gaussdbformysql:user:create |
- |
|
GET /v3/{project_id}/instances/{instance_id}/db-users |
gaussdbformysql:user:list |
- |
|
DELETE /v3/{project_id}/instances/{instance_id}/db-users |
gaussdbformysql:user:delete |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/db-users/comment |
gaussdbformysql:user:modify |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/db-users/password |
gaussdbformysql:user:updatePassWord |
- |
|
POST /v3/{project_id}/instances/{instance_id}/db-users/privilege |
gaussdbformysql:user:grantPrivilege |
- |
|
DELETE /v3/{project_id}/instances/{instance_id}/db-users/privilege |
gaussdbformysql:user:revokePrivilege |
- |
|
GET /v3/{project_id}/instances/{instance_id}/databases/charsets |
gaussdbformysql:database:list |
- |
|
POST /v3/{project_id}/instances/{instance_id}/databases |
gaussdbformysql:database:create |
- |
|
GET /v3/{project_id}/instances/{instance_id}/databases |
gaussdbformysql:database:list |
- |
|
DELETE /v3/{project_id}/instances/{instance_id}/databases |
gaussdbformysql:database:delete |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/databases/comment |
gaussdbformysql:database:modify |
- |
|
POST /v3/{project_id}/instances/{instance_id}/sql-filter/switch |
gaussdbformysql:instance:setSqlFilterStatus |
- |
|
GET /v3/{project_id}/instances/{instance_id}/sql-filter/switch |
gaussdbformysql:instance:getSqlFilterStatus |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/sql-filter/rules |
gaussdbformysql:instance:setSqlFilterRules |
- |
|
GET /v3/{project_id}/instances/{instance_id}/sql-filter/rules |
gaussdbformysql:instance:getSqlFilterRule |
- |
|
DELETE /v3/{project_id}/instances/{instance_id}/sql-filter/rules |
gaussdbformysql:instance:deleteSqlFilterRules |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/session-consistence |
gaussdbformysql:proxy:modifyConsistency |
- |
|
GET /v3/{project_id}/immediate-jobs |
gaussdbformysql:task:list |
- |
|
GET /v3/{project_id}/scheduled-jobs |
gaussdbformysql:task:list |
- |
|
DELETE /v3/{project_id}/scheduled-jobs |
gaussdbformysql:task:delete |
- |
|
DELETE /v3/{project_id}/jobs/{job_id} |
gaussdbformysql:task:delete |
- |
|
POST /v3/{project_id}/instances/{instance_id}/db-upgrade |
gaussdbformysql:instance:upgrade |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/ssl-option |
gaussdbformysql:instance:modifySSL |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/public-ips/bind |
gaussdbformysql:instance:bindPublicIp |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/public-ips/unbind |
gaussdbformysql:instance:unbindPublicIp |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/switchover |
gaussdbformysql:instance:switchover |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/ops-window |
gaussdbformysql:instance:modifyMaintenanceWindow |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/security-group |
gaussdbformysql:instance:modifySecurityGroup |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/internal-ip |
gaussdbformysql:instance:modifyVip |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/port |
gaussdbformysql:instance:modifyPort |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/alias |
gaussdbformysql:instance:rename |
- |
|
DELETE /v3/{project_id}/backups/{backup_id} |
gaussdbformysql:backup:delete |
- |
|
POST /v3.1/{project_id}/instances/{instance_id}/restore/tables |
gaussdbformysql:instance:tableRestore |
- |
|
POST /v3/{project_id}/instances/restore |
gaussdbformysql:instance:restoreInPlace |
- |
|
GET /v3/{project_id}/instances/{instance_id}/restore-time |
gaussdbformysql:backup:getRestoreTime |
- |
|
PUT /v3/{project_id}/instances/{instance_id}/proxy/{proxy_id}/connection-pool-type |
gaussdbformysql:proxy:switchConnectionPoolType |
- |
Resources
A resource type indicates the resources that an SCP applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the SCP statements using that action, and the SCP applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the SCP applies to all resources. You can also set condition keys in an SCP to define resource types.
The following table lists the resource types that you can define in SCP statements for GaussDB(for MySQL).
Conditions
GaussDB(for MySQL) does not support service-specific condition keys in SCPs. It can only use global condition keys applicable to all services. For details, see Global Condition Keys.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
