RAM authorization - AnalyticDB - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by AnalyticDB for MySQL for RAM permission policies. The RAM code (RamCode) for AnalyticDB for MySQL is adb , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by AnalyticDB for MySQL. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
adb:DescribeAdviceServiceEnabled	DescribeAdviceServiceEnabled	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeDBClusterSSL	DescribeDBClusterSSL	get	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyDBClusterMaintainTime	ModifyDBClusterMaintainTime	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeSQLPatterns	DescribeSQLPatterns	list	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:EnableAdviceService	EnableAdviceService	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeAppliedAdvices	DescribeAppliedAdvices	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeAutoRenewAttribute	DescribeAutoRenewAttribute	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:ModifyDBResourcePool	ModifyDBResourcePool	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeEIURange	DescribeEIURange	get	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeSQAConfig	DescribeSQAConfig	get	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeDiagnosisMonitorPerformance	DescribeDiagnosisMonitorPerformance	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:CheckServiceLinkedRole	CheckServiceLinkedRole	get	All Resource ``	None	None
adb:DescribeDBClusterHealthStatus	DescribeDBClusterHealthStatus	get	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:MigrateDBCluster	MigrateDBCluster	update	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeHistoryEventsStat	DescribeHistoryEventsStat	get	All Resource ``	None	None
adb:DescribeDiagnosisTasks	DescribeDiagnosisTasks	get	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeDBClusterPerformance	DescribeDBClusterPerformance	list	All Resource ``	None	None
adb:DescribeTableAccessCount	DescribeTableAccessCount	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribePatternPerformance	DescribePatternPerformance	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ResetAccountPassword	ResetAccountPassword	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeAuditLogConfig	DescribeAuditLogConfig	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:OperateLogHub	OperateLogHub	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:BatchApplyAdviceByIdList	BatchApplyAdviceByIdList	update	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeInclinedTables	DescribeInclinedTables	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeLoadTasksRecords	DescribeLoadTasksRecords	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DeleteDBResourcePool	DeleteDBResourcePool	delete	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeLogHubAttribute	DescribeLogHubAttribute	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyAccountDescription	ModifyAccountDescription	update	All Resource ``	None	None
adb:DescribeTablePartitionDiagnose	DescribeTablePartitionDiagnose	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeDiagnosisDimensions	DescribeDiagnosisDimensions	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeSchemas	DescribeSchemas	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:UpgradeKernelVersion	UpgradeKernelVersion	update	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyClusterConnectionString	ModifyClusterConnectionString	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeTaskInfo	DescribeTaskInfo	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyAuditLogConfig	ModifyAuditLogConfig	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeTableStatistics	DescribeTableStatistics	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeAvailableAdvices	DescribeAvailableAdvices	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyDBCluster	ModifyDBCluster	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeBackups	DescribeBackups	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ListTagResources	ListTagResources	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeElasticPlan	DescribeElasticPlan	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeBackupPolicy	DescribeBackupPolicy	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeDBClusterSpaceSummary	DescribeDBClusterSpaceSummary	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeActiveOperationTasks	DescribeActiveOperationTasks	list	All Resource ``	None	None
adb:ModifyDBClusterVip	ModifyDBClusterVip	update	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeConnectionCountRecords	DescribeConnectionCountRecords	get	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:CreateDBResourceGroup	CreateDBResourceGroup	create	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:UntagResources	UntagResources	delete	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:ModifyDBClusterShardNumber	ModifyDBClusterShardNumber	update	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DownloadDiagnosisRecords	DownloadDiagnosisRecords	create	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeExcessivePrimaryKeys	DescribeExcessivePrimaryKeys	get	*DBClusterLakeVersion `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:CreateDBResourcePool	CreateDBResourcePool	create	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyDBClusterAccessWhiteList	ModifyDBClusterAccessWhiteList	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:GetCreateTableSQL	GetCreateTableSQL	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeAccounts	DescribeAccounts	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeAvailableResource	DescribeAvailableResource	get	All Resource ``	None	None
adb:DescribeOversizeNonPartitionTableInfos	DescribeOversizeNonPartitionTableInfos	get	*DBClusterLakeVersion `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:AttachUserENI	AttachUserENI	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeDBClusterAttribute	DescribeDBClusterAttribute	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeMaintenanceAction	DescribeMaintenanceAction	get	All Resource ``	None	None
adb:DeleteDBCluster	DeleteDBCluster	delete	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeDiagnosisSQLInfo	DescribeDiagnosisSQLInfo	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyDBClusterDescription	ModifyDBClusterDescription	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeDownloadRecords	DescribeDownloadRecords	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeLogStoreKeys	DescribeLogStoreKeys	get	All Resource ``	None	None
adb:ModifyDBClusterPayType	ModifyDBClusterPayType	update	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeOperatorPermission	DescribeOperatorPermission	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeDBClusterNetInfo	DescribeDBClusterNetInfo	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeSqlPattern	DescribeSqlPattern	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeDBResourcePool	DescribeDBResourcePool	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyResubmitConfig	ModifyResubmitConfig	update	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:RevokeOperatorPermission	RevokeOperatorPermission	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeAllDataSource	DescribeAllDataSource	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeSyncJobList	DescribeSyncJobList	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeLoghubDetail	DescribeLoghubDetail	get	All Resource ``	None	None
adb:ModifyActiveOperationMaintainConf	ModifyActiveOperationMaintainConf	update	All Resource ``	None	None
adb:ModifyLogBackupPolicy	ModifyLogBackupPolicy	update	All Resource ``	None	None
adb:GrantOperatorPermission	GrantOperatorPermission	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeTableDetail	DescribeTableDetail	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DeleteBackups	DeleteBackups	delete	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:KillProcess	KillProcess	delete	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyLogHubStatus	ModifyLogHubStatus	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeActiveOperationMaintainConf	DescribeActiveOperationMaintainConf	get	All Resource ``	None	None
adb:DescribeInclinedNodes	DescribeInclinedNodes	get	DBClusterLakeVersion `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyDBClusterSSL	ModifyDBClusterSSL	update	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	adb:EnableSSL	None
adb:DescribeAuditLogRecords	DescribeAuditLogRecords	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeAbnormalPatternDetection	DescribeAbnormalPatternDetection	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeDBClusterAccessWhiteList	DescribeDBClusterAccessWhiteList	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:TagResources	TagResources	create	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeSQLPlanTask	DescribeSQLPlanTask	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeKernelVersion	DescribeKernelVersion	list	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:CreateElasticPlan	CreateElasticPlan	create	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:CreateServiceLinkedRole	CreateServiceLinkedRole	update	All Resource ``	None	None
adb:DeleteElasticPlan	DeleteElasticPlan	delete	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:AllocateClusterPublicConnection	AllocateClusterPublicConnection	update	DBCluster `acs:adb:*:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeDBClusters	DescribeDBClusters	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/*`	None	None
adb:UnbindDBResourceGroupWithUser	UnbindDBResourceGroupWithUser	update	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeDBClusterResourcePoolPerformance	DescribeDBClusterResourcePoolPerformance	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:CreateAccount	CreateAccount	create	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeProcessList	DescribeProcessList	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:CreateDBCluster	CreateDBCluster	create	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/*`	adb:DiskEncryption adb:EnableSSL	None
adb:ModifyElasticPlan	ModifyElasticPlan	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyDBClusterResourceGroup	ModifyDBClusterResourceGroup	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyMaintenanceAction	ModifyMaintenanceAction	update	All Resource ``	None	None
adb:DescribeTables	DescribeTables	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeDBResourceGroup	DescribeDBResourceGroup	get	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeExecutorDetection	DescribeExecutorDetection	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeKmsKeys	DescribeKmsKeys	get	All Resource ``	None	None
adb:DescribeResubmitConfig	DescribeResubmitConfig	get	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeSlowLogRecords	DescribeSlowLogRecords	get	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DeleteAccount	DeleteAccount	delete	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeSQLPlan	DescribeSQLPlan	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:BindDBResourceGroupWithUser	BindDBResourceGroupWithUser	update	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DisableAdviceService	DisableAdviceService	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeComputeResource	DescribeComputeResource	get	All Resource ``	None	None
adb:ModifyBackupPolicy	ModifyBackupPolicy	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeDBClusterShardNumber	DescribeDBClusterShardNumber	get	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:UnbindDBResourcePoolWithUser	UnbindDBResourcePoolWithUser	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ApplyAdviceById	ApplyAdviceById	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifySQAConfig	ModifySQAConfig	update	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyAutoRenewAttribute	ModifyAutoRenewAttribute	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:BindDBResourcePoolWithUser	BindDBResourcePoolWithUser	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifyActiveOperationTasks	ModifyActiveOperationTasks	update	All Resource ``	None	None
adb:DetachUserENI	DetachUserENI	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeAllAccounts	DescribeAllAccounts	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeDiagnosisRecords	DescribeDiagnosisRecords	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ModifySyncJob	ModifySyncJob	update	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:ReleaseClusterPublicConnection	ReleaseClusterPublicConnection	delete	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:ModifyDBResourceGroup	ModifyDBResourceGroup	update	*DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
adb:DescribeControllerDetection	DescribeControllerDetection	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeWorkerDetection	DescribeWorkerDetection	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeElasticDailyPlan	DescribeElasticDailyPlan	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeBadSqlDetection	DescribeBadSqlDetection	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DescribeColumns	DescribeColumns	get	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None
adb:DeleteDBResourceGroup	DeleteDBResourceGroup	delete	DBCluster `acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}`	None	None

Resource

The following table lists the resources defined by AnalyticDB for MySQL. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
DBCluster	acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId} acs:adb:{#regionId}:{#accountId}:dbcluster/* acs:adb:{#regionId}:{#accountId}:* acs:adb:{#regionId}:{#accountId}:null/* acs:adb:*:{#accountId}:dbcluster/{#dbclusterId}
DBClusterLakeVersion	acs:adb:{#Region}:{#AccountId}:dbcluster/{#DBClusterId} acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}

Condition

The following table lists the product-level condition keys defined by AnalyticDB for MySQL. You can also use Alibaba Cloud's Common condition keys. Specify these keys in the Condition element of RAM policy statements to define granular authorization rules. In the condition key, specify the condition values in the Condition_value element of the policy.

Each condition key has a specific data type, such as string, number, Boolean, or IP address. The data type determines which conditional operators can be used to compare the request values against policy values. You must specify the conditional operators compatible with the data type of the condition key. Mismatched operators will invalidate the policy. See Condition operator for valid combinations.

Condition key	Description	Data type
adb:DiskEncryption	Whether to enable cloud disk encryption	String
adb:EnableSSL	Whether to enable SSL encryption link	String

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: