Database Autonomy Service:How do I use DAS as a RAM user?

Use system policies to grant permissions to a RAM user

1. Create a RAM user. For more information, see Create a RAM user.

2. Grant the RAM user permissions on DAS. For more information, see Grant permissions to RAM users.

   • AliyunHDMFullAccess: grants the RAM user full permissions on DAS.

   • AliyunHDMReadOnlyAccess: grants the RAM user the read-only permissions on DAS.

   • AliyunHDMReadOnlyWithSQLLogArchiveAccess: grants the RAM user the read-only permissions on DAS and the permissions to use the search and export features in the SQL Explorer and Audit module.

     Note

     You can also use custom policies to grant a RAM user the permissions to use the search and export features in the SQL Explorer and Audit module. For more information, see the Use custom policies to grant a RAM user the permissions to use the search and export features in the SQL Explorer and Audit module section of this topic.

Use custom policies to grant permissions to a RAM user

If the preceding method cannot meet your requirements, you can create custom policies to implement more fine-grained access control.

A policy defines a set of permissions that are described based on the policy structure and syntax. You can use policies to describe the authorized resource sets, authorized operation sets, and authorization conditions. For more information about the policy elements, structure, and syntax, see Policy elements and Policy structure and syntax.

1. Create a RAM user. For more information, see Create a RAM user.

2. Create a custom policy. For more information, see the Create a custom policy on the JSON tab section of the "Create a custom policy" topic.

3. Attach the created custom policy to the RAM user. For more information, see Grant permissions to RAM users.

Use custom policies to grant a RAM user the permissions to use the search and export features in the SQL Explorer and Audit module

1. Create a custom policy that grants the permissions to use the export feature. For more information, see the Create a custom policy on the JSON tab section of the "Create a custom policy" topic.

   • ApsaraDB RDS instances

     {
       "Version": "1",
       "Statement": [
         {
           "Action":
           [
           "rds:DescribeSQLLogRecordsList",
           "rds:DescribeSqlLogDetailArchiveStatus",
           "rds:StartSqlLogDetailArchive"
           ],
           "Resource": "*",
           "Effect": "Allow"
         }
       ]
     }

     Note

     The preceding custom policy grants the RAM user the permissions to export the information about all ApsaraDB RDS instances. If you want to grant the RAM user the permissions to export the information about a specific ApsaraDB RDS instance, replace "Resource": "*" with "Resource": "acs:rds:*:*:dbinstance/<ApsaraDB RDS instance ID>".

   • PolarDB for MySQL clusters

     {
       "Version": "1",
       "Statement": [
         {
           "Action":
           [
           "polardb:DescribeSQLLogRecords",
           "polardb:DescribeSqlLogDetailArchiveStatus",
           "polardb:StartSqlLogDetailArchive"
           ],
           "Resource": "*",
           "Effect": "Allow"
         }
       ]
     }

     Note

     The preceding custom policy grants the RAM user the permissions to export the information about all PolarDB for MySQL clusters. If you want to grant the RAM user the permissions to export the information about a specific PolarDB for MySQL cluster, replace "Resource": "*" with "Resource": "acs:polardb:*:*:dbcluster/<PolarDB for MySQL cluster ID>".

   • PolarDB-X 2.0 instances

     {
       "Version": "1",
       "Statement": [
         {
           "Action":
           [
           "hdm:DescribeDasSQLLogRecordsList",
           "hdm:DescribeDasSqlLogDetailArchiveStatus",
           "hdm:StartDasSqlLogDetailArchive"
           ],
           "Resource": "*",
           "Effect": "Allow"
         }
       ]
     }

     Note

     The preceding custom policy grants the RAM user the permissions to export the information about all PolarDB-X 2.0 instances. If you want to grant the RAM user the permissions to export the information about a specific PolarDB-X 2.0 instance, replace "Resource": "*" with "Resource": "acs:polardbx:*:*:instance/<PolarDB-X 2.0 instance ID>".

2. Attach the created custom policy to the RAM user. For more information, see Grant permissions to RAM users.

   Note

   If you want to export data in the console of a database service, make sure that the RAM user has the read-only permissions on the database service.

Sample custom policy

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "hdm:Get*",
                "hdm:Describe*",
                "hdm:Query*"
            ],
            "Resource": "acs:rds:*:*:dbinstance/<ApsaraDB RDS instance ID>",
            "Effect": "Allow"
        }
    ]
}