Fine-Grained Permissions Policies

GaussDB(DWS) Permissions in Fine-Grained Policies

When creating a custom policy on IAM, you can add the operations on GaussDB(DWS) resources or the permissions corresponding to RESTful APIs to the action list of the policy authorization statement so that the policy contains the operation permissions. The following table lists the GaussDB(DWS) permissions.

• RESTful APIs

  For details about GaussDB(DWS) REST API actions, see "Permissions Policies and Supported Actions" in the Data Warehouse Service (DWS) API Reference.

• Management console operations

  Table 1 describes the GaussDB(DWS) operations on resources and corresponding permissions.

Authorization Using the Fine-Grained Permission Policy

1. Log in to the IAM console and create a custom policy.

   For details, see "User Guide > Fine-grained Policy Management > Creating Custom Policies" in the Identity and Access Management User Guide.

   Refer to the following to create the policy:

   • Use the IAM administrator account, that is, the user in the admin user group, because only the IAM administrator has the permissions to create users and user groups and modify user group permissions.
   • GaussDB(DWS) is a project-level service, so its Scope must be set to Project-level services. If this policy is required to take effect for multiple projects, authorization is required to each project.
   • Two GaussDB(DWS) policy templates are preconfigured on IAM. When creating a custom policy, you can select either of the following templates and modify the policy authorization statement based on the template:
     • DWS Admin: has all execution permissions on GaussDB(DWS).
     • DWS Viewer: has the read-only permission on GaussDB(DWS).
   • You can add permissions corresponding to GaussDB(DWS) operations or RESTful APIs listed in GaussDB(DWS) Permissions in Fine-Grained Policies to the action list in the policy authorization statement, so that the policy can obtain the permissions.

     For example, if dws:cluster:create is added to the action list of a policy statement, the policy has the permission to create or restore clusters.

   • If you want to use other services, grant related operation permissions on these services. For details, see the help documents of related services.

     For example, when creating a data warehouse cluster, you need to configure the VPC to which the cluster belongs. To obtain the VPC list, add permission vpc:*:get* to the policy statement.

   Policy example:

   • Example in which multiple operation permissions are supported
     For example, the following policy has the permissions to create/restore/restart/delete a cluster, set security parameters, and reset passwords.

     {
           "Version": "1.1",
           "Statement": [
                 {
                       "Effect": "Allow",
                       "Action": [
                             "dws:cluster:create",
                             "dws:cluster:restart",
                             "dws:cluster:delete",
                             "dws:cluster:setSecuritySettings",
                             "dws:cluster:resetPassword",
                             "ecs:*:get*",
                             "ecs:*:list*",
                             "ecs:*:create*",
                             "ecs:*:delete*",
                             "vpc:*:get*",
                             "vpc:*:list*",
                             "vpc:*:create*",
                             "vpc:*:delete*",
                             "evs:*:get*",
                             "evs:*:list*",
                             "evs:*:create*",
                             "evs:*:delete*"
                       ]
                 }
           ]
     }

   • Example of wildcard (*) usage
     For example, the following policy has all operation permissions on GaussDB(DWS) snapshots.

     {
           "Version": "1.1",
           "Statement": [
                 {
                       "Effect": "Allow",
                       "Action": [
                             "dws:snapshot:*",
                             "ecs:*:get*",
                             "ecs:*:list*",
                             "vpc:*:get*",
                             "vpc:*:list*"
                       ]
                 }
           ]
     }

2. Create a user group.

   For details, see "User Guide > User and User Group Management > Creating a User Group" in the Identity and Access Management User Guide.

3. Add users to the user group and grant the new custom policy to the user group so that users in it can obtain the permissions defined by the policy.

   For details, see "User Guide > User and User Group Management > Viewing and Modifying User Group Information" in the Identity and Access Management User Guide.