Actions Supported by Policy-based Authorization

This section describes the actions supported by DAS in policy-based authorization.

Supported Actions

DAS provides system-defined policies that can be directly used in IAM. You can also create custom policies to supplement system-defined policies for more refined access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:

Permissions: statements that allow or deny certain operations
APIs: REST APIs that can be called by a user who has been granted specific permissions.
Actions: specific operations that are allowed or denied in a custom policy.
Dependencies: actions which a specific action depends on. When allowing an action for a user, you also need to allow any existing action dependencies for that user.
IAM or enterprise projects: the authorization scope of a custom policy. A custom policy can be applied to IAM projects or enterprise projects or both. Policies that contain actions for both IAM and enterprise projects can be used and applied for both IAM and Enterprise Management. Policies that contain actions only for IAM projects can be used and applied to IAM only. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. For details about the differences between IAM and enterprise management, see Differences Between IAM and Enterprise Management.

DAS supports the following actions in custom policies.

**Table 1** Intelligent O&M
Permission	API	Action	IAM Project	Enterprise Project
Querying database users	GET /v3/{project_id}/instances/{instance_id}/db-users	das:clouddba:listDbUser	√	x
Creating a database user	POST /v3/{project_id}/instances/{instance_id}/db-users	das:clouddba:registerDbUser	√	x
Querying a specified database user	GET /v3/{project_id}/instances/{instance_id}/db-users/{db_user_id}	das:clouddba:getDbUser	√	x
Modifying a database user	PUT /v3/{project_id}/instances/{instance_id}/db-users/{db_user_id}	das:clouddba:modifyDbUser	√	x
Deleting a database user	DELETE /v3/{project_id}/instances/{instance_id}/db-users/{db_user_id}	das:clouddba:deleteDbUser	√	x
Querying a SQL execution plan	GET /v3/{project_id}/instances/{instance_id}/sql/explain	das:clouddba:showSqlExecutionPlan	√	x
Querying a SQL execution plan	POST /v3/{project_id}/instances/{instance_id}/sql/explain	das:clouddba:showSqlExecutionPlan	√	x
Querying instance sessions	GET /v3/{project_id}/instances/{instance_id}/processes	das::showCloudDBAInfo	√	x
Killing a session	DELETE /v3/{project_id}/instances/{instance_id}/process	das:clouddba:deleteProcess	√	×
Querying metadata locks	GET /v3/{project_id}/instances/{instance_id}/metadata-locks	das:clouddba:listMetadataLock	√	×
Querying InnoDB lock waits	GET /v3/{project_id}/instances/{instance_id}/innodb-locks	das:clouddba:listInnodbLock	√	×
Exporting slow query logs	GET /v3/{project_id}/instances/{instance_id}/slow-query-logs	das:clouddba:slowSqlExport	√	×
Exporting all query logs	GET /v3/{project_id}/instances/{instance_id}/sql-statements	das:clouddba:fullSqlExport	√	×
Querying SQL Insights tasks	GET /v3/{project_id}/instances/{instance_id}/full-sql-tasks	das:clouddba:listFullSql	√	×
Exporting details about all query logs	GET /v3/{project_id}/instances/{instance_id}/full-sql-search	das:clouddba:listFullSql	√	×
Whether Collect All Query Logs and Collect Slow Query Logs are enabled	GET /v3/{project_id}/instances/{instance_id}/sql/switch	das:clouddba:showSqlSwitchStatus	√	×
Enabling or disabling Collect All Query Logs and Collect Slow Query Logs	POST /v3/{project_id}/instances/{instance_id}/sql/switch	das:clouddba:changeSqlSwitch	√	×
Whether Historical Transactions is enabled	GET /v3/{project_id}/instances/{instance_id}/transaction/switch	das::showCloudDBAInfo	√	×
Enabling or disabling historical transactions	POST /v3/{project_id}/instances/{instance_id}/transaction/switch	das:clouddba:changeTransactionSwitch	√	×
Querying historical transactions	GET /v3/{project_id}/instances/{instance_id}/transaction	das::showCloudDBAInfo	√	×
Obtaining the space analysis data list	GET /v3/{project_id}/instances/{instance_id}/space-analysis	das:clouddba:listSpaceAnalysis	√	×
Creating a space analysis task	POST /v3/{project_id}/instances/{instance_id}/space-analysis	das:clouddba:createSpaceAnalysisTask	√	×
Querying whether SQL Throttling is enabled	GET /v3/{project_id}/instances/{instance_id}/sql-limit/switch	das:clouddba:showSqlLimitSwitchStatus	√	×
Enabling or disabling SQL Throttling	POST /v3/{project_id}/instances/{instance_id}/sql-limit/switch	das:clouddba:changeSqlLimitSwitchStatus	√	×
Querying a SQL throttling task	GET /v3/{project_id}/instances/{instance_id}/sql-limit/job	das:clouddba:showSqlLimitJobInfo	√	×
Querying SQL throttling rules	GET /v3/{project_id}/instances/{instance_id}/sql-limit/rules	das:clouddba:listSqlLimitRules	√	×
Creating a SQL throttling rule	POST /v3/{project_id}/instances/{instance_id}/sql-limit/rules	das:clouddba:createSqlLimitRules	√	×
Deleting a SQL throttling rule	DELETE /v3/{project_id}/instances/{instance_id}/sql-limit/rules	das:clouddba:deleteSqlLimitRules	√	×
Modifying a SQL throttling rule	PUT /v3/{project_id}/instances/{instance_id}/sql-limit/rules	das:clouddba:updateSqlLimitRules	√	×
Generating keywords of a SQL throttling rule based on the original SQL statement	POST /v3/{project_id}/instances/{instance_id}/sql-limit/parse	das:clouddba:createSqlLimitRules	√	×
Querying Intelligent O&M quotas	GET /v3/{project_id}/quotas	das::showQuotas	√	×
Exporting the top SQL template list	GET /v3/{project_id}/instances/{instance_id}/top-sql-templates	das:clouddba:listTopSql	√	×
Exporting SQL duration distribution	GET /v3/{project_id}/instances/{instance_id}/top-sql-trend	das:clouddba:listTopSql	√	×
Exporting the slow SQL template list	GET /v3/{project_id}/instances/{instance_id}/slow-sql-templates	das:clouddba:slowSqlExport	√	×
Exporting the quantity trend of slow query logs	GET /v3/{project_id}/instances/{instance_id}/slow-sql-trend	das:clouddba:slowSqlExport	√	×
Exporting slow query log statistics	POST /v3/{project_id}/instances/{instance_id}/slow-sql-statistics	das::showCloudDBAInfo	√	×
Executing a SQL diagnosis task	POST /v3/{project_id}/connections/{connectionId}/tuning/create-tuning	das:clouddba:sqlDiagnosis	√	×
Obtaining the diagnosis result	GET /v3/{project_id}/connections/{connectionId}/tuning/{messageId}/show-tuning-result	das:clouddba:sqlDiagnosis	√	×
Exporting top risky instances	GET /v3/{project_id}/instances/top-risk	das::showCloudDBAInfo	√	×
Querying the risk trend of an instance	GET /v3/{project_id}/instances/risk-trend	das::showCloudDBAInfo	√	×
Querying the instance distribution	GET /v3/{project_id}/instances/distribution	das::showCloudDBAInfo	√	×
Querying top slow SQL statements	GET /v3/{project_id}/instances/top-slow-log	das::showCloudDBAInfo	√	×
Querying top slow SQL statements of an instance	GET /v3/{project_id}/instances/{instance_id}/top-slow-log	das::showCloudDBAInfo	√	×
Single metric on multiple nodes	GET /v3/{project_id}/metric-names/support	das::showCloudDBAInfo	√	×
Obtaining information about a single instance node	GET /v3/{project_id}/instance/nodes-info	das::showCloudDBAInfo	√	×
Obtaining data of a single metric on multiple nodes	POST /v3/{project_id}/multi-nodes/single-metric	das::showCloudDBAInfo	√	×
Querying risk items of an instance	GET /v3/{project_id}/get-risk-items	das::showCloudDBAInfo	√	×
Setting metric thresholds	POST /v3/{project_id}/set-metric-threshold	das::setMetricThreshold	√	×
Viewing the instance list on the Intelligent O&M page	GET /v3/{project_id}/instances	das::listInstances	√	×
Creating an instance diagnosis task	POST /v3/{project_id}/instances/{instance_id}/create-instance-health-report-task	das:clouddba:dailyReportsSubscribe	√	×
Querying instance diagnosis reports	GET /v3/{project_id}/instances/{instance_id}/get-instance-health-report-task-list	das:clouddba:listDailyReports	√	×
Obtaining an instance diagnosis report	GET /v3/{project_id}/instances/{instance_id}/get-instance-health-report	das:clouddba:listDailyReports	√	×
Synchronizing the instance list	POST /v3/{project_id}/instances/synchronize-instance-list	das::showCloudDBAInfo	√	×
Setting the payment mode	POST /v3/{project_id}/cloud-dba/change-payment-mode	das:clouddba:changePaymentMode	√	×
Creating a task for parsing all SQL statements	POST /v3/{project_id}/instances/{instance_id}/full-sql/add-task	das:clouddba:listFullSql	√	×

**Table 2** Development Tool
Permission	API	Action	IAM Project	Enterprise Project
Setting a shared connection	POST /v3/{project_id}/connections/share	das:connection:createShareConnections	√	x
Deleting a shared connection	DELETE /v3/{project_id}/connections/share	das:connection:cancelShareConnections	√	x
Creating an instance connection	POST /v3/{project_id}/instances/{instance_id}/create-connection	das:instance:createConnection	√	x
Querying the instance connection list	GET /v3/{project_id}/list-connections	das::showCloudDBAInfo	√	x