Using IAM Identity Policies to Grant Access to GaussDB

Prerequisites

Before granting permissions, learn about the GaussDB permissions and select them as required. For the system-defined identity policies for GaussDB, see Identity Policy-based Authorization. To grant permissions for other services, learn about all system-defined permissions supported by IAM.

Process Flow

Figure 1 Process of granting GaussDB permissions

1. Create an IAM user or create a user group.

   Log in to the IAM console to create a user or user group.

2. Attach a system-defined policy to the user or user group.

   Assign the permissions defined in the system-defined policy GaussDBReadOnlyPolicy to a user or user group.

3. Log in as the IAM user and verify permissions.

   In the authorized region, perform the following operations:

   • Choose Service List > GaussDB. On the GaussDB console, click Create DB Instance in the upper right corner to create a GaussDB instance. If the GaussDB instance cannot be created (assuming only the GaussDBReadOnlyPolicy permission is assigned), the GaussDBReadOnlyPolicy permission has already taken effect.
   • Choose any other service in the service list. If a message appears indicating that you have insufficient permissions to access the service, the GaussDBReadOnlyPolicy policy has already taken effect.

Example Custom Identity Policies

Custom identity policies can be created to supplement the system-defined policies of GaussDB. For details about actions supported in custom identity policies, see Actions Supported by Identity Policy-based Authorization.

For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

When creating a custom identity policy, use the Resource element to specify the resources the identity policy applies to and use the Condition element (service-specific condition keys) to control when the identity policy is in effect. For details about the supported resource types and condition keys, see Actions Supported by Identity Policy-based Authorization. The following contains examples of common custom identity policies for GaussDB.

• Example 1: Grant the permission to create and delete GaussDB instances.

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "gaussdb:instance:createInstance",
                  "gaussdb:instance:deleteInstance"
              ]
          }
      ]
  }

• Example 2: Create a custom policy containing multiple actions.

  A custom identity policy can contain the actions of one or more services. The following is an example policy containing actions of multiple services:

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "gaussdb:instance:createInstance",
                  "gaussdb:instance:deleteInstance"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "evs:volumes:create",
                  "evs:volumes:list"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "ecs:cloudServers:createServers",
                  "ecs:cloudServers:listServersDetails"
              ]
          }
      ]
  }