文档首页/ 系统权限/ 系统权限/ 身份策略授权参考/ 安全与合规/ 数据库安全服务 DBSS
更新时间：2025-09-26 GMT+08:00
查看PDF
分享

数据库安全服务 DBSS

云服务在IAM预置了常用的权限，称为系统身份策略。如果IAM系统身份策略无法满足授权要求，管理员可以根据各服务支持的授权项，创建IAM自定义身份策略来进行精细的访问控制，IAM自定义身份策略是对系统身份策略的扩展和补充。

除IAM服务外，Organizations服务中的服务控制策略（Service Control Policy，以下简称SCP）也可以使用这些授权项元素设置访问控制策略。

SCP不直接进行授权，只划定权限边界。将SCP绑定到组织单元或者成员账号时，并没有直接对组织单元或成员账号授予操作权限，而是规定了成员账号或组织单元包含的成员账号的授权范围。IAM身份策略授予权限的有效性受SCP限制，只有在SCP允许范围内的权限才能生效。

IAM服务与Organizations服务在使用这些元素进行访问控制时，存在着一些区别，详情请参见：IAM服务与Organizations服务权限访问控制的区别。

本章节介绍IAM服务身份策略授权场景中自定义身份策略和组织服务中SCP使用的元素，这些元素包含了操作（Action）、资源（Resource）和条件（Condition）。

操作（Action）

操作（Action）即为身份策略中支持的授权项。

  • “访问级别”列描述如何对操作进行分类（List、Read和Write等）。此分类可帮助您了解在身份策略中相应操作对应的访问级别。
  • “资源类型”列指每个操作是否支持资源级权限。
    • 资源类型支持通配符号*表示所有。如果此列没有值（-），则必须在身份策略语句的Resource元素中指定所有资源类型（“*”）。
    • 如果该列包含资源类型，则必须在具有该操作的语句中指定该资源的URN。
    • 资源类型列中必需资源在表中用星号（*）标识，表示使用此操作必须指定该资源类型。

    关于DBSS定义的资源类型的详细信息请参见资源类型（Resource）。

  • “条件键”列包括了可以在身份策略语句的Condition元素中支持指定的键值。
    • 如果该授权项资源类型列存在值，则表示条件键仅对列举的资源类型生效。
    • 如果该授权项资源类型列没有值（-），则表示条件键对整个授权项生效。
    • 如果此列条件键没有值（-），表示此操作不支持指定条件键。

    关于DBSS定义的条件键的详细信息请参见条件（Condition）。

  • “别名”列包括了可以在身份策略中配置的策略授权项。通过这些授权项，可以控制支持策略授权的API访问。详细信息请参见身份策略兼容性说明。

您可以在身份策略语句的Action元素中指定以下DBSS的相关操作。

表1 DBSS支持的授权项

授权项

描述

访问级别

资源类型（*为必须）

条件键

别名

dbss:auditInstance:listSqlInjectRules

授予权限以查询SQL注入规则。

List

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:listSqls

授予权限以获取审计结果信息。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:switchSqlInjectRule

授予权限以开启或关闭sql注入策略。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:addSqlInjectRule

授予权限以添加自定义sql注入规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:orderSqlInjectRule

授予权限以对sql规则优先级进行排序。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:createReporter

授予权限以立即生成报表。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:listReporters

授予权限以查询报表信息。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:getRiskRuleDetail

授予权限以查询指定风险规则策略。

Read

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:listAlarmEmails

授予权限以查询告警邮件信息。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:downloadReporter

授予权限以下载报表。

Read

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:listAuditScopeRules

授予权限以查询审计范围策略列表。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:addSensitiveRule

授予权限以添加隐私数据保护规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:editSensitiveRule

授予权限以编辑隐私数据保护规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:deleteReporter

授予权限以删除报表。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:listOperateLog

授予权限以查询用户操作日志信息。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:listMonitorInfos

授予权限以查询审计实例监控信息。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:listSessionInfo

授予权限以查询审计实例会话信息。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:switchBackup

授予权限以开启或关闭备份功能。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss::downloadLicense

授予权限以下载销售许可证。

Read

-

-

dbss:auditInstance:list

dbss::deleteAuditInstanceJob

授予权限以删除审计实例创建失败的任务。

Write

-

-

dbss:auditInstance:delete

dbss::listRdsDb

授予权限以查询RDS数据库。

List

-

-

dbss:auditInstance:list

dbss:auditInstance:instanceStart

授予权限以开启审计实例。

Write

auditInstance *

dbss:auditInstance:start

dbss:auditInstance:reboot

授予权限以重启审计实例。

Write

auditInstance *

-

dbss:auditInstance:stop

授予权限以关闭审计实例。

Write

auditInstance *

-

dbss:auditInstance:upgrade

授予权限以升级审计实例。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss::queryUpgradeStatus

授予权限以查询审计实例升级状态。

List

-

-

dbss:auditInstance:createOnOrder

dbss:auditInstance:updateSecurityGroup

授予权限以修改审计实例安全组。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:modifyAttribute

授予权限以修改审计实例审计属性。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:downloadAgent

授予权限以下载agent。

Read

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:switchAgent

授予权限以开启或关闭Agent。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:listAgents

授予权限以获取agent列表。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:deleteAgent

授予权限以删除agent。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:addAgent

授予权限以添加agent。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:previewReporter

授予权限以预览报表。

Read

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:setAlarmConfig

授予权限以配置告警信息。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:configAlarmEmail

授予权限以配置告警邮件信息。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:getAlarmConfig

授予权限以查询告警配置信息。

Read

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:listRiskRules

授予权限以查询风险规则策略。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:exportInstancesDatabaseConfig

授予权限以导出数据库配置。

List

auditInstance *

-

dbss:auditInstance:createOnOrder

dbss:auditInstance:createOnPeriod

授予权限以包年包月计费模式创建审计实例。

Write

auditInstance *

-

dbss:auditInstance:createOnOrder

-

dbss:auditInstance:editSqlInjectRule

授予权限以编辑自定义sql注入规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:deleteSqlInjectRule

授予权限以删除自定义sql注入规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:deleteSensitiveRule

授予权限以删除隐私数据保护规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:deleteAuditScopeRule

授予权限以删除审计范围规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:deleteRiskRule

授予权限以删除风险规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:deleteBackup

授予权限以删除本地备份信息。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:listBackups

授予权限以查询备份信息。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:getBackupConfig

授予权限以获取备份配置信息。

Read

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:editAuditScopeRule

授予权限以编辑审计范围规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:instanceList

授予权限以查询审计实例信息。

List

auditInstance *

-

dbss:auditInstance:list

dbss:auditInstance:createOnDemand

授予权限以按需模式创建审计实例。

Write

auditInstance *

-

-

-

dbss::listCommonInfo

授予权限以查询公共信息。

List

-

-

dbss:auditInstance:list

dbss:auditInstance:listInstancesSummaryInfo

授予权限以查询所有审计实例总览信息。

List

auditInstance *

-

dbss:auditInstance:list

dbss::getauditInstancesSummaryTaskStatus

授予权限以查询总览任务状态。

Read

-

-

dbss:auditInstance:list

dbss::updateAuditInstancesSummaryInfo

授予权限以更新所有审计实例总览信息。

Write

-

-

dbss:auditInstance:start

dbss:auditInstance:setReporterConfig

授予权限以更改报表的计划任务配置信息。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:getReporterConfig

授予权限以获取报表的计划任务配置信息。

Read

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:addBareDatabase

授予权限以添加自建数据库。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:listDatabases

授予权限以查询数据库列表。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:switchDatabase

授予权限以开启关闭数据库审计功能。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:deleteDatabase

授予权限以删除数据库。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:addAuditScopeRule

授予权限以添加审计范围规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:switchAuditScopeRule

授予权限以开启关闭审计范围规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:addRiskRule

授予权限以添加风险规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:switchRiskRule

授予权限以开启或关闭风险规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:editRiskRule

授予权限以编辑风险规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:setRiskRulePriority

授予权限以设置风险规则优先级。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:listStatistics

授予权限以查询审计实例概览信息。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:listSensitiveRules

授予权限以查询隐私数据脱敏规则。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:modifySensitiveRuleSaveResultSwitch

授予权限以开启关闭存储结果集开关。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:modifySensitiveRuleAnonymizeSwitch

授予权限以开启关闭隐私数据脱敏开关。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:switchSensitiveRule

授予权限以开启或关闭隐私数据保护规则。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:listAlarmItems

授予权限以查询告警信息。

List

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:markAlarm

授予权限以标记告警信息。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:deleteAlarm

授予权限以删除告警信息。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:restoreBackup

授予权限以恢复备份信息。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:retryBackup

授予权限以重试备份操作。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:getRiskBackupConfigInfo

授予权限以获取风险导出配置信息。

Read

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:switchRiskBackup

授予权限以开启关闭风险导出功能。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:getRiskBackupBucketInfo

授予权限以获取风险导出obs桶信息。

Read

auditInstance *

dbss:auditInstance:list

dbss:auditInstance:setRiskBackupBucketInfo

授予权限以设置风险导出obs桶信息。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss:auditInstance:addRdsDatabase

授予权限以添加RDS数据库。

Write

auditInstance *

dbss:auditInstance:createOnOrder

dbss::getServerInfo

授予权限以获取DBSS服务信息。

Read

-

-

dbss:auditInstance:list

dbss::getAuditInstanceJob

授予权限以查看审计实例任务创建信息。

Read

-

-

dbss:auditInstance:list

dbss:auditInstance:listJobs

授予权限以列举审计实例任务创建信息。

List

auditInstance *

-

dbss:auditInstance:list

dbss::listObsBuckets

授予权限以查询obs桶列表。

List

-

-

dbss:auditInstance:list

dbss:auditInstance:instanceDelete

授予权限以删除审计实例。

Write

auditInstance *

dbss:auditInstance:delete

dbss::listResourcesByTag

授予权限以根据标签信息查询审计实例。

List

-

dbss:auditInstance:list

dbss::tagResource

授予权限以批量添加实例标签。

Tagging

-

dbss:auditInstance:createOnOrder

dbss::unTagResource

授予权限以批量删除实例标签。

Tagging

-

dbss:auditInstance:delete

dbss::listTags

授予权限以查询项目下的所有标签。

List

-

-

dbss:auditInstance:list

dbss::listTagsForResource

授予权限以查询实例标签信息。

List

-

-

dbss:auditInstance:list

DBSS的API通常对应着一个或多个授权项。表2展示了API与授权项的关系，以及该API需要依赖的授权项。

表2 API与授权项的关系

API

对应的授权项

依赖的授权项

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql-rules

dbss:auditInstance:listSqlInjectRules

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql/list-rules

dbss:auditInstance:listSqlInjectRules

-

POST /dbss/v1/{project_id}/{instance_id}/dbss/audit/rule/sql-injections

dbss:auditInstance:listSqlInjectRules

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sqls

dbss:auditInstance:listSqls

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sqls/list-sqls

dbss:auditInstance:listSqls

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql-rule/switch

dbss:auditInstance:switchSqlInjectRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql/switch

dbss:auditInstance:switchSqlInjectRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql-rule

dbss:auditInstance:addSqlInjectRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql

dbss:auditInstance:addSqlInjectRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql-rules/rank

dbss:auditInstance:orderSqlInjectRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql/rank-sql

dbss:auditInstance:orderSqlInjectRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/reports

dbss:auditInstance:createReporter

-

POST /dbss/v1/{project_id}/{instance_id}/audit/reports/results/create-report

dbss:auditInstance:createReporter

-

POST /dbss/v1/{project_id}/{instance_id}/audit/reports/list

dbss:auditInstance:listReporters

-

POST /dbss/v1/{project_id}/{instance_id}/audit/reports/list-reports

dbss:auditInstance:listReporters

-

GET /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/{risk_id}

dbss:auditInstance:getRiskRuleDetail

-

GET /dbss/v1/{project_id}/{instance_id}/dbss/audit/rule/risk/{risk_id}

dbss:auditInstance:getRiskRuleDetail

-

GET /dbss/v1/{project_id}/{instance_id}/audit/operation/emails

dbss:auditInstance:listAlarmEmails

-

GET /dbss/v1/{project_id}/{instance_id}/audit/operation/list-emails

dbss:auditInstance:listAlarmEmails

-

GET /dbss/v1/{project_id}/{instance_id}/audit/reports/{report_id}

dbss:auditInstance:downloadReporter

-

GET /dbss/v1/{project_id}/{instance_id}/audit/reports/results/{report_id}/download-report

dbss:auditInstance:downloadReporter

-

GET /dbss/v1/{project_id}/{instance_id}/audit/rule/scopes

dbss:auditInstance:listAuditScopeRules

-

GET /dbss/v1/{project_id}/{instance_id}/audit/rule/scope/list-scope

dbss:auditInstance:listAuditScopeRules

-

GET /dbss/v1/{project_id}/{instance_id}/dbss/audit/rule/scopes

dbss:auditInstance:listAuditScopeRules

-

GET /dbss/v1/{project_id}/{instance_id}/audit/sensitive/masks

dbss:auditInstance:listSensitiveRules

-

GET /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/list-rules

dbss:auditInstance:listSensitiveRules

-

GET /dbss/v1/{project_id}/{instance_id}/dbss/audit/sensitive/masks

dbss:auditInstance:listSensitiveRules

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/masks

dbss:auditInstance:addSensitiveRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/add-rule

dbss:auditInstance:addSensitiveRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/masks/{rule_id}

dbss:auditInstance:editSensitiveRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/{rule_id}/edit-rule

dbss:auditInstance:editSensitiveRule

-

GET /dbss/v1/{project_id}/{instance_id}/audit/reports/templates

dbss:auditInstance:listReporters

-

GET /dbss/v1/{project_id}/{instance_id}/audit/reports/list-templates

dbss:auditInstance:listReporters

-

GET /dbss/v1/{project_id}/{instance_id}/audit/rule/risk

dbss:auditInstance:listRiskRules

-

GET /dbss/v1/{project_id}/{instance_id}/dbss/audit/rule/risk

dbss:auditInstance:listRiskRules

-

DELETE /dbss/v1/{project_id}/{instance_id}/audit/reports/{report_id}

dbss:auditInstance:deleteReporter

-

DELETE /dbss/v1/{project_id}/{instance_id}/audit/reports/results/{report_id}/delete-report

dbss:auditInstance:deleteReporter

-

POST /dbss/v1/{project_id}/{instance_id}/audit/general/operate-log

dbss:auditInstance:listOperateLog

-

POST /dbss/v1/{project_id}/{instance_id}/dbss/audit/operate-log

dbss:auditInstance:listOperateLog

-

POST /dbss/v1/{project_id}/{instance_id}/audit/operation/monitorinfo

dbss:auditInstance:listMonitorInfos

-

POST /dbss/v1/{project_id}/{instance_id}/audit/operation/get-monitorinfo

dbss:auditInstance:listMonitorInfos

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sessionstatistics/clientsession

dbss:auditInstance:listSessionInfo

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sessionstatistics/list-clientsession

dbss:auditInstance:listSessionInfo

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sessionstatistics/accountsession

dbss:auditInstance:listSessionInfo

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sessionstatistics/list-accountsession

dbss:auditInstance:listSessionInfo

-

POST /dbss/v1/{project_id}/{instance_id}/audit/backup/stop

dbss:auditInstance:switchBackup

dbss:auditInstance:getBackupConfig

POST /dbss/v1/{project_id}/{instance_id}/audit/backup/stop-backup

dbss:auditInstance:switchBackup

dbss:auditInstance:getBackupConfig

POST /dbss/v1/{project_id}/{instance_id}/audit/backup/start

dbss:auditInstance:switchBackup

dbss:auditInstance:getBackupConfig

POST /dbss/v1/{project_id}/{instance_id}/audit/backup/start-backup

dbss:auditInstance:switchBackup

dbss:auditInstance:getBackupConfig

GET /dbss/v1/{project_id}/dbss/saleslicense/download

dbss::downloadLicense

-

GET /dbss/v1/{project_id}/dbss/download-saleslicense

dbss::downloadLicense

-

DELETE /dbss/v1/{project_id}/dbss/audit/job/{failed_id}

dbss::deleteAuditInstanceJob

-

DELETE /dbss/v1/{project_id}/dbss/audit/delete-job/{failed_id}

dbss::deleteAuditInstanceJob

-

GET /dbss/v2/{project_id}/audit/databases/rds

dbss::listRdsDb

-

POST /dbss/v1/{project_id}/dbss/audit/rds-instance

dbss::listRdsDb

-

POST /dbss/v1/{project_id}/dbss/audit/guassDbInstance

dbss::listRdsDb

-

POST /dbss/v1/{project_id}/dbss/audit/instance/start

dbss:auditInstance:instanceStart

-

POST /dbss/v1/{project_id}/dbss/audit/start-instance

dbss:auditInstance:instanceStart

-

POST /dbss/v1/{project_id}/dbss/audit/instance/reboot

dbss:auditInstance:reboot

-

POST /dbss/v1/{project_id}/dbss/audit/reboot-instance

dbss:auditInstance:reboot

-

POST /dbss/v1/{project_id}/dbss/audit/instance/stop

dbss:auditInstance:stop

-

POST /dbss/v1/{project_id}/dbss/audit/stop-instance

dbss:auditInstance:stop

-

POST /dbss/v1/{project_id}/dbss/{instance_id}/audit/upgrade

dbss:auditInstance:upgrade

-

GET /dbss/v1/{project_id}/dbss/audit/upgrade/status

dbss::queryUpgradeStatus

-

POST /dbss/v1/{project_id}/dbss/audit/securitygroup

dbss:auditInstance:updateSecurityGroup

-

POST /dbss/v1/{project_id}/dbss/audit/update-securitygroup

dbss:auditInstance:updateSecurityGroup

-

PUT /dbss/v1/{project_id}/dbss/audit/instances/{instance_id}

dbss:auditInstance:modifyAttribute

-

POST /dbss/v1/{project_id}/dbss/audit/update-instance/{instance_id}

dbss:auditInstance:modifyAttribute

-

GET /dbss/v1/{project_id}/{instance_id}/audit/operation/agent/{agent_id}/download

dbss:auditInstance:downloadAgent

-

GET /dbss/v1/{project_id}/{instance_id}/audit/operation/download-agent/{agent_id}

dbss:auditInstance:downloadAgent

-

GET /dbss/v2/{project_id}/{instance_id}/audit/agents/{agent_id}

dbss:auditInstance:downloadAgent

-

POST /dbss/v1/{project_id}/{instance_id}/audit/agent/switch

dbss:auditInstance:switchAgent

-

GET /dbss/v2/{project_id}/{instance_id}/audit/agents

dbss:auditInstance:listAgents

-

GET /dbss/v1/{project_id}/{instance_id}/audit/agents/{db_id}

dbss:auditInstance:listAgents

-

DELETE /dbss/v1/{project_id}/{instance_id}/audit/agents/{db_id}/{agent_id}

dbss:auditInstance:deleteAgent

-

DELETE /dbss/v2/{project_id}/{instance_id}/audit/agents/{agent_id}

dbss:auditInstance:deleteAgent

-

POST /dbss/v2/{project_id}/{instance_id}/audit/agents

dbss:auditInstance:addAgent

-

POST /dbss/v1/{project_id}/{instance_id}/audit/agents

dbss:auditInstance:addAgent

-

POST /dbss/v1/{project_id}/{instance_id}/audit/agent/add-agent

dbss:auditInstance:addAgent

-

POST /dbss/v1/{project_id}/{instance_id}/audit/agent/{agent_id}

dbss:auditInstance:addAgent

-

GET /dbss/v1/{project_id}/{instance_id}/audit/reports/{report_id}/preview

dbss:auditInstance:previewReporter

-

GET /dbss/v1/{project_id}/{instance_id}/audit/reports/{report_id}/preview-report

dbss:auditInstance:previewReporter

-

POST /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-config

dbss:auditInstance:setAlarmConfig

-

POST /dbss/v1/{project_id}/{instance_id}/audit/operation/config-email

dbss:auditInstance:configAlarmEmail

-

GET /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-config

dbss:auditInstance:getAlarmConfig

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/search-rules

dbss:auditInstance:listRiskRules

-

POST /dbss/v1/{project_id}/obs/upload-config

dbss:auditInstance:exportInstancesDatabaseConfig

-

POST /dbss/v1/charge/{project_id}/audit/period/order

dbss:auditInstance:createOnPeriod

dbss::listCommonInfo

GET /dbss/v1/{project_id}/{instance_id}/audit/agent/get-agent

dbss:auditInstance:listAgents

-

POST /dbss/v1/{project_id}/{instance_id}/audit/agent/del-agent

dbss:auditInstance:deleteAgent

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql/{sql_id}

dbss:auditInstance:editSqlInjectRule

-

DELETE /dbss/v1/{project_id}/{instance_id}/audit/rule/sql/{sql_id}

dbss:auditInstance:deleteSqlInjectRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/delete-rules

dbss:auditInstance:deleteSensitiveRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/list-rules

dbss:auditInstance:listRiskRules

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/scope/delete-scope

dbss:auditInstance:deleteAuditScopeRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/delete-risk

dbss:auditInstance:deleteRiskRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/backup/del-backup

dbss:auditInstance:deleteBackup

-

POST /dbss/v1/{project_id}/{instance_id}/audit/backup/status

dbss:auditInstance:listBackups

-

POST /dbss/v1/{project_id}/{instance_id}/audit/backup/auto-backup-template

dbss:auditInstance:getBackupConfig

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/scope/edit-rule/{scope-id}

dbss:auditInstance:editAuditScopeRule

-

GET /dbss/v1/{project_id}/dbss/audit/list-instances

dbss:auditInstance:instanceList

-

POST /dbss/v1/{project_id}/dbss/audit/create-instance

dbss:auditInstance:createOnDemand

dbss::listCommonInfo

POST /dbss/v2/{project_id}/dbss/audit/charge/period/order

dbss:auditInstance:createOnPeriod

dbss::listCommonInfo

GET /dbss/v2/{project_id}/dbss/audit/availability-zone

dbss::listCommonInfo

-

GET /dbss/v2/{project_id}/audit/summary/{busi_type}/taskstatus

dbss::getauditInstancesSummaryTaskStatus

-

GET /dbss/v1/{project_id}/audit/summary/info

dbss:auditInstance:listInstancesSummaryInfo

-

GET /dbss/v1/{project_id}/audit/summary/{busi_type}/taskstatus

dbss::getauditInstancesSummaryTaskStatus

-

GET /dbss/v1/{project_id}/audit/risk/statistics

dbss:auditInstance:listInstancesSummaryInfo

-

POST /dbss/v1/{project_id}/audit/summary/{busi_type}/taskstatus

dbss::updateAuditInstancesSummaryInfo

-

POST /dbss/v1/{project_id}/{instance_id}/audit/reports/templates-topic/scheduler/config-task

dbss:auditInstance:setReporterConfig

-

GET /dbss/v1/{project_id}/{instance_id}/audit/reports/templates-topic/scheduler/{template_id}

dbss:auditInstance:getReporterConfig

-

POST /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-config-topic

dbss:auditInstance:setAlarmConfig

-

GET /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-config-topic

dbss:auditInstance:getAlarmConfig

-

POST /dbss/v1/{project_id}/{instance_id}/audit/databases

dbss:auditInstance:addBareDatabase

-

POST /dbss/v1/{project_id}/{instance_id}/audit/operation/databases

dbss:auditInstance:addBareDatabase

-

POST /dbss/v1/{project_id}/{instance_id}/audit/operation/create-database

dbss:auditInstance:addBareDatabase

-

GET /dbss/v1/{project_id}/{instance_id}/dbss/audit/databases

dbss:auditInstance:listDatabases

-

GET /dbss/v1/{project_id}/{instance_id}/audit/operation/databases

dbss:auditInstance:listDatabases

-

GET /dbss/v1/{project_id}/{instance_id}/audit/operation/list-databases

dbss:auditInstance:listDatabases

-

POST /dbss/v1/{project_id}/{instance_id}/audit/operation/switch

dbss:auditInstance:switchDatabase

-

POST /dbss/v2/{project_id}/{instance_id}/audit/databases/switch

dbss:auditInstance:switchDatabase

-

DELETE /dbss/v2/{project_id}/{instance_id}/audit/databases/{db_id}

dbss:auditInstance:deleteDatabase

-

POST /dbss/v1/{project_id}/{instance_id}/audit/operation/database/delete

dbss:auditInstance:deleteDatabase

-

POST /dbss/v1/{project_id}/{instance_id}/audit/operation/delete-database

dbss:auditInstance:deleteDatabase

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/scopes

dbss:auditInstance:addAuditScopeRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/scope/add-rule

dbss:auditInstance:addAuditScopeRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/scope/switch

dbss:auditInstance:switchAuditScopeRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk

dbss:auditInstance:addRiskRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/add-rule

dbss:auditInstance:addRiskRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/switch

dbss:auditInstance:switchRiskRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/{risk_id}

dbss:auditInstance:editRiskRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/edit-risk/{risk_id}

dbss:auditInstance:editRiskRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/scopes/{scope_id}

dbss:auditInstance:editAuditScopeRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/operation/email/{email_id}

dbss:auditInstance:configAlarmEmail

-

POST /dbss/v1/{project_id}/{instance_id}/audit/operation/edit-email/{email_id}

dbss:auditInstance:configAlarmEmail

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/rank-risk

dbss:auditInstance:setRiskRulePriority

-

POST /dbss/v1/{project_id}/{instance_id}/audit/rule/sql-rule/{rule_id}

dbss:auditInstance:editSqlInjectRule

-

DELETE /dbss/v1/{project_id}/{instance_id}/audit/rule/sql-rule/{rule_id}

dbss:auditInstance:deleteSqlInjectRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/reports/templates/scheduler/config-task

dbss:auditInstance:setReporterConfig

-

POST /dbss/v1/{project_id}/{instance_id}/audit/general/risk-statistics

dbss:auditInstance:listStatistics

-

POST /dbss/v1/{project_id}/{instance_id}/audit/general/session-statistics

dbss:auditInstance:listStatistics

-

POST /dbss/v1/{project_id}/{instance_id}/audit/general/sql-statistics

dbss:auditInstance:listStatistics

-

GET /dbss/v1/{project_id}/{instance_id}/audit/reports/templates/scheduler/{template_id}

dbss:auditInstance:getReporterConfig

-

GET /dbss/v1/{project_id}/{instance_id}/audit/sqls/{sql_statement_id}

dbss:auditInstance:listSqls

-

GET /dbss/v1/{project_id}/{instance_id}/audit/sensitive/result/switch

dbss:auditInstance:listSensitiveRules

-

GET /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/switch

dbss:auditInstance:listSensitiveRules

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/result/switch

dbss:auditInstance:modifySensitiveRuleSaveResultSwitch

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/switch

dbss:auditInstance:modifySensitiveRuleAnonymizeSwitch

-

DELETE /dbss/v1/{project_id}/{instance_id}/audit/sensitive/masks/{rule_id}

dbss:auditInstance:deleteSensitiveRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/sensitive/mask/rule/switch

dbss:auditInstance:switchSensitiveRule

-

DELETE /dbss/v1/{project_id}/{instance_id}/audit/rule/scopes/{scope_id}

dbss:auditInstance:deleteAuditScopeRule

-

DELETE /dbss/v1/{project_id}/{instance_id}/audit/rule/risk/{risk_id}

dbss:auditInstance:deleteRiskRule

-

POST /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-log

dbss:auditInstance:listAlarmItems

-

POST /dbss/v1/{project_id}/{instance_id}/audit/alarm-log

dbss:auditInstance:listAlarmItems

-

PUT /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-log/{alarm_id}

dbss:auditInstance:markAlarm

-

DELETE /dbss/v1/{project_id}/{instance_id}/audit/general/alarm-log/{alarm_id}

dbss:auditInstance:deleteAlarm

-

POST /dbss/v1/{project_id}/{instance_id}/audit/general/mark-alarm-log

dbss:auditInstance:markAlarm

-

POST /dbss/v1/{project_id}/{instance_id}/audit/general/synopsis-statistics

dbss:auditInstance:listStatistics

-

POST /dbss/v1/{project_id}/{instance_id}/audit/backups

dbss:auditInstance:listBackups

-

POST /dbss/v1/{project_id}/{instance_id}/audit/backup/get-backup

dbss:auditInstance:listBackups

-

DELETE /dbss/v1/{project_id}/{instance_id}/audit/backups/{id}

dbss:auditInstance:deleteBackup

-

POST /dbss/v1/{project_id}/{instance_id}/audit/backup/restore

dbss:auditInstance:restoreBackup

-

POST /dbss/v1/{project_id}/{instance_id}/audit/backup/retry

dbss:auditInstance:retryBackup

-

GET /dbss/v1/{project_id}/{instance_id}/audit/backup/bucket-name

dbss:auditInstance:getBackupConfig

-

GET /dbss/v1/{project_id}/{instance_id}/audit/backup/status

dbss:auditInstance:listBackups

-

GET /dbss/v1/{project_id}/{instance_id}/audit/backup/auto-backup-template

dbss:auditInstance:getBackupConfig

-

GET /dbss/v1/{project_id}/{instance_id}/audit/backup/risk-templates

dbss:auditInstance:getRiskBackupConfigInfo

-

GET /dbss/v1/{project_id}/{instance_id}/audit/backup/risk-template/{db_id}

dbss:auditInstance:getRiskBackupConfigInfo

-

POST /dbss/v1/{project_id}/{instance_id}/audit/backup/risk/switch

dbss:auditInstance:switchRiskBackup

-

GET /dbss/v1/{project_id}/{instance_id}/audit/backup/risk-bucket-path

dbss:auditInstance:getRiskBackupBucketInfo

-

POST /dbss/v1/{project_id}/{instance_id}/audit/backup/risk-bucket-path

dbss:auditInstance:setRiskBackupBucketInfo

-

GET /dbss/v1/{project_id}/{instance_id}/audit/backup/bucket-path

dbss:auditInstance:getBackupConfig

-

POST /dbss/v1/{project_id}/{instance_id}/dbss/audit/databases/rds

dbss:auditInstance:addRdsDatabase

-

POST /dbss/v1/{project_id}/{instance_id}/audit/operation/rds

dbss:auditInstance:addRdsDatabase

-

POST /dbss/v1/{project_id}/{instance_id}/audit/operation/create-guassdb-rds

dbss:auditInstance:addRdsDatabase

-

POST /dbss/v2/{project_id}/{instance_id}/audit/databases/rds

dbss:auditInstance:addRdsDatabase

-

POST /dbss/v1/{domain_id}/{instance_id}/audit/backup/risk-bucket-path/global

dbss:auditInstance:setRiskBackupBucketInfo

-

POST /dbss/v1/{domain_id}/{instance_id}/audit/backup/global/switch

dbss:auditInstance:switchBackup

dbss:auditInstance:getBackupConfig

POST /dbss/v1/{domain_id}/{instance_id}/audit/backup/risk/global/switch

dbss:auditInstance:switchRiskBackup

-

GET /dbss/v1/{project_id}/dbss/server-info

dbss::getServerInfo

-

GET /dbss/v1/{project_id}/dbss/audit/jobs/{resource_id}

dbss::getAuditInstanceJob

-

GET /dbss/v1/{project_id}/dbss/audit/list-jobs/{resource_id}

dbss::getAuditInstanceJob

-

GET /dbss/v1/{project_id}/dbss/audit/list-jobs

dbss:auditInstance:listJobs

-

GET /dbss/v1/{project_id}/dbss/audit/specification

dbss::listCommonInfo

-

GET /dbss/v1/{project_id}/dbss/audit/instances

dbss:auditInstance:instanceList

-

GET /dbss/v1/{project_id}/dbss/audit/quota

dbss::listCommonInfo

-

GET /dbss/v1/{project_id}/dbss/availability-zone

dbss::listCommonInfo

-

GET /dbss/v1/{project_id}/dbss/get-availability-zone

dbss::listCommonInfo

-

GET /dbss/v1/{project_id}/obs/audit/backup/obs-buckets

dbss::listObsBuckets

-

POST /dbss/v1/{project_id}/dbss/audit/security-group

dbss:auditInstance:updateSecurityGroup

-

POST /dbss/v1/{project_id}/dbss/audit/instances

dbss:auditInstance:createOnDemand

dbss::listCommonInfo

DELETE /dbss/v1/{project_id}/dbss/audit/delete-instance

dbss:auditInstance:instanceDelete

-

POST /dbss/v1/{project_id}/{resource_type}/resource-instances/filter

dbss::listResourcesByTag

-

POST /dbss/v1/{project_id}/{resource_type}/resource-instances/count

dbss::listResourcesByTag

-

POST /dbss/v1/{project_id}/{resource_type}/{resource_id}/tags/create

dbss::tagResource

-

DELETE /dbss/v1/{project_id}/{resource_type}/{resource_id}/tags/delete

dbss::unTagResource

-

GET /dbss/v1/{project_id}/{resource_type}/tags

dbss::listTags

-

GET /dbss/v1/{project_id}/{resource_type}/{resource_id}/tags

dbss::listTagsForResource

-

资源类型（Resource）

资源类型（Resource）表示身份策略所作用的资源。如表3中的某些操作指定了可以在该操作指定的资源类型，则必须在具有该操作的身份策略语句中指定该资源的URN，身份策略仅作用于此资源；如未指定，Resource默认为“*”，则身份策略将应用到所有资源。您也可以在身份策略中设置条件，从而指定资源类型。

DBSS定义了以下可以在自定义身份策略的Resource元素中使用的资源类型。

表3 DBSS支持的资源类型

资源类型

URN

auditInstance

dbss:<region>:<account-id>:auditInstance:<instance-id>

条件（Condition）

条件键概述

条件（Condition）是身份策略生效的特定条件，包括条件键和运算符。

  • 条件键表示身份策略语句的Condition元素中的键值。根据适用范围，分为全局级条件键和服务级条件键。
    • 全局级条件键（前缀为g:）适用于所有操作，在鉴权过程中，云服务不需要提供用户身份信息，系统将自动获取并鉴权。详情请参见：全局条件键。
    • 服务级条件键（前缀通常为服务缩写，如dbss:）仅适用于对应服务的操作，详情请参见表4。
    • 单值/多值表示API调用时请求中与条件关联的值数。单值条件键在API调用时的请求中最多包含一个值，多值条件键在API调用时请求可以包含多个值。例如：g:SourceVpce是单值条件键，表示仅允许通过某个VPC终端节点发起请求访问某资源，一个请求最多包含一个VPC终端节点ID值。g:TagKeys是多值条件键，表示请求中携带的所有标签的key组成的列表，当用户在调用API请求时传入标签可以传入多个值。
  • 运算符与条件键、条件值一起构成完整的条件判断语句，当请求信息满足该条件时，身份策略才能生效。支持的运算符请参见：运算符。

DBSS支持的服务级条件键

DBSS定义了以下可以在自定义身份策略的Condition元素中使用的条件键，您可以使用这些条件键进一步细化身份策略语句应用的条件。

表4 DBSS支持的服务级条件键

服务级条件键

类型

单值/多值

说明

dbss:VpcId

string

单值

根据请求参数中指定的网络ID过滤访问。

dbss:SubnetId

string

单值

根据请求参数中指定的子网ID过滤访问。
父主题： 安全与合规

相关文档