ApsaraDB for MongoDB:How to grant permissions to a RAM user for ApsaraDB for MongoDB

Grant permissions to a RAM user

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the target RAM user and click Add Permissions in the Actions column. > Tip: To grant permissions to multiple RAM users at once, select the RAM users and click Add Permissions at the bottom of the page.

4. In the Grant Permission panel, configure the following parameters:

   Important

   If you select Resource Group for Resource Scope, make sure that ApsaraDB for MongoDB supports resource groups. For more information, see Services that work with Resource Group. For more information about how to grant permissions on a resource group, see Use a resource group to grant a RAM user the permissions to manage a specific ECS instance.

   Note The system automatically identifies high-risk system policies such as AdministratorAccess and AliyunRAMFullAccess. Avoid attaching high-risk policies unless absolutely necessary.

   Parameter	Description
   Resource Scope	Account: The policy takes effect on the current Alibaba Cloud account. Resource Group: The policy takes effect on a specific resource group.
   Principal	The RAM user to which permissions are granted. The current RAM user is selected by default.
   Policy	The policy to attach. Select one or more system policies or custom policies.

5. Click Grant permissions.

6. Click Close.

System policies

ApsaraDB for MongoDB provides two system policies:

Use AliyunMongoDBFullAccess for administrators who manage instances. Use AliyunMongoDBReadOnlyAccess for users who only need to view instance information, monitoring data, or backup status.

Custom policies

Custom policies provide fine-grained access control over specific API operations and instances. For the full syntax reference, see Policy structure and syntax.

acs:dds:$regionid:$accountid:dbinstance/$dbinstanceid

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dds:DescribeDBInstances",
        "dds:DescribeDBInstanceAttribute",
        "dds:DescribeDBInstancePerformance",
        "dds:DescribeReplicaSetRole",
        "dds:DescribeSecurityIps",
        "dds:DescribeAccounts",
        "dds:DescribeBackupPolicy"
      ],
      "Resource": "acs:dds:cn-hangzhou:1234567890:dbinstance/dds-bp1234567890"
    }
  ]
}

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dds:DescribeBackupPolicy",
        "dds:ModifyBackupPolicy",
        "dds:CreateBackup",
        "dds:RestoreDBInstance",
        "dds:DescribeDBInstances"
      ],
      "Resource": "acs:dds:*:*:dbinstance/*"
    }
  ]
}

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "dds:*",
      "Resource": "acs:dds:cn-hangzhou:*:dbinstance/*"
    }
  ]
}

Core concepts

Best practices

• Start with system policies. Use AliyunMongoDBFullAccess or AliyunMongoDBReadOnlyAccess for most scenarios. Create custom policies only when finer control is required.

• Apply least-privilege access. Grant only the minimum permissions a RAM user needs. For example, a monitoring user needs only Describe* operations, not Modify* or Delete* operations.

• Restrict resources by instance. Use the resource description format to limit permissions to specific instances rather than granting access to all instances with a wildcard (*).

• Separate duties. Assign different custom policies to different RAM users based on their roles. For example, separate backup operators from instance administrators.

• Review permissions regularly. Audit RAM user permissions periodically and revoke permissions that are no longer needed.

• Avoid high-risk policies. Do not attach AdministratorAccess or AliyunRAMFullAccess unless the RAM user requires broad access across all Alibaba Cloud services.

References

• Create a RAM user

• Create a custom policy

• Policy structure and syntax

• Services that work with RAM

• Services that work with Resource Group