Actions Supported by Policy-based Authorization

This section describes the actions supported by DCS in policy-based authorization.

Supported Actions

DCS provides system-defined policies, which can be directly used in IAM. You can also create custom policies to supplement system-defined policies for more refined access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:

Permissions: statements in a policy that allow or deny certain operations
APIs: REST APIs that can be called by a user who has been granted specific permissions
Actions: specific operations that are allowed or denied in a custom policy
Dependencies: actions which a specific action depends on. When allowing an action for a user, you also need to allow any existing action dependencies for that user.
IAM projects/Enterprise projects: the authorization scope of a custom policy. A custom policy can be applied to IAM projects or enterprise projects or both. Policies that contain actions for both IAM and enterprise projects can be used and applied for both IAM and Enterprise Management. Policies that contain actions only for IAM projects can be used and applied to IAM only. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. "√" indicates that the action supports the project and "×" indicates that the action does not support the project. For details about the differences between IAM and enterprise management, see Differences Between IAM and Enterprise Management.

DCS supports the following actions in custom policies:

**Table 1** DCS actions
Permission	API	Action	IAM Project	Enterprise Project
Querying instance upgrade information	-	dcs:instance:getUpgradeInfo	√	√
Listing background tasks	GET /v2/{project_id}/instances/{instance_id}/tasks	dcs:instance:getBackgroundTask	√	√
Querying details of a data migration task	GET /v2/{project_id}/migration-task/{task_id}	dcs:migrationTask:get	√	X
Viewing audit logs	-	dcs:auditlog:get	√	√
Querying instance configuration parameters	GET /v2/{project_id}/instances/{instance_id}/configs	dcs:instance:getConfiguration	√	√
Viewing parameter templates	GET /v2/{project_id}/config-templates/{template_id}	dcs:template:get	√	X
Listing parameter templates	GET /v2/{project_id}/config-templates	dcs:template:list	√	X
Querying instance restoration logs	GET /v2/{project_id}/instances/{instance_id}/restores	dcs:instance:getDataRestoreLog	√	√
Querying a DCS instance	GET /v2/{project_id}/instances/{instance_id}	dcs:instance:get	√	√
Querying instance backup logs	GET /v2/{project_id}/instances/{instance_id}/backups	dcs:instance:getDataBackupLog	√	√
Creating a DCS instance	POST /v2/{project_id}/instances	dcs:instance:create	√	√
Diagnosing an instance	POST /v2/{project_id}/instances/{instance_id}/diagnosis	dcs:instance:diagnosis	√	√
Creating a user for accessing an instance	POST /v2/{project_id}/instances/{instance_id}/accounts	dcs:aclaccount:create	√	√
Deleting instance backup files	DELETE /v2/{project_id}/instances/{instance_id}/backups/{backup_id}	dcs:instance:deleteDataBackupFile	√	√
Viewing the task progress	-	dcs:job:get	√	X
Expanding instance capacity	POST /v2/{project_id}/instances/{instance_id}/resize	dcs:instance:scale	√	√
Upgrading the instance version	-	dcs:instance:upgrade	√	√
Querying the Redis session list	GET /v2/{project_id}/instances/{instance_id}/clients	dcs:clients:list	√	√
Rolling back IP address switching	-	dcs:migrationTask:rollbackIp	√	X
Killing Redis sessions	POST /v2/{project_id}/instances/{instance_id}/clients/kill	dcs:clients:kill	√	√
Backing up an instance	POST /v2/{project_id}/instances/{instance_id}/backups	dcs:instance:backupData	√	√
Releasing historical domain names	-	dcs:histroydomainname:release	√	√
Enabling or disabling public domain name resolution	-	dcs:publicdomainname:update	√	√
Modifying DCS instance configuration parameters	PUT /v2/{project_id}/instances/{instance_id}/configs	dcs:instance:modifyConfigureation	√	√
Modifying SSL encryption for an instance	-	dcs:ssl:modify	√	√
Deleting an instance user	DELETE /v2/{project_id}/instances/{instance_id}/accounts/{account_id}	dcs:aclaccount:delete	√	√
Modifying a DCS instance	PUT /v2/{project_id}/instances/{instance_id}	dcs:instance:modify	√	√
Deleting a DCS instance	DELETE /v2/{project_id}/instances/{instance_id}	dcs:instance:delete	√	√
Performing a master/standby switchover	POST /v2/{project_id}/instances/{instance_id}/swap	dcs:instance:swap	√	√
Changing an instance password	PUT /v2/{project_id}/instances/{instance_id}/password	dcs:instance:modifyAuthInfo	√	√
Modifying migration task configurations or stopping a migration task	POST /v2/{project_id}/migration-task/{task_id}/stop	dcs:migrationTask:modify	√	X
Updating domain names	-	dcs:domainname:rebuild	√	√
Creating a migration task	POST /v2/{project_id}/migration-task	dcs:migrationTask:create	√	X
Modifying the information about an instance user	PUT /v2/{project_id}/instances/{instance_id}/accounts/{account_id}	dcs:aclaccount:modify	√	√
Enabling or disabling audit logging	-	dcs:auditlog:modify	√	√
Web CLI	POST /v2/{project_id}/instances/{instance_id}/webcli/auth	dcs:instance:webcli	√	√
Deleting a migration task	DELETE /v2/{project_id}/migration-tasks/delete	dcs:migrationTask:delete	√	X
Enabling or disabling client IP pass-through	PUT /v2/{project_id}/{instance_id}/client-ip-transparent-transmission	dcs:clientiptrans:modify	√	√
Deleting a parameter template	DELETE /v2/{project_id}/config-templates/{template_id}	dcs:template:delete	√	X
Modifying a parameter template	PUT /v2/{project_id}/config-templates/{template_id}	dcs:template:modify	√	X
Switching IP addresses	POST /v2/{project_id}/migration-task/{task_id}/exchange-ip	dcs:migrationTask:exchangeIp	√	X
Downloading instance backup data	POST /v2/{project_id}/instances/{instance_id}/backups/{backup_id}/links	dcs:instance:downloadBackupData	√	√
Analyzing big or hot keys	GET /v2/{project_id}/instances/{instance_id}/bigkey-task/{bigkey_id}	dcs:instance:analyze	√	√
Restoring an instance	POST /v2/{project_id}/instances/{instance_id}/restores	dcs:instance:restoreData	√	√
Deleting a background task	DELETE /v2/{project_id}/instances/{instance_id}/tasks/{task_id}	dcs:instance:deleteBackgroundTask	√	√
Resetting instance passwords	POST /v2/{project_id}/instances/{instance_id}/password/reset	dcs:instance:resetAuthInfo	√	√
Creating a parameter template	POST /v2/{project_id}/config-templates	dcs:template:create	√	X
Modifying instance running status	PUT /v2/{project_id}/instances/status	dcs:instance:modifyStatus	√	√
Modifying the whitelist of an instance	PUT /v2/{project_id}/instance/{instance_id}/whitelist	dcs:whitelist:modify	√	√
Obtaining the whitelist of an instance	GET /v2/{project_id}/instance/{instance_id}/whitelist	dcs:whitelist:list	√	√
Querying slow logs	GET /v2/{project_id}/instances/{instance_id}/slowlog	dcs:slowlog:list	√	√
Obtaining the list of instance users	GET /v2/{project_id}/instances/{instance_id}/accounts	dcs:aclaccount:list	√	√
Listing instances	GET /v2/{project_id}/instances	dcs:instance:list	√	√
Listing migration tasks	GET /v2/{project_id}/migration-tasks	dcs:migrationTask:list	√	X
Listing tags of an instance	GET /v2/{project_id}/instances/{instance_id}/tags	dcs:tag:get	√	X
Modifying an instance tag	POST /v2/{project_id}/dcs/{instance_id}/tags/action	dcs:tag:modify	√	√
Querying SSL encryption of an instance	-	dcs:ssl:get	√	X