Database Security Service (DBSS)

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see What Are the Differences in Access Control Between IAM and Organizations?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to create a custom SCP, see Creating an SCP.

Action

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN for the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table.
For details about the resource types defined by DBSS, see Resource.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by DBSS, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for identity policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for DBSS.

**Table 1** Actions supported by DBSS
Action	Description	Access Level	Resource Type (*: Required)	Condition Key	Alias
dbss:auditInstance:listSqlInjectRules	Grants permission to query SQL injection rules.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:listSqls	Grants permission to obtain audit results.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:switchSqlInjectRule	Grants permission to enable or disable SQL injection policies.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:addSqlInjectRule	Grants permission to add custom SQL injection rules.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:orderSqlInjectRule	Grants permission to sort SQL rules by priority.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:createReporter	Grants permission to generate reports immediately.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:listReporters	Grants permission to query report information.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:getRiskRuleDetail	Grants permission to query a specified risk rule policy.	Read	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:listAlarmEmails	Grants permission to query alarm email information.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:downloadReporter	Grants permission to download reports.	Read	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:listAuditScopeRules	Grants permission to query the policy list for an audit scope.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:addSensitiveRule	Grants permission to add a privacy data protection rule.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:editSensitiveRule	Grants permission to edit privacy data protection rules.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:deleteReporter	Grants permission to delete reports.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:listOperateLog	Grants permission to query user operation logs.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:listMonitorInfos	Grants permission to query audit instance monitoring information.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:listSessionInfo	Grants permission to query audit instance session information.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:switchBackup	Grants permission to enable or disable the backup function.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss::downloadLicense	Grants permission to download a sales license.	Read	-	-	dbss:auditInstance:list
dbss::deleteAuditInstanceJob	Grants permission to delete failed audit instance creation tasks.	Write	-	-	dbss:auditInstance:delete
dbss::listRdsDb	Grants permission to query RDS databases.	List	-	-	dbss:auditInstance:list
dbss:auditInstance:instanceStart	Grants permission to enable audit instances.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:start
dbss:auditInstance:reboot	Grants permission to restart audit instances.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
dbss:auditInstance:stop	Grants permission to disable audit instances.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
dbss:auditInstance:upgrade	Grants permission to upgrade audit instances.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss::queryUpgradeStatus	Grants permission to query the upgrade status of an audit instance.	List	-	-	dbss:auditInstance:createOnOrder
dbss:auditInstance:updateSecurityGroup	Grants permission to modify the security group of an audit instance.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:modifyAttribute	Grants permission to modify attributes of audit instances.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:downloadAgent	Grants permission to download agents.	Read	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:switchAgent	Grants permission to enable or disable agents.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:listAgents	Grants permissions to obtain the agent list.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:deleteAgent	Grants permissions to delete agents.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:addAgent	Grants permissions to add agents.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:previewReporter	Grants permissions to preview reports.	Read	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:setAlarmConfig	Grants permission to configure alarm information.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:configAlarmEmail	Grants permission to configure alarm email information.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:getAlarmConfig	Grants permission to query alarm configurations.	Read	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:listRiskRules	Grants permission to query risk rule policies.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:exportInstancesDatabaseConfig	Grants permission to export database configurations.	List	auditInstance *	-	dbss:auditInstance:createOnOrder
dbss:auditInstance:createOnPeriod	Grants permission to create audit instances in yearly/monthly billing mode.	Write	auditInstance *	-	dbss:auditInstance:createOnOrder
dbss:auditInstance:createOnPeriod		Write	-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId dbss:VpcId dbss:SubnetId	dbss:auditInstance:createOnOrder
dbss:auditInstance:editSqlInjectRule	Grants permission to edit custom SQL injection rules.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:deleteSqlInjectRule	Grants permission to delete custom SQL injection rules.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:deleteSensitiveRule	Grants permission to delete privacy data protection rules.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:deleteAuditScopeRule	Grants permission to delete an audit scope rule.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:deleteRiskRule	Grants permission to delete a risk rule.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:deleteBackup	Grants permission to delete local backup information.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:listBackups	Grants permission to query backup information.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:getBackupConfig	Grants permission to obtain backup configuration information.	Read	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:editAuditScopeRule	Grants permission to edit an audit scope rule.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:instanceList	Grants permission to query audit instance information.	List	auditInstance *	-	dbss:auditInstance:list
dbss:auditInstance:createOnDemand	Grants permission to create audit instances in pay-per-use mode.	Write	auditInstance *	-	-
dbss:auditInstance:createOnDemand		Write	-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId dbss:VpcId dbss:SubnetId	-
dbss::listCommonInfo	Grants permission to query public information.	List	-	-	dbss:auditInstance:list
dbss:auditInstance:listInstancesSummaryInfo	Grants permission to query the overview of all audit instances.	List	auditInstance *	-	dbss:auditInstance:list
dbss::getauditInstancesSummaryTaskStatus	Grants permission to query the status of overview tasks.	Read	-	-	dbss:auditInstance:list
dbss::updateAuditInstancesSummaryInfo	Grants permission to update the overview of all audit instances.	Write	-	-	dbss:auditInstance:start
dbss:auditInstance:setReporterConfig	Grants permission to modify the scheduled task configuration information of reports.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:getReporterConfig	Grants permission to obtain the scheduled task configuration information of reports.	Read	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:addBareDatabase	Grants permission to add a self-built database.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:listDatabases	Grants permission to query the database list.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:switchDatabase	Grants permission to enable or disable database audit.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:deleteDatabase	Grants permission to delete a database.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:addAuditScopeRule	Grants permission to add an audit scope rule.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:switchAuditScopeRule	Grants permission to enable or disable audit scope rules.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:addRiskRule	Grants permission to add a risk rule.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:switchRiskRule	Grants permission to enable or disable a risk rule.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:editRiskRule	Grants permission to edit risk rules.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:setRiskRulePriority	Grants permission to set risk rule priorities.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:listStatistics	Grants permission to query the overview of audit instances.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:listSensitiveRules	Grants permission to query privacy data masking rules.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:modifySensitiveRuleSaveResultSwitch	Grants permission to enable or disable the result set storage.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:modifySensitiveRuleAnonymizeSwitch	Grants permission to enable or disable the privacy data masking function.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:switchSensitiveRule	Grants permission to enable or disable privacy data protection rules.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:listAlarmItems	Grants permission to query alarm information.	List	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:markAlarm	Grants permission to mark alarms.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:deleteAlarm	Grants permission to delete alarms.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:restoreBackup	Grants permission to restore backups.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:retryBackup	Grants permissions to retry backups.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:getRiskBackupConfigInfo	Grants permission to obtain risk export configurations.	Read	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:switchRiskBackup	Grants permission to enable or disable risk export.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:getRiskBackupBucketInfo	Grants permission to obtain OBS bucket for risk export.	Read	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:list
dbss:auditInstance:setRiskBackupBucketInfo	Grants permission to set OBS bucket for risk export.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss:auditInstance:addRdsDatabase	Grants permission to add an RDS database.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:createOnOrder
dbss::getServerInfo	Grants permission to obtain DBSS information.	Read	-	-	dbss:auditInstance:list
dbss::getAuditInstanceJob	Grants permission to view the creation information about audit instance tasks.	Read	-	-	dbss:auditInstance:list
dbss:auditInstance:listJobs	Grants permission to list the creation information about audit instance tasks.	List	auditInstance *	-	dbss:auditInstance:list
dbss::listObsBuckets	Grants permission to query the OBS bucket list.	List	-	-	dbss:auditInstance:list
dbss:auditInstance:instanceDelete	Grants permission to delete audit instances.	Write	auditInstance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	dbss:auditInstance:delete
dbss::listResourcesByTag	Grants permission to query audit instances by tag.	List	-	g:RequestTag/<tag-key> g:TagKeys	dbss:auditInstance:list
dbss::tagResource	Grants permission to add instance tags in batches.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	dbss:auditInstance:createOnOrder
dbss::unTagResource	Grants permission to delete instance tags in batches.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	dbss:auditInstance:delete
dbss::listTags	Grants permission to query all tags of a project.	List	-	-	dbss:auditInstance:list
dbss::listTagsForResource	Grants permission to query instance tags.	List	-	-	dbss:auditInstance:list

Each API of DBSS usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by DBSS APIs
API	Action	Dependency
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql-rules	dbss:auditInstance:listSqlInjectRules	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql/list-rules	dbss:auditInstance:listSqlInjectRules	-
POST /dbss/v1/{project_id}/{instance_id}/dbss/audit/rule/sql-injections	dbss:auditInstance:listSqlInjectRules	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sqls	dbss:auditInstance:listSqls	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sqls/list-sqls	dbss:auditInstance:listSqls	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql-rule/switch	dbss:auditInstance:switchSqlInjectRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql/switch	dbss:auditInstance:switchSqlInjectRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql-rule	dbss:auditInstance:addSqlInjectRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql	dbss:auditInstance:addSqlInjectRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql-rules/rank	dbss:auditInstance:orderSqlInjectRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql/rank-sql	dbss:auditInstance:orderSqlInjectRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/reports	dbss:auditInstance:createReporter	-
POST /dbss/v1/{project_id}/{instance_id}/audit/reports/results/create-report	dbss:auditInstance:createReporter	-
POST /dbss/v1/{project_id}/{instance_id}/audit/reports/list	dbss:auditInstance:listReporters	-
POST /dbss/v1/{project_id}/{instance_id}/audit/reports/list-reports	dbss:auditInstance:listReporters	-
GET /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/{risk_id}	dbss:auditInstance:getRiskRuleDetail	-
GET /dbss/v1/{project_id}/{instance_id}/dbss/audit/rule/risk/{risk_id}	dbss:auditInstance:getRiskRuleDetail	-
GET /dbss/v1/{project_id}/{instance_id}/audit/operation/emails	dbss:auditInstance:listAlarmEmails	-
GET /dbss/v1/{project_id}/{instance_id}/audit/operation/list-emails	dbss:auditInstance:listAlarmEmails	-
GET /dbss/v1/{project_id}/{instance_id}/audit/reports/{report_id}	dbss:auditInstance:downloadReporter	-
GET /dbss/v1/{project_id}/{instance_id}/audit/reports/results/{report_id}/download-report	dbss:auditInstance:downloadReporter	-
GET /dbss/v1/{project_id}/{instance_id}/audit/rule/scopes	dbss:auditInstance:listAuditScopeRules	-
GET /dbss/v1/{project_id}/{instance_id}/audit/rule/scope/list-scope	dbss:auditInstance:listAuditScopeRules	-
GET /dbss/v1/{project_id}/{instance_id}/dbss/audit/rule/scopes	dbss:auditInstance:listAuditScopeRules	-
GET /dbss/v1/{project_id}/{instance_id}/audit/sensitive/masks	dbss:auditInstance:listSensitiveRules	-
GET /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/list-rules	dbss:auditInstance:listSensitiveRules	-
GET /dbss/v1/{project_id}/{instance_id}/dbss/audit/sensitive/masks	dbss:auditInstance:listSensitiveRules	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/masks	dbss:auditInstance:addSensitiveRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/add-rule	dbss:auditInstance:addSensitiveRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/masks/{rule_id}	dbss:auditInstance:editSensitiveRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/{rule_id}/edit-rule	dbss:auditInstance:editSensitiveRule	-
GET /dbss/v1/{project_id}/{instance_id}/audit/reports/templates	dbss:auditInstance:listReporters	-
GET /dbss/v1/{project_id}/{instance_id}/audit/reports/list-templates	dbss:auditInstance:listReporters	-
GET /dbss/v1/{project_id}/{instance_id}/audit/rule/risk	dbss:auditInstance:listRiskRules	-
GET /dbss/v1/{project_id}/{instance_id}/dbss/audit/rule/risk	dbss:auditInstance:listRiskRules	-
DELETE /dbss/v1/{project_id}/{instance_id}/audit/reports/{report_id}	dbss:auditInstance:deleteReporter	-
DELETE /dbss/v1/{project_id}/{instance_id}/audit/reports/results/{report_id}/delete-report	dbss:auditInstance:deleteReporter	-
POST /dbss/v1/{project_id}/{instance_id}/audit/general/operate-log	dbss:auditInstance:listOperateLog	-
POST /dbss/v1/{project_id}/{instance_id}/dbss/audit/operate-log	dbss:auditInstance:listOperateLog	-
POST /dbss/v1/{project_id}/{instance_id}/audit/operation/monitorinfo	dbss:auditInstance:listMonitorInfos	-
POST /dbss/v1/{project_id}/{instance_id}/audit/operation/get-monitorinfo	dbss:auditInstance:listMonitorInfos	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sessionstatistics/clientsession	dbss:auditInstance:listSessionInfo	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sessionstatistics/list-clientsession	dbss:auditInstance:listSessionInfo	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sessionstatistics/accountsession	dbss:auditInstance:listSessionInfo	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sessionstatistics/list-accountsession	dbss:auditInstance:listSessionInfo	-
POST /dbss/v1/{project_id}/{instance_id}/audit/backup/stop	dbss:auditInstance:switchBackup	dbss:auditInstance:getBackupConfig
POST /dbss/v1/{project_id}/{instance_id}/audit/backup/stop-backup	dbss:auditInstance:switchBackup	dbss:auditInstance:getBackupConfig
POST /dbss/v1/{project_id}/{instance_id}/audit/backup/start	dbss:auditInstance:switchBackup	dbss:auditInstance:getBackupConfig
POST /dbss/v1/{project_id}/{instance_id}/audit/backup/start-backup	dbss:auditInstance:switchBackup	dbss:auditInstance:getBackupConfig
GET /dbss/v1/{project_id}/dbss/saleslicense/download	dbss::downloadLicense	-
GET /dbss/v1/{project_id}/dbss/download-saleslicense	dbss::downloadLicense	-
DELETE /dbss/v1/{project_id}/dbss/audit/job/{failed_id}	dbss::deleteAuditInstanceJob	-
DELETE /dbss/v1/{project_id}/dbss/audit/delete-job/{failed_id}	dbss::deleteAuditInstanceJob	-
GET /dbss/v2/{project_id}/audit/databases/rds	dbss::listRdsDb	-
POST /dbss/v1/{project_id}/dbss/audit/rds-instance	dbss::listRdsDb	-
POST /dbss/v1/{project_id}/dbss/audit/guassDbInstance	dbss::listRdsDb	-
POST /dbss/v1/{project_id}/dbss/audit/instance/start	dbss:auditInstance:instanceStart	-
POST /dbss/v1/{project_id}/dbss/audit/start-instance	dbss:auditInstance:instanceStart	-
POST /dbss/v1/{project_id}/dbss/audit/instance/reboot	dbss:auditInstance:reboot	-
POST /dbss/v1/{project_id}/dbss/audit/reboot-instance	dbss:auditInstance:reboot	-
POST /dbss/v1/{project_id}/dbss/audit/instance/stop	dbss:auditInstance:stop	-
POST /dbss/v1/{project_id}/dbss/audit/stop-instance	dbss:auditInstance:stop	-
POST /dbss/v1/{project_id}/dbss/{instance_id}/audit/upgrade	dbss:auditInstance:upgrade	-
GET /dbss/v1/{project_id}/dbss/audit/upgrade/status	dbss::queryUpgradeStatus	-
POST /dbss/v1/{project_id}/dbss/audit/securitygroup	dbss:auditInstance:updateSecurityGroup	-
POST /dbss/v1/{project_id}/dbss/audit/update-securitygroup	dbss:auditInstance:updateSecurityGroup	-
PUT /dbss/v1/{project_id}/dbss/audit/instances/{instance_id}	dbss:auditInstance:modifyAttribute	-
POST /dbss/v1/{project_id}/dbss/audit/update-instance/{instance_id}	dbss:auditInstance:modifyAttribute	-
GET /dbss/v1/{project_id}/{instance_id}/audit/operation/agent/{agent_id}/download	dbss:auditInstance:downloadAgent	-
GET /dbss/v1/{project_id}/{instance_id}/audit/operation/download-agent/{agent_id}	dbss:auditInstance:downloadAgent	-
GET /dbss/v2/{project_id}/{instance_id}/audit/agents/{agent_id}	dbss:auditInstance:downloadAgent	-
POST /dbss/v1/{project_id}/{instance_id}/audit/agent/switch	dbss:auditInstance:switchAgent	-
GET /dbss/v2/{project_id}/{instance_id}/audit/agents	dbss:auditInstance:listAgents	-
GET /dbss/v1/{project_id}/{instance_id}/audit/agents/{db_id}	dbss:auditInstance:listAgents	-
DELETE /dbss/v1/{project_id}/{instance_id}/audit/agents/{db_id}/{agent_id}	dbss:auditInstance:deleteAgent	-
DELETE /dbss/v2/{project_id}/{instance_id}/audit/agents/{agent_id}	dbss:auditInstance:deleteAgent	-
POST /dbss/v2/{project_id}/{instance_id}/audit/agents	dbss:auditInstance:addAgent	-
POST /dbss/v1/{project_id}/{instance_id}/audit/agents	dbss:auditInstance:addAgent	-
POST /dbss/v1/{project_id}/{instance_id}/audit/agent/add-agent	dbss:auditInstance:addAgent	-
POST /dbss/v1/{project_id}/{instance_id}/audit/agent/{agent_id}	dbss:auditInstance:addAgent	-
GET /dbss/v1/{project_id}/{instance_id}/audit/reports/{report_id}/preview	dbss:auditInstance:previewReporter	-
GET /dbss/v1/{project_id}/{instance_id}/audit/reports/{report_id}/preview-report	dbss:auditInstance:previewReporter	-
POST /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-config	dbss:auditInstance:setAlarmConfig	-
POST /dbss/v1/{project_id}/{instance_id}/audit/operation/config-email	dbss:auditInstance:configAlarmEmail	-
GET /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-config	dbss:auditInstance:getAlarmConfig	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/search-rules	dbss:auditInstance:listRiskRules	-
POST /dbss/v1/{project_id}/obs/upload-config	dbss:auditInstance:exportInstancesDatabaseConfig	-
POST /dbss/v1/charge/{project_id}/audit/period/order	dbss:auditInstance:createOnPeriod	dbss::listCommonInfo
GET /dbss/v1/{project_id}/{instance_id}/audit/agent/get-agent	dbss:auditInstance:listAgents	-
POST /dbss/v1/{project_id}/{instance_id}/audit/agent/del-agent	dbss:auditInstance:deleteAgent	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql/{sql_id}	dbss:auditInstance:editSqlInjectRule	-
DELETE /dbss/v1/{project_id}/{instance_id}/audit/rule/sql/{sql_id}	dbss:auditInstance:deleteSqlInjectRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/delete-rules	dbss:auditInstance:deleteSensitiveRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/list-rules	dbss:auditInstance:listRiskRules	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/scope/delete-scope	dbss:auditInstance:deleteAuditScopeRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/delete-risk	dbss:auditInstance:deleteRiskRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/backup/del-backup	dbss:auditInstance:deleteBackup	-
POST /dbss/v1/{project_id}/{instance_id}/audit/backup/status	dbss:auditInstance:listBackups	-
POST /dbss/v1/{project_id}/{instance_id}/audit/backup/auto-backup-template	dbss:auditInstance:getBackupConfig	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/scope/edit-rule/{scope-id}	dbss:auditInstance:editAuditScopeRule	-
GET /dbss/v1/{project_id}/dbss/audit/list-instances	dbss:auditInstance:instanceList	-
POST /dbss/v1/{project_id}/dbss/audit/create-instance	dbss:auditInstance:createOnDemand	dbss::listCommonInfo
POST /dbss/v2/{project_id}/dbss/audit/charge/period/order	dbss:auditInstance:createOnPeriod	dbss::listCommonInfo
GET /dbss/v2/{project_id}/dbss/audit/availability-zone	dbss::listCommonInfo	-
GET /dbss/v2/{project_id}/audit/summary/{busi_type}/taskstatus	dbss::getauditInstancesSummaryTaskStatus	-
GET /dbss/v1/{project_id}/audit/summary/info	dbss:auditInstance:listInstancesSummaryInfo	-
GET /dbss/v1/{project_id}/audit/summary/{busi_type}/taskstatus	dbss::getauditInstancesSummaryTaskStatus	-
GET /dbss/v1/{project_id}/audit/risk/statistics	dbss:auditInstance:listInstancesSummaryInfo	-
POST /dbss/v1/{project_id}/audit/summary/{busi_type}/taskstatus	dbss::updateAuditInstancesSummaryInfo	-
POST /dbss/v1/{project_id}/{instance_id}/audit/reports/templates-topic/scheduler/config-task	dbss:auditInstance:setReporterConfig	-
GET /dbss/v1/{project_id}/{instance_id}/audit/reports/templates-topic/scheduler/{template_id}	dbss:auditInstance:getReporterConfig	-
POST /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-config-topic	dbss:auditInstance:setAlarmConfig	-
GET /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-config-topic	dbss:auditInstance:getAlarmConfig	-
POST /dbss/v1/{project_id}/{instance_id}/audit/databases	dbss:auditInstance:addBareDatabase	-
POST /dbss/v1/{project_id}/{instance_id}/audit/operation/databases	dbss:auditInstance:addBareDatabase	-
POST /dbss/v1/{project_id}/{instance_id}/audit/operation/create-database	dbss:auditInstance:addBareDatabase	-
GET /dbss/v1/{project_id}/{instance_id}/dbss/audit/databases	dbss:auditInstance:listDatabases	-
GET /dbss/v1/{project_id}/{instance_id}/audit/operation/databases	dbss:auditInstance:listDatabases	-
GET /dbss/v1/{project_id}/{instance_id}/audit/operation/list-databases	dbss:auditInstance:listDatabases	-
POST /dbss/v1/{project_id}/{instance_id}/audit/operation/switch	dbss:auditInstance:switchDatabase	-
POST /dbss/v2/{project_id}/{instance_id}/audit/databases/switch	dbss:auditInstance:switchDatabase	-
DELETE /dbss/v2/{project_id}/{instance_id}/audit/databases/{db_id}	dbss:auditInstance:deleteDatabase	-
POST /dbss/v1/{project_id}/{instance_id}/audit/operation/database/delete	dbss:auditInstance:deleteDatabase	-
POST /dbss/v1/{project_id}/{instance_id}/audit/operation/delete-database	dbss:auditInstance:deleteDatabase	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/scopes	dbss:auditInstance:addAuditScopeRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/scope/add-rule	dbss:auditInstance:addAuditScopeRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/scope/switch	dbss:auditInstance:switchAuditScopeRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk	dbss:auditInstance:addRiskRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/add-rule	dbss:auditInstance:addRiskRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/switch	dbss:auditInstance:switchRiskRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/{risk_id}	dbss:auditInstance:editRiskRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/edit-risk/{risk_id}	dbss:auditInstance:editRiskRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/scopes/{scope_id}	dbss:auditInstance:editAuditScopeRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/operation/email/{email_id}	dbss:auditInstance:configAlarmEmail	-
POST /dbss/v1/{project_id}/{instance_id}/audit/operation/edit-email/{email_id}	dbss:auditInstance:configAlarmEmail	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/rank-risk	dbss:auditInstance:setRiskRulePriority	-
POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql-rule/{rule_id}	dbss:auditInstance:editSqlInjectRule	-
DELETE /dbss/v1/{project_id}/{instance_id}/audit/rule/sql-rule/{rule_id}	dbss:auditInstance:deleteSqlInjectRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/reports/templates/scheduler/config-task	dbss:auditInstance:setReporterConfig	-
POST /dbss/v1/{project_id}/{instance_id}/audit/general/risk-statistics	dbss:auditInstance:listStatistics	-
POST /dbss/v1/{project_id}/{instance_id}/audit/general/session-statistics	dbss:auditInstance:listStatistics	-
POST /dbss/v1/{project_id}/{instance_id}/audit/general/sql-statistics	dbss:auditInstance:listStatistics	-
GET /dbss/v1/{project_id}/{instance_id}/audit/reports/templates/scheduler/{template_id}	dbss:auditInstance:getReporterConfig	-
GET /dbss/v1/{project_id}/{instance_id}/audit/sqls/{sql_statement_id}	dbss:auditInstance:listSqls	-
GET /dbss/v1/{project_id}/{instance_id}/audit/sensitive/result/switch	dbss:auditInstance:listSensitiveRules	-
GET /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/switch	dbss:auditInstance:listSensitiveRules	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/result/switch	dbss:auditInstance:modifySensitiveRuleSaveResultSwitch	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/switch	dbss:auditInstance:modifySensitiveRuleAnonymizeSwitch	-
DELETE /dbss/v1/{project_id}/{instance_id}/audit/sensitive/masks/{rule_id}	dbss:auditInstance:deleteSensitiveRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/rule/switch	dbss:auditInstance:switchSensitiveRule	-
DELETE /dbss/v1/{project_id}/{instance_id}/audit/rule/scopes/{scope_id}	dbss:auditInstance:deleteAuditScopeRule	-
DELETE /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/{risk_id}	dbss:auditInstance:deleteRiskRule	-
POST /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-log	dbss:auditInstance:listAlarmItems	-
POST /dbss/v1/{project_id}/{instance_id}/audit/alarm-log	dbss:auditInstance:listAlarmItems	-
PUT /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-log/{alarm_id}	dbss:auditInstance:markAlarm	-
DELETE /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-log/{alarm_id}	dbss:auditInstance:deleteAlarm	-
POST /dbss/v1/{project_id}/{instance_id}/audit/general/mark-alarm-log	dbss:auditInstance:markAlarm	-
POST /dbss/v1/{project_id}/{instance_id}/audit/general/synopsis-statistics	dbss:auditInstance:listStatistics	-
POST /dbss/v1/{project_id}/{instance_id}/audit/backups	dbss:auditInstance:listBackups	-
POST /dbss/v1/{project_id}/{instance_id}/audit/backup/get-backup	dbss:auditInstance:listBackups	-
DELETE /dbss/v1/{project_id}/{instance_id}/audit/backups/{id}	dbss:auditInstance:deleteBackup	-
POST /dbss/v1/{project_id}/{instance_id}/audit/backup/restore	dbss:auditInstance:restoreBackup	-
POST /dbss/v1/{project_id}/{instance_id}/audit/backup/retry	dbss:auditInstance:retryBackup	-
GET /dbss/v1/{project_id}/{instance_id}/audit/backup/bucket-name	dbss:auditInstance:getBackupConfig	-
GET /dbss/v1/{project_id}/{instance_id}/audit/backup/status	dbss:auditInstance:listBackups	-
GET /dbss/v1/{project_id}/{instance_id}/audit/backup/auto-backup-template	dbss:auditInstance:getBackupConfig	-
GET /dbss/v1/{project_id}/{instance_id}/audit/backup/risk-templates	dbss:auditInstance:getRiskBackupConfigInfo	-
GET /dbss/v1/{project_id}/{instance_id}/audit/backup/risk-template/{db_id}	dbss:auditInstance:getRiskBackupConfigInfo	-
POST /dbss/v1/{project_id}/{instance_id}/audit/backup/risk/switch	dbss:auditInstance:switchRiskBackup	-
GET /dbss/v1/{project_id}/{instance_id}/audit/backup/risk-bucket-path	dbss:auditInstance:getRiskBackupBucketInfo	-
POST /dbss/v1/{project_id}/{instance_id}/audit/backup/risk-bucket-path	dbss:auditInstance:setRiskBackupBucketInfo	-
GET /dbss/v1/{project_id}/{instance_id}/audit/backup/bucket-path	dbss:auditInstance:getBackupConfig	-
POST /dbss/v1/{project_id}/{instance_id}/dbss/audit/databases/rds	dbss:auditInstance:addRdsDatabase	-
POST /dbss/v1/{project_id}/{instance_id}/audit/operation/rds	dbss:auditInstance:addRdsDatabase	-
POST /dbss/v1/{project_id}/{instance_id}/audit/operation/create-guassdb-rds	dbss:auditInstance:addRdsDatabase	-
POST /dbss/v2/{project_id}/{instance_id}/audit/databases/rds	dbss:auditInstance:addRdsDatabase	-
POST /dbss/v1/{domain_id}/{instance_id}/audit/backup/risk-bucket-path/global	dbss:auditInstance:setRiskBackupBucketInfo	-
POST /dbss/v1/{domain_id}/{instance_id}/audit/backup/global/switch	dbss:auditInstance:switchBackup	dbss:auditInstance:getBackupConfig
POST /dbss/v1/{domain_id}/{instance_id}/audit/backup/risk/global/switch	dbss:auditInstance:switchRiskBackup	-
GET /dbss/v1/{project_id}/dbss/server-info	dbss::getServerInfo	-
GET /dbss/v1/{project_id}/dbss/audit/jobs/{resource_id}	dbss::getAuditInstanceJob	-
GET /dbss/v1/{project_id}/dbss/audit/list-jobs/{resource_id}	dbss::getAuditInstanceJob	-
GET /dbss/v1/{project_id}/dbss/audit/list-jobs	dbss:auditInstance:listJobs	-
GET /dbss/v1/{project_id}/dbss/audit/specification	dbss::listCommonInfo	-
GET /dbss/v1/{project_id}/dbss/audit/instances	dbss:auditInstance:instanceList	-
GET /dbss/v1/{project_id}/dbss/audit/quota	dbss::listCommonInfo	-
GET /dbss/v1/{project_id}/dbss/availability-zone	dbss::listCommonInfo	-
GET /dbss/v1/{project_id}/dbss/get-availability-zone	dbss::listCommonInfo	-
GET /dbss/v1/{project_id}/obs/audit/backup/obs-buckets	dbss::listObsBuckets	-
POST /dbss/v1/{project_id}/dbss/audit/security-group	dbss:auditInstance:updateSecurityGroup	-
POST /dbss/v1/{project_id}/dbss/audit/instances	dbss:auditInstance:createOnDemand	dbss::listCommonInfo
DELETE /dbss/v1/{project_id}/dbss/audit/delete-instance	dbss:auditInstance:instanceDelete	-
POST /dbss/v1/{project_id}/{resource_type}/resource-instances/filter	dbss::listResourcesByTag	-
POST /dbss/v1/{project_id}/{resource_type}/resource-instances/count	dbss::listResourcesByTag	-
POST /dbss/v1/{project_id}/{resource_type}/{resource_id}/tags/create	dbss::tagResource	-
DELETE /dbss/v1/{project_id}/{resource_type}/{resource_id}/tags/delete	dbss::unTagResource	-
GET /dbss/v1/{project_id}/{resource_type}/tags	dbss::listTags	-
GET /dbss/v1/{project_id}/{resource_type}/{resource_id}/tags	dbss::listTagsForResource	-

Resource

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for DBSS.

**Table 3** Resource types supported by DBSS
Resource Type	URN
auditInstance	dbss:<region>:<account-id>:auditInstance:<instance-id>

Conditions

Condition Key

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

Condition keys are the key values in the Condition element of an identity policy statement. Condition keys are classified into global condition keys and service-specific condition keys based on the application scope.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, dbss:) apply only to operations of the specific service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, a condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see Condition operators.

Service-specific condition keys supported by DBSS

The following table lists the condition keys that you can define in identity policies for DBSS. You can include these condition keys to specify conditions for when your identity policy is in effect.

**Table 4** Service-specific condition keys supported by DBSS
Service-specific Condition Key	Type	Single-valued/Multivalued	Important Notes
dbss:VpcId	string	Single-valued	Filters access based on the network ID specified in the request parameter.
dbss:SubnetId	string	Single-valued	Filters access based on the subnet ID specified in the request parameter.