策略语法：细粒度策略
在实际业务中，您可能需要给不同角色的用户授予不同的资源操作权限。IAM服务为用户提供了细粒度访问控制功能。在IAM中，IAM管理员用户（即属于admin用户组的用户）通过创建自定义策略，可以自由搭配需要授予的权限集。通过给用户组授予策略，用户组中的用户就能获得策略中定义的权限。IAM通过策略定义的权限内容实现精细的权限管理。
为了更精细地控制GaussDB(DWS) 资源的使用权限，您可以使用IAM的用户管理功能，实现细粒度权限控制，授予不同角色的用户不同的资源操作权限。
策略结构
策略结构包括：Version（策略版本号）和Statement（策略权限语句），其中Statement可以有多个，表示不同的授权项。
策略语法
在IAM左侧导航窗格中，单击“策略”，单击策略名称，可以查看策略的详细内容，以“DWS ReadOnlyAccess”为例，说明细粒度策略的语法。
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dws:*:get*",
"dws:*:list*",
"ecs:*:get*",
"ecs:*:list*",
"vpc:*:get*",
"vpc:*:list*",
"evs:*:get*",
"evs:*:list*",
"mrs:*:get*",
"bss:*:list*",
"bss:*:get*"
]
}
]
}
- Version：标识策略的版本号，主要用于区分Role-Based Access Control（RBAC）策略和细粒度策略。
- 1.0：RBAC策略。RBAC策略是将服务作为一个整体进行授权，授权后，用户可以拥有这个服务的所有权限。
- 1.1：经典细粒度策略。相比RBAC策略，细粒度策略基于服务的API接口进行权限拆分，授权更加精细。授权后，用户可以对这个服务执行特定的操作。细粒度策略包括系统预置和用户自定义两种。
- Statement：策略授权语句，描述策略的详细信息，包含Effect（作用）和Action（授权项）。
授权项列表
在IAM中创建自定义策略时，您可以根据需求在策略授权语句的Action列表中添加GaussDB(DWS) 资源操作或REST API所对应的“授权项”，使得该策略具有相应的操作权限。GaussDB(DWS) 细粒度策略的授权项列表如下：
- REST API
GaussDB(DWS) REST API的授权项列表，请参见权限策略和授权项。
- 管理控制台操作
GaussDB(DWS) 资源操作及对应的授权项如表1所示。
GaussDB(DWS)部分授权项依赖的授权项包括了ECS、VPC、EVS、ELB、MRS或OBS等服务的授权项，如果这些服务没有对接相应的服务授权项，则需要添加对应服务的Admin系统权限。
GaussDB(DWS) 资源操作 |
授权项 |
依赖的授权项 |
授权项作用域 |
|---|---|---|---|
创建集群 |
"dws:cluster:create" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "vpc:securityGroupRules:delete", "vpc:ports:update", "evs:*:get*", "evs:*:list*", "evs:*:create*", |
|
获取集群列表 |
"dws:cluster:list" |
-- |
|
获取单个集群详情 |
"dws:cluster:getDetail" |
"dws:*:get*", "dws:*:list*", "vpc:vpcs:list", "vpc:securityGroups:get" |
|
设置自动快照 |
"dws:cluster:setAutomatedSnapshot" |
"dws:backupPolicy:list" |
|
设置安全参数/参数组 |
"dws:cluster:setSecuritySettings" |
"dws:*:get*", "dws:*:list*", |
|
重启集群 |
"dws:cluster:restart" |
"dws:*:get*", "dws:*:list*", |
|
扩容集群 |
"dws:cluster:scaleOut" |
"dws:*:get*", "dws:*:list*", "dws:cluster:scaleOutOrOpenAPIResize", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "vpc:*:update*", "evs:*:get*", "evs:*:list*", "evs:*:create*", |
|
使用API扩容集群或调整大小 |
"dws:cluster:scaleOutOrOpenAPIResize" |
"dws:*:get*", "dws:*:list*", "vpc:vpcs:list", "vpc:ports:create", "vpc:ports:get", "vpc:ports:update", "vpc:subnets:get", "vpc:subnets:update", "vpc:subnets:create", "vpc:routers:get", "vpc:routers:update", "vpc:networks:create", "vpc:networks:get", "vpc:networks:update", "ecs:serverInterfaces:use", "ecs:serverInterfaces:get", "ecs:cloudServerFlavors:get" |
|
重置密码 |
"dws:cluster:resetPassword" |
"dws:*:get*", "dws:*:list*", |
|
删除集群 |
"dws:cluster:delete" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:delete*", "vpc:*:get*", "vpc:*:list*", "vpc:*:delete*", "evs:*:get*", "evs:*:list*", "evs:*:delete*", |
|
设置可维护时间段 |
"dws:cluster:setMaintainceWindow" |
"dws:*:get*", "dws:*:list*", |
|
绑定EIP |
"dws:eip:operate" |
"dws:*:get*", "dws:*:list*", "eip:*:get*", "eip:*:list*" |
|
解绑EIP |
"dws:eip:operate" |
"dws:*:get*", "dws:*:list*", "eip:*:get*", "eip:*:list*" |
|
创建DNS域名 |
"dws:dns:create" |
"dws:*:get*", "dws:*:list*", |
|
释放DNS域名 |
"dws:dns:release" |
"dws:*:get*", "dws:*:list*", |
|
修改DNS域名 |
"dws:dns:edit" |
"dws:*:get*", "dws:*:list*", |
|
创建MRS连接 |
"dws:MRSConnection:create" |
"dws:*:get*", "dws:*:list*", "mrs:*:get*", "mrs:*:list*", "mrs:cluster:create", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "evs:*:get*", "evs:*:list*", "evs:*:create*" |
|
更新MRS连接 |
"dws:MRSConnection:update" |
"dws:*:get*", "dws:*:list*", "mrs:*:get*", "mrs:*:list*", "mrs:cluster:create", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "evs:*:get*", "evs:*:list*", "evs:*:create*" |
|
删除MRS连接 |
"dws:MRSConnection:delete" |
"dws:*:get*", "dws:*:list*", "mrs:*:get*", "mrs:*:list*", "mrs:cluster:create" "ecs:*:get*", "ecs:*:list*", "ecs:*:delete*", "vpc:*:get*", "vpc:*:list*", "vpc:*:delete*", "evs:*:get*", "evs:*:list*", "evs:*:delete*", |
|
MRS数据源列表 |
"dws:MRSSource:list" |
"mrs:cluster:list", "mrs:tag:listResource", "mrs:tag:list", "dws:*:get*", "dws:*:list*" |
|
添加/删除标签 |
"dws:tag:addAndDelete" |
"dws:*:get*", "dws:*:list*", "dws:openAPITag:update", "dws:openAPITag:getResourceTag", |
|
编辑标签 |
"dws:tag:edit" |
"dws:*:get*", "dws:*:list*", "dws:openAPITag:update", "dws:openAPITag:getResourceTag", |
|
创建快照 |
"dws:snapshot:create" |
"dws:*:get*", "dws:*:list*", |
|
获取快照列表 |
"dws:snapshot:list" |
-- |
|
查看单个集群快照列表 |
"dws:clusterSnapshot:list" |
"dws:cluster:list", "dws:openAPICluster:getDetail" |
|
删除快照 |
"dws:snapshot:delete" |
"dws:snapshot:list" |
|
复制快照 |
"dws:snapshot:copy" |
"dws:snapshot:list", "dws:snapshot:create" |
|
恢复到新集群 |
"dws:cluster:restore" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "evs:*:get*", "evs:*:list*", "evs:*:create*" |
|
集群调整大小 |
"dws:cluster:resize" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "ecs:*:delete*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "vpc:*:delete*", "evs:*:get*", "evs:*:list*", "evs:*:create*", "evs:*:delete*" |
|
主备恢复 |
"dws:cluster:switchover" |
"dws:*:get*", "dws:*:list*" |
|
查询弹性负载均衡列表 |
"dws:elb:list" |
"dws:*:get*", "dws:*:list*", "elb:*:get*", "elb:*:list*", |
|
绑定弹性负载均衡 |
"dws:elb:bind" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "vpc:*:get*", "vpc:*:list*", "evs:*:get*", "evs:*:list*", "elb:*:get*", "elb:*:list*", "elb:*:delete*", "elb:*:create*", |
|
解绑弹性负载均衡 |
"dws:elb:unbind" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "vpc:*:get*", "vpc:*:list*", "evs:*:get*", "evs:*:list*", "elb:*:get*", "elb:*:list*", "elb:*:delete*", |
|
查询快照配置参数 |
"dws:snapshotConfig:list" |
"dws:*:get*", "dws:*:list*", |
|
更新快照策略 |
"dws:backupPolicyDetail:update" |
"dws:*:get*", "dws:*:list*", |
|
删除快照策略 |
"dws:backupPolicy:delete" |
"dws:*:get*", "dws:*:list*", |
|
查询快照策略 |
"dws:backupPolicy:list" |
"dws:cluster:list" |
|
查询集群加密信息 |
"dws:clusterEncryptInfo:list" |
"dws:*:get*", "dws:*:list*", "KMS Administrator" |
|
创建代理 |
"dws:createAgency:create" |
"dws:*:get*", "dws:*:list*", "security administrator" |
|
查询obs桶信息 |
"dws:queryBuckets:list" |
"dws:*:get*", "dws:*:list*", |
|
扩容节点 |
"dws:expandWithExistedNodes:update" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "vpc:*:update*", "evs:*:get*", "evs:*:list*", "evs:*:create*"， |
|
删除容灾备份 |
"dws:disasterRecovery:delete" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:delete*", "vpc:*:get*", "vpc:*:list*", "vpc:*:delete*", "evs:*:get*", "evs:*:list*", "evs:*:delete*" |
|
创建容灾备份 |
"dws:disasterRecovery:create" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "evs:*:get*", "evs:*:list*", "evs:*:create*"， |
|
容灾备份其他操作 |
"dws:disasterRecovery:otherOperate" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "evs:*:get*", "evs:*:list*", "evs:*:create*" |
|
容灾备份查询操作 |
"dws:disasterRecovery:get" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "vpc:*:get*", "vpc:*:list*", "evs:*:get*", "evs:*:list*" |
|
增加CN节点 |
"dws:module:install" |
"dws:*:get*", "dws:*:list*", |
|
删除CN节点 |
"dws:module:uninstall" |
"dws:*:get*", "dws:*:list*", |
|
删除节点 |
"dws:clusterNodes:operate" |
"dws:*:get*", "dws:*:list*" |
|
更新节点别名 |
dws:instanceAliasName:update |
dws:cluster:list |
|
实施重分布 |
"dws:redistribution:operate" |
"dws:*:get*", "dws:*:list*", |
|
查询重分布 |
"dws:redistributionInfo:list" |
"dws:*:get*", "dws:*:list*", |
|
停止重分布 |
"dws:redistribution:suspend" |
"dws:*:get*", "dws:*:list*", |
|
恢复重分布 |
"dws:redistribution:recover" |
"dws:*:get*", "dws:*:list*", |
|
磁盘扩容 |
"dws:disk:expand" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "evs:*:get*", "evs:*:list*", "evs:*:create*"， |
|
集群缩容 |
"dws:cluster:shrink" |
"dws:*:get*", "dws:*:list*", "dws:createAgency:create", "ecs:*:get*", "ecs:*:list*", "ecs:*:delete*", "vpc:*:get*", "vpc:*:list*", "vpc:*:delete*", "evs:*:get*", "evs:*:list*", "evs:*:delete*" |
|
查询规格产品信息 |
"dws:specProduct:list" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*" |
|
按需转包周期 |
"dws:ondemandToPeriod:operate" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "vpc:securityGroupRules:delete", "evs:*:get*", "evs:*:list*", "evs:*:create*"， "bss:coupon:view", "bss:order:pay", "bss:order:view", "bss:contract:update", "bss:balance:view", "bss:renewal:view", "bss:unsubscribe:update", "bss:renewal:update", "bss:order:update" |
|
修改包周期集群 |
"dws:periodCluster:modify" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:delete*", "vpc:*:get*", "vpc:*:list*", "vpc:*:delete*", "evs:*:get*", "evs:*:list*", "evs:*:delete*", "bss:coupon:view", "bss:order:pay", "bss:order:view", "bss:contract:update", "bss:balance:view", "bss:renewal:view", "bss:unsubscribe:update", "bss:renewal:update", "bss:order:update" |
|
创建包周期集群 |
"dws:periodCluster:create" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "evs:*:get*", "evs:*:list*", "evs:*:create*"， "bss:coupon:view", "bss:order:pay", "bss:order:view", "bss:contract:update", "bss:balance:view", "bss:renewal:view", "bss:unsubscribe:update", "bss:renewal:update", "bss:order:update" |
|
包周期集群磁盘扩容前检查 |
"dws:periodExpandPrecheck:operate" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*", "vpc:*:get*", "vpc:*:list*", "vpc:*:create*", "evs:*:get*", "evs:*:list*", "evs:*:create*"， |
|
查询是否支持DAS |
"dws:supportDas:list" |
"dws:*:get*", "dws:*:list*", "das:*:get*", "das:*:list*", |
|
绑定管理面IP |
"dws:bindManageIp:operate" |
"dws:*:get*", "dws:*:list*" |
|
获取用户授权 |
"dws:checkAuthorize:operate" |
"dws:*:get*", "dws:*:list*", "dws:checkSupport:operate" |
|
用户授权 |
"dws:authorize:operate" |
"dws:*:get*", "dws:*:list*", "dws:checkSupport:operate" |
|
获取用户数据库 |
"dws:userDatabase:list" |
"dws:*:get*", "dws:*:list*", "dws:checkSupport:operate" |
|
获取用户结构 |
"dws:schemas:list" |
"dws:*:get*", "dws:*:list*", "dws:checkSupport:operate" |
|
获取用户表 |
"dws:tables:list" |
"dws:*:get*", "dws:*:list*", |
|
表恢复 |
"dws:tableRestore:operate" |
"dws:*:get*", "dws:*:list*", |
|
用户恢复表名检测 |
"dws:tableRestoreCheck:operate" |
"dws:*:get*", "dws:*:list*", |
|
检测集群是否支持细粒度备份 |
"dws:checkSupport:operate" |
"dws:*:get*", "dws:*:list*", |
|
查询支持变更的规格列表 |
"dws:supportFlavors:list" |
"dws:*:get*", "dws:*:list*", |
|
执行弹性变更规格 |
"dws:specResize:operate" |
"dws:*:get*", "dws:*:list*", "ecs:*:get*", "ecs:*:list*", "ecs:*:create*" |
|
停止快照 |
"dws:snapshot:stop" |
"dws:snapshot:list" |
|
终止会话 |
"dws:dmsSession:terminate" |
"dws:dmsGrpcOuter:operation" |
|
负荷诊断报告操作 |
"dws:dmsWorkloadDiagnosisReport:create" |
"dws:dmsGrpcOuter:operation" |
|
修改告警规则 |
"dws:dmsAlarmRule:update" |
"dws:dmsQuery:list" |
|
启用告警规则 |
"dws:dmsAlarmRule:enable" |
"dws:dmsQuery:list" |
|
启用集群告警 |
"dws:dmsClusterAlarm:enable" |
"dws:dmsQuery:list" |
|
禁用集群告警 |
"dws:dmsClusterAlarm:disable" |
"dws:dmsQuery:list" |
|
GRPC对外服务 |
"dws:dmsGrpcOuter:operation" |
"dws:dmsQuery:list", "dws:cluster:setSecuritySettings", "obs:bucket:ListAllMyBuckets" |
|
新增SQL探针 |
"dws:dmsProbe:add" |
"dws:dmsGrpcOuter:operation" |
|
修改SQL探针 |
"dws:dmsProbe:update" |
"dws:dmsGrpcOuter:operation" |
|
删除SQL探针 |
"dws:dmsProbe:delete" |
"dws:dmsGrpcOuter:operation" |
|
启用/禁用SQL探针 |
"dws:dmsProbe:enable" |
"dws:dmsGrpcOuter:operation" |
|
创建用户面板 |
"dws:dmsUserBoard:create" |
"dws:dmsQuery:list" |
|
修改用户面板 |
"dws:dmsUserBoard:update" |
"dws:dmsQuery:list" |
|
删除用户面板 |
"dws:dmsUserBoard:delete" |
"dws:dmsQuery:list" |
|
终止查询 |
"dws:dmsQuery:terminate" |
"dws:dmsGrpcOuter:operation" |
|
启停DMS监控服务 |
"dws:dmsService:enableOrDisable" |
"dws:dmsQuery:list" |
|
修改DMS存储配置 |
"dws:dmsStorageConfig:modify" |
"dws:dmsQuery:list" |
|
DDL审核创建获取 |
"dws:dmsDdlExamine:getOrCreate" |
"dws:dmsGrpcOuter:operation" |
|
负荷快照操作 |
"dws:dmsWorkloadDiagnosisSnapshot:create" |
"dws:dmsGrpcOuter:operation" |
|
创建告警规则 |
"dws:dmsAlarmRule:add" |
"dws:dmsQuery:list" |
|
删除告警规则 |
"dws:dmsAlarmRule:delete" |
"dws:dmsQuery:list" |
|
执行SQL探针 |
"dws:dmsProbe:execute" |
"dws:dmsGrpcOuter:operation" |
|
删除监控项 |
"dws:dmsPerformanceMonitor:delete" |
"dws:dmsQuery:list" |
|
启停DMS监控采集项 |
"dws:dmsCollectItem:enableOrDisable" |
"dws:dmsGrpcOuter:operation" |
|
修改DMS监控采集配置 |
"dws:dmsCollectConfig:modify" |
"dws:dmsGrpcOuter:operation" |
|
条件查询 |
"dws:dmsQuery:list" |
"dws:cluster:list" |
|
OPENAPI条件查询 |
"dws:dmsOpenapiQuery:list" |
"dws:cluster:list" |
|
禁用告警规则 |
"dws:dmsAlarmRule:disable" |
"dws:dmsQuery:list" |
|
删除告警记录 |
"dws:dmsAlarmRecord:delete" |
"dws:dmsQuery:list" |
|
检查SQL探针 |
"dws:dmsProbe:check" |
"dws:dmsGrpcOuter:operation" |
|
新增监控项 |
"dws:dmsPerformanceMonitor:add" |
"dws:dmsQuery:list" |
|
修改监控项 |
"dws:dmsPerformanceMonitor:update" |
"dws:dmsQuery:list" |
|
下载历史监控趋势 |
"dws:dmsTrendHistory:down" |
"dws:dmsQuery:list" |
|
获取集群ring环信息 |
"dws:ring:list" |
"dws:*:get*", "dws:*:list*" |
|
获取群进程拓扑 |
"dws:processTopo:list" |
"dws:*:get*", "dws:*:list*" |
|
查询智能运维信息 |
"dws:operationalTask:get" |
"dws:*:get*", "dws:*:list*" |
|
智能运维执行操作 |
"dws:operationalTask:operate" |
"dws:*:get*", "dws:*:list*" |
|
逻辑集群增删改操作 |
"dws:logicalCluster:operate" |
"dws:*:get*", "dws:*:list*" |
|
逻辑集群查询操作 |
"dws:logicalCluster:get" |
"dws:*:get*", "dws:*:list*" |
|
逻辑集群弹性计划操作 |
"dws:logicalClusterPlan:operate" |
"dws:*:get*", "dws:*:list*", "dws:logicalCluster:*", "dws:cluster:scaleOut", "iam:agencies:*", "iam:permissions:*Agency*" |
|
创建终端节点服务 |
"dws:vpcEndpointService:create" |
"dws:*:get*", "dws:*:list*" |
|
查询资源管理信息 |
"dws:workLoadManager:get" |
"dws:*:get*", "dws:*:list*" |
|
资源管理相关操作 |
"dws:workLoadManager:operate" |
"dws:*:get*", "dws:*:list*" |
|
云日志服务相关操作 |
"dws:ltsAccess:operate" |
"dws:*:get*", "dws:*:list*" |
|
查询云日志服务信息 |
"dws:ltsAccess:get" |
"dws:*:get*", "dws:*:list*" |
|
查询事件信息 |
"dws:event:list" |
"dws:*:get*", "dws:*:list*" |
|
查询事件规格信息 |
"dws:event:list" |
"dws:*:get*", "dws:*:list*" |
|
查询事件订阅信息 |
"dws:eventSub:list" |
"dws:*:get*", "dws:*:list*" |
|
创建事件订阅信息 |
"dws:eventSub:create" |
"dws:*:get*", "dws:*:list*", |
|
更新事件订阅信息 |
"dws:eventSub:update" |
"dws:*:get*", "dws:*:list*" |
|
删除事件订阅信息 |
"dws:eventSub:delete" |
"dws:*:get*", "dws:*:list*" |
|
查询告警统计信息 |
"dws:alarmStatistic:list" |
"dws:*:get*", "dws:*:list*" |
|
查询告警详情信息 |
"dws:alarmDetail:list" |
"dws:*:get*", "dws:*:list*" |
|
查询告警配置信息 |
"dws:alarmConfig:list" |
"dws:*:get*", "dws:*:list*" |
|
查询告警订阅信息 |
"dws:alarmSub:list" |
"dws:*:get*", "dws:*:list*" |
|
创建告警订阅信息 |
"dws:alarmSub:create" |
"dws:*:get*", "dws:*:list*", |
|
更新告警订阅信息 |
"dws:alarmSub:update" |
"dws:*:get*", "dws:*:list*" |
|
删除告警订阅信息 |
"dws:alarmSub:delete" |
"dws:*:get*", "dws:*:list*" |
|
下发集群升级相关操作（升级、回滚、提交、重试） |
"dws:cluster:doUpdate" |
"dws:*:get*", "dws:*:list*" |
|
查询集群可用的升级路径信息 |
"dws:cluster:getUpgradePaths" |
"dws:*:get*", "dws:*:list*" |
|
查询集群升级记录 |
"dws:cluster:getUpgradeRecords" |
"dws:*:get*", "dws:*:list*" |
|
细粒度策略授权
- 登录IAM服务管理控制台，创建自定义策略。
具体操作，请参见《统一身份认证服务用户指南》中的创建自定义策略。
说明如下：
- 您必须使用IAM管理员用户，即属于admin用户组的用户，因为只有IAM管理员用户具备创建用户组及用户、修改用户组权限等操作权限。
- 由于GaussDB(DWS) 服务属于项目级服务，“作用范围”必须选择“项目级服务”，如果需要该策略对多个项目生效，需要对多个项目分别授权。
- 在IAM中，预置了以下两种GaussDB(DWS) 策略模板。在创建自定义策略时，您可以选择以下模板，然后基于模板修改策略授权语句。
- DWS Admin：拥有对数据仓库服务的所有执行权限。
- DWS Viewer：拥有对数据仓库服务的只读权限。
- 在策略授权语句中，您可以在Action列表中，添加如授权项列表所述的GaussDB(DWS) 资源操作或REST API对应的“授权项”，从而使策略获得相应的操作权限。
例如，在策略语句的Action列表中，添加"dws:cluster:create"，那么该策略就拥有了创建/恢复集群的权限。
- 如果需要使用其他服务，您同时还需授予其他服务的相关操作权限，具体内容请查阅相关服务的帮助文档。
例如，创建GaussDB(DWS) 集群时，需要配置集群所属的虚拟私有云，为了能获取VPC列表，您需在策略语句中添加授权项"vpc:*:get*"。
- 创建用户组。
具体操作，请参见《统一身份认证服务用户指南》中的创建用户组。
- 将用户加入用户组，并将新创建的自定义策略授权给用户组，使用户组中的用户具有策略定义的权限。
具体操作，请参见《统一身份认证服务用户指南》中的查看或修改用户组。
检查规则
当用户被授予多个策略，或者一个策略中包含多个授权语句，这些策略中既有Allow又有Deny的授权语句时，遵循Deny优先的原则。在用户访问资源时，权限检查逻辑如下。
每条策略做评估时， Action之间是或(or)的关系。
- 用户访问系统，发起操作请求。
- 系统评估用户被授予的访问策略，鉴权开始。
- 在用户被授予的访问策略中，系统将优先寻找显式拒绝指令。如找到一个适用的显式拒绝，系统将返回Deny决定。
- 如果没有找到显式拒绝指令，系统将寻找适用于请求的任何Allow指令。如果找到一个显式允许指令，系统将返回Allow决定。
- 如果找不到显式允许，最终决定为Deny，鉴权结束。
