RAM authorization - PolarDB - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by PolarDB for RAM permission policies. The RAM code (RamCode) for PolarDB is polardb , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by PolarDB. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
polardb:DisableDBClusterServerless	DisableDBClusterServerless	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:CancelScheduleTasks	CancelScheduleTasks	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DeleteDBClusterEndpointZonal	DeleteDBClusterEndpointZonal	delete	All Resource ``	None	None
polardb:DescribeDBClusterTDE	DescribeDBClusterTDE	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CreateDBNodes	CreateDBNodes	create	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeDBInstancePerformance	DescribeDBInstancePerformance	get	DBCluster `acs:polardb::{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:ModifyDBDescription	ModifyDBDescription	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:EnableDBClusterServerless	EnableDBClusterServerless	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeUpgradeReport	DescribeUpgradeReport	get	All Resource ``	None	None
polardb:ModifyDBClusterMaintainTime	ModifyDBClusterMaintainTime	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DeleteGlobalDatabaseNetwork	DeleteGlobalDatabaseNetwork	delete	*GlobalDatabaseNetwork `acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}`	None	None
polardb:DisableDBClusterOrca	DisableDBClusterOrca	none	All Resource ``	None	None
polardb:ModifyDBClusterDescriptionZonal	ModifyDBClusterDescriptionZonal	update	All Resource ``	None	None
polardb:ModifyDBClusterEndpoint	ModifyDBClusterEndpoint	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeDBClustersWithBackups	DescribeDBClustersWithBackups	get	DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/`	None	None
polardb:ModifyResourcePackage	ModifyResourcePackage	update	All Resource ``	None	None
polardb:DeleteAccount	DeleteAccount	delete	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeDBNodePerformance	DescribeDBNodePerformance	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ModifyScheduleTask	ModifyScheduleTask	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:ModifyMaskingRules	ModifyMaskingRules	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:UpdateExtensions	UpdateExtensions	update	All Resource ``	None	None
polardb:ContinueDBClusterMigration	ContinueDBClusterMigration	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeDBClusterAuditLogCollector	DescribeDBClusterAuditLogCollector	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeHistoryTasksStat	DescribeHistoryTasksStat	get	All Resource ``	None	None
polardb:ModifyEncryptionDBSecret	ModifyEncryptionDBSecret	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DeleteDBCluster	DeleteDBCluster	delete	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CloseAITask	CloseAITask	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeMetaList	DescribeMetaList	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:CheckKMSAuthorized	CheckKMSAuthorized	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:ModifyDBClusterStorageSpace	ModifyDBClusterStorageSpace	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeDBClusters	DescribeDBClusters	list	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeDBClusterVersion	DescribeDBClusterVersion	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:AddFirewallRules	AddFirewallRules	create	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ModifyGlobalSecurityIPGroupName	ModifyGlobalSecurityIPGroupName	update	All Resource ``	None	None
polardb:ModifyDBEndpointAddress	ModifyDBEndpointAddress	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CreateDBClusterEndpointZonal	CreateDBClusterEndpointZonal	create	All Resource ``	None	None
polardb:DescribeSlowLogRecords	DescribeSlowLogRecords	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeApplicationParameters	DescribeApplicationParameters	get	All Resource ``	None	None
polardb:DescribeVSwitches	DescribeVSwitches	get	All Resource ``	None	None
polardb:DescribeGlobalDataNetworkList	DescribeGlobalDataNetworkList	list	All Resource ``	None	None
polardb:CreateAccount	CreateAccount	create	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeFirewallRules	DescribeFirewallRules	get	DBCluster `acs:polardb::{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CreateGlobalSecurityIPGroup	CreateGlobalSecurityIPGroup	create	All Resource ``	None	None
polardb:DescribeAIDBClusters	DescribeAIDBClusters	get	All Resource ``	None	None
polardb:CreateDatabase	CreateDatabase	create	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DeleteApplicationEndpointAddress	DeleteApplicationEndpointAddress	delete	All Resource ``	None	None
polardb:CreateDBLink	CreateDBLink	create	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:DescribeDBClusterNetInfo	DescribeDBClusterNetInfo	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DBClusterId}`	None	None
polardb:ModifyCronJobPolicyServerless	ModifyCronJobPolicyServerless	update	All Resource ``	None	None
polardb:ModifyAccountPassword	ModifyAccountPassword	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeParameterGroup	DescribeParameterGroup	get	All Resource ``	None	None
polardb:AddSQLRateLimitingRules	AddSQLRateLimitingRules	create	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeDBClusterSSL	DescribeDBClusterSSL	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeActivationCodes	DescribeActivationCodes	get	All Resource ``	None	None
polardb:DeleteBackup	DeleteBackup	delete	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ModifyApplicationDescription	ModifyApplicationDescription	update	All Resource ``	None	None
polardb:RevokeAccountPrivilege	RevokeAccountPrivilege	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeMaskingRules	DescribeMaskingRules	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:DescribeCronJobPolicyServerless	DescribeCronJobPolicyServerless	list	All Resource ``	None	None
polardb:TempModifyDBNode	TempModifyDBNode	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:DeleteDatabase	DeleteDatabase	delete	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeLicenseOrders	DescribeLicenseOrders	get	All Resource ``	None	None
polardb:ResetAccountZonal	ResetAccountZonal	update	All Resource ``	None	None
polardb:RefreshDBClusterStorageUsage	RefreshDBClusterStorageUsage	update	All Resource ``	None	None
polardb:FailoverDBClusterZonal	FailoverDBClusterZonal	update	All Resource ``	None	None
polardb:DescribeActiveOperationMaintainConf	DescribeActiveOperationMaintainConf	get	All Resource ``	None	None
polardb:RestartDBNodeZonal	RestartDBNodeZonal	update	All Resource ``	None	None
polardb:DescribeGlobalSecurityIPGroup	DescribeGlobalSecurityIPGroup	get	All Resource ``	None	None
polardb:ModifyBackupPolicy	ModifyBackupPolicy	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CreateDatabaseZonal	CreateDatabaseZonal	create	All Resource ``	None	None
polardb:DeleteDBClusterEndpoint	DeleteDBClusterEndpoint	delete	*Endpoint `acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}`	None	None
polardb:CreateCronJobPolicyServerless	CreateCronJobPolicyServerless	create	All Resource ``	None	None
polardb:ManuallyStartDBCluster	ManuallyStartDBCluster	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeGlobalDatabaseNetworks	DescribeGlobalDatabaseNetworks	get	DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/`	None	None
polardb:ModifyPendingMaintenanceAction	ModifyPendingMaintenanceAction	update	All Resource ``	None	None
polardb:CreateDBEndpointAddress	CreateDBEndpointAddress	create	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeDBClusterPerformance	DescribeDBClusterPerformance	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:GrantAccountPrivilegeZonal	GrantAccountPrivilegeZonal	update	All Resource ``	None	None
polardb:DescribeDBClusterConnectivity	DescribeDBClusterConnectivity	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:DescribeDBInitializeVariable	DescribeDBInitializeVariable	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeAIDBClusterAttribute	DescribeAIDBClusterAttribute	get	All Resource ``	None	None
polardb:ModifyDBClusterResourceGroup	ModifyDBClusterResourceGroup	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:ModifyDBClusterVpc	ModifyDBClusterVpc	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeGlobalDatabaseNetwork	DescribeGlobalDatabaseNetwork	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ModifyDBNodeSccMode	ModifyDBNodeSccMode	update	*DBNode `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:DescribeApplications	DescribeApplications	get	All Resource ``	None	None
polardb:ModifyDBClusterMonitor	ModifyDBClusterMonitor	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CheckServiceLinkedRole	CheckServiceLinkedRole	none	All Resource ``	None	None
polardb:DescribePendingMaintenanceAction	DescribePendingMaintenanceAction	get	All Resource ``	None	None
polardb:DescribeRdsVSwitchs	DescribeRdsVSwitchs	get	All Resource ``	None	None
polardb:CloseDBClusterMigration	CloseDBClusterMigration	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeScheduleTasks	DescribeScheduleTasks	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:TransformDBClusterPayType	TransformDBClusterPayType	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ModifyAccountLockState	ModifyAccountLockState	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeSlowLogs	DescribeSlowLogs	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ModifyDBClusterServerlessConf	ModifyDBClusterServerlessConf	update	DBCluster `acs:polardb::{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeApplicationAttribute	DescribeApplicationAttribute	get	All Resource ``	None	None
polardb:DescribeRdsVpcs	DescribeRdsVpcs	get	DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/`	None	None
polardb:ResetGlobalDatabaseNetwork	ResetGlobalDatabaseNetwork	update	*GlobalDatabaseNetwork `acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}`	None	None
polardb:ResetAccountPassword	ResetAccountPassword	get	All Resource ``	None	None
polardb:ExecuteCrossCloudOpenAPI	ExecuteCrossCloudOpenAPI	none	All Resource ``	None	None
polardb:DescribeBackups	DescribeBackups	get	Backup `acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DBClusterId}` DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DeleteSQLRateLimitingRules	DeleteSQLRateLimitingRules	delete	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeUserEncryptionKeyList	DescribeUserEncryptionKeyList	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeModifyParameterLog	DescribeModifyParameterLog	none	All Resource ``	None	None
polardb:CheckAccountName	CheckAccountName	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CheckConnectionString	CheckConnectionString	get	All Resource ``	None	None
polardb:DeleteMaskingRules	DeleteMaskingRules	delete	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:DescribeAIDBClusterPerformance	DescribeAIDBClusterPerformance	get	All Resource ``	None	None
polardb:ModifyApplicationWhitelist	ModifyApplicationWhitelist	none	All Resource ``	None	None
polardb:DescribeNetworkChannel	DescribeNetworkChannel	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeAvailableCrossRegions	DescribeAvailableCrossRegions	get	DBCluster `acs:polardb::{#accountId}:{#resource-type}/*`	None	None
polardb:ModifyDBNodeHotReplicaMode	ModifyDBNodeHotReplicaMode	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:CreateApplication	CreateApplication	get	All Resource ``	None	None
polardb:DescribeDBLinks	DescribeDBLinks	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:AttachApplicationPolarFS	AttachApplicationPolarFS	none	All Resource ``	None	None
polardb:DescribeBackupPolicy	DescribeBackupPolicy	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CheckDBName	CheckDBName	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DeletePolarFsQuota	DeletePolarFsQuota	none	All Resource ``	None	None
polardb:UpgradeDBClusterVersionZonal	UpgradeDBClusterVersionZonal	update	All Resource ``	None	None
polardb:OpenAITask	OpenAITask	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:TagResources	TagResources	create	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:ModifyDBClusterArch	ModifyDBClusterArch	none	All Resource ``	None	None
polardb:DescribeResourcePackages	DescribeResourcePackages	get	All Resource ``	None	None
polardb:RevokeAccountPrivilegeZonal	RevokeAccountPrivilegeZonal	update	All Resource ``	None	None
polardb:DescribeAccounts	DescribeAccounts	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeVSwitchList	DescribeVSwitchList	none	All Resource ``	None	None
polardb:DescribeColdStorageInstance	DescribeColdStorageInstance	get	All Resource ``	None	None
polardb:DescribeDBClusterEndpointsZonal	DescribeDBClusterEndpointsZonal	get	All Resource ``	None	None
polardb:UntagResources	UntagResources	delete	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribePolarFsQuota	DescribePolarFsQuota	none	All Resource ``	None	None
polardb:DescribeDatabasesZonal	DescribeDatabasesZonal	list	All Resource ``	None	None
polardb:ModifyDBCluster	ModifyDBCluster	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}`	None	None
polardb:CreateStoragePlan	CreateStoragePlan	create	All Resource ``	None	None
polardb:DescribeDBClusterMigration	DescribeDBClusterMigration	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ModifyDBClusterSSL	ModifyDBClusterSSL	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeLocalAvailableRecoveryTime	DescribeLocalAvailableRecoveryTime	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeBackupLogs	DescribeBackupLogs	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeParameterGroups	DescribeParameterGroups	get	All Resource ``	None	None
polardb:UpgradeDBClusterVersion	UpgradeDBClusterVersion	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CreateBackup	CreateBackup	create	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:AddEncryptionDBRolePrivilege	AddEncryptionDBRolePrivilege	create	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeApplicationServerlessConf	DescribeApplicationServerlessConf	get	All Resource ``	None	None
polardb:CreateOrGetVirtualLicenseOrder	CreateOrGetVirtualLicenseOrder	create	All Resource ``	None	None
polardb:DescribeDBClusterMonitor	DescribeDBClusterMonitor	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeDBClusterProxy	DescribeDBClusterProxy	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:ModifyDBClusterAndNodesParameters	ModifyDBClusterAndNodesParameters	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ModifyDBClusterPrimaryZone	ModifyDBClusterPrimaryZone	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CancelActiveOperationTasks	CancelActiveOperationTasks	delete	All Resource ``	None	None
polardb:CreateDBClusterEndpoint	CreateDBClusterEndpoint	create	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:CreateDBCluster	CreateDBCluster	create	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	polardb:EncryptionRequired	None
polardb:ModifyAccountPasswordZonal	ModifyAccountPasswordZonal	update	All Resource ``	None	None
polardb:DeleteDatabaseZonal	DeleteDatabaseZonal	delete	All Resource ``	None	None
polardb:DeleteEncryptionDBRolePrivilege	DeleteEncryptionDBRolePrivilege	delete	All Resource ``	None	None
polardb:DescribeActiveOperationTasks	DescribeActiveOperationTasks	get	All Resource ``	None	None
polardb:GrantAccountPrivilege	GrantAccountPrivilege	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeAccountsZonal	DescribeAccountsZonal	list	All Resource ``	None	None
polardb:ModifyAIDBClusterDescription	ModifyAIDBClusterDescription	update	All Resource ``	None	None
polardb:RestartDBNode	RestartDBNode	update	*DBNode `acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}`	None	None
polardb:DescribeGlobalSecurityIPGroupRelation	DescribeGlobalSecurityIPGroupRelation	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:DescribeDBClusterParameters	DescribeDBClusterParameters	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeBackupRegions	DescribeBackupRegions	get	All Resource ``	None	None
polardb:CheckDBNameZonal	CheckDBNameZonal	get	All Resource ``	None	None
polardb:DescribeEncryptionDBSecret	DescribeEncryptionDBSecret	none	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:ModifyActiveOperationMaintainConf	ModifyActiveOperationMaintainConf	update	All Resource ``	None	None
polardb:CreateExtensions	CreateExtensions	create	All Resource ``	None	None
polardb:ModifyDBNodeConfig	ModifyDBNodeConfig	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeCrossCloudRegion	DescribeCrossCloudRegion	get	All Resource ``	None	None
polardb:DescribePolarFsAttribute	DescribePolarFsAttribute	get	All Resource ``	None	None
polardb:SwitchOverGlobalDatabaseNetwork	SwitchOverGlobalDatabaseNetwork	update	*GlobalDatabaseNetwork `acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}`	None	None
polardb:DescribeActivationCodeDetails	DescribeActivationCodeDetails	get	All Resource ``	None	None
polardb:DescribeTasks	DescribeTasks	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeDBClusterAccessWhitelist	DescribeDBClusterAccessWhitelist	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:ModifyDBClusterStoragePerformance	ModifyDBClusterStoragePerformance	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:RestoreTable	RestoreTable	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ResetAccount	ResetAccount	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DeleteExtensions	DeleteExtensions	delete	All Resource ``	None	None
polardb:EnableSQLRateLimitingRules	EnableSQLRateLimitingRules	update	All Resource ``	None	None
polardb:DeleteDBEndpointAddress	DeleteDBEndpointAddress	delete	*Endpoint `acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}`	None	None
polardb:DeleteApplication	DeleteApplication	delete	All Resource ``	None	None
polardb:DescribeBackupTasks	DescribeBackupTasks	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:SetPolarFsFileQuota	SetPolarFsFileQuota	none	All Resource ``	None	None
polardb:ModifyDBNodesClass	ModifyDBNodesClass	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:ModifyAutoRenewAttribute	ModifyAutoRenewAttribute	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ModifyDBNodeDescription	ModifyDBNodeDescription	update	All Resource ``	None	None
polardb:CreateApplicationEndpointAddress	CreateApplicationEndpointAddress	none	All Resource ``	None	None
polardb:ModifyDBClusterDeletion	ModifyDBClusterDeletion	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeDatabases	DescribeDatabases	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:ListTagResourcesForRegion	ListTagResourcesForRegion	get	DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/`	None	None
polardb:ModifyDBClusterTDE	ModifyDBClusterTDE	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:RestartDBLink	RestartDBLink	none	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:DescribeCrossCloudLevels	DescribeCrossCloudLevels	get	All Resource ``	None	None
polardb:ModifySQLRateLimitingRules	ModifySQLRateLimitingRules	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:CancelPolarFsFileQuota	CancelPolarFsFileQuota	none	All Resource ``	None	None
polardb:ModifyDBClusterMigration	ModifyDBClusterMigration	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeDBClusterServerlessConf	DescribeDBClusterServerlessConf	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DeleteAccountZonal	DeleteAccountZonal	delete	All Resource ``	None	None
polardb:DescribeLogBackupPolicy	DescribeLogBackupPolicy	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DeleteAINodes	DeleteAINodes	update	All Resource ``	None	None
polardb:ModifyLogBackupPolicy	ModifyLogBackupPolicy	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeVpcs	DescribeVpcs	get	All Resource ``	None	None
polardb:DescribeDBClusterAttribute	DescribeDBClusterAttribute	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:ModifyDBClusterAccessWhitelist	ModifyDBClusterAccessWhitelist	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CreateParameterGroup	CreateParameterGroup	create	All Resource ``	None	None
polardb:ModifyDBClusterAuditLogCollector	ModifyDBClusterAuditLogCollector	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeCrossCloudRegionMappingToAliyun	DescribeCrossCloudRegionMappingToAliyun	get	All Resource ``	None	None
polardb:ModifyGlobalDatabaseNetwork	ModifyGlobalDatabaseNetwork	update	*GlobalDatabaseNetwork `acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}`	None	None
polardb:ModifyDBClusterParameters	ModifyDBClusterParameters	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeDetachedBackups	DescribeDetachedBackups	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}`	None	None
polardb:ModifyGlobalSecurityIPGroup	ModifyGlobalSecurityIPGroup	update	All Resource ``	None	None
polardb:CancelCronJobPolicyServerless	CancelCronJobPolicyServerless	delete	All Resource ``	None	None
polardb:DescribePolarSQLCollectorPolicy	DescribePolarSQLCollectorPolicy	get	All Resource ``	None	None
polardb:AbortDBClusterMigration	AbortDBClusterMigration	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeExtensions	DescribeExtensions	get	All Resource ``	None	None
polardb:DeleteParameterGroup	DeleteParameterGroup	delete	All Resource ``	None	None
polardb:ModifyDBClusterMigrationEndpoint	ModifyDBClusterMigrationEndpoint	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeSQLRateLimitingRules	DescribeSQLRateLimitingRules	list	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeDBProxyPerformance	DescribeDBProxyPerformance	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ModifyFirewallRules	ModifyFirewallRules	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:ListTagResources	ListTagResources	get	DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/`	None	None
polardb:DescribeDBClustersZonal	DescribeDBClustersZonal	list	All Resource ``	None	None
polardb:CreateAccountZonal	CreateAccountZonal	create	All Resource ``	None	None
polardb:DescribeDBClusterEncryptionKey	DescribeDBClusterEncryptionKey	get	All Resource ``	None	None
polardb:DescribeDBLogFiles	DescribeDBLogFiles	list	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:ModifyDBDescriptionZonal	ModifyDBDescriptionZonal	update	All Resource ``	None	None
polardb:DescribeDasConfig	DescribeDasConfig	get	*DBCluster `acs:polardb:{#regionId}:{#AccountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribeLicenseOrderDetails	DescribeLicenseOrderDetails	get	All Resource ``	None	None
polardb:EnableFirewallRules	EnableFirewallRules	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:DescribeParameterTemplates	DescribeParameterTemplates	get	DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/`	None	None
polardb:DescribeEncryptionDBRolePrivilege	DescribeEncryptionDBRolePrivilege	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DeleteNetworkChannel	DeleteNetworkChannel	delete	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:DescribePendingMaintenanceActions	DescribePendingMaintenanceActions	get	All Resource ``	None	None
polardb:CreateNetworkChannel	CreateNetworkChannel	create	All Resource ``	None	None
polardb:DescribeAutoRenewAttribute	DescribeAutoRenewAttribute	list	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:ModifyDBNodeClass	ModifyDBNodeClass	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:ModifyEncryptionDBRolePrivilege	ModifyEncryptionDBRolePrivilege	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	polardb:EncryptionRequired	None
polardb:ModifyAccountDescriptionZonal	ModifyAccountDescriptionZonal	update	All Resource ``	None	None
polardb:DescribeDBClusterVersionZonal	DescribeDBClusterVersionZonal	get	All Resource ``	None	None
polardb:AddPolarFsQuota	AddPolarFsQuota	none	All Resource ``	None	None
polardb:FailoverDBCluster	FailoverDBCluster	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ModifyApplicationServerlessConf	ModifyApplicationServerlessConf	update	All Resource ``	None	None
polardb:CreateAINodes	CreateAINodes	create	All Resource ``	None	None
polardb:ModifyDBClusterEndpointZonal	ModifyDBClusterEndpointZonal	update	All Resource ``	None	None
polardb:DeleteDBNodes	DeleteDBNodes	delete	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeAITaskStatus	DescribeAITaskStatus	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DescribeDBClusterEndpoints	DescribeDBClusterEndpoints	get	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CheckAccountNameZonal	CheckAccountNameZonal	get	All Resource ``	None	None
polardb:ModifyAccountDescription	ModifyAccountDescription	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:ModifyActiveOperationTasks	ModifyActiveOperationTasks	update	All Resource ``	None	None
polardb:DescribeClassList	DescribeClassList	get	All Resource ``	None	None
polardb:DescribeDBMiniEngineVersions	DescribeDBMiniEngineVersions	get	All Resource ``	None	None
polardb:DescribeDBNodesParameters	DescribeDBNodesParameters	get	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:EnableDBClusterOrca	EnableDBClusterOrca	none	All Resource ``	None	None
polardb:DeleteGlobalSecurityIPGroup	DeleteGlobalSecurityIPGroup	delete	All Resource ``	None	None
polardb:DeleteAIDBCluster	DeleteAIDBCluster	delete	All Resource ``	None	None
polardb:DescribeDbClusterAttributeZonal	DescribeDbClusterAttributeZonal	get	All Resource ``	None	None
polardb:ModifyDBClusterDescription	ModifyDBClusterDescription	update	*dbcluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DeleteFirewallRules	DeleteFirewallRules	delete	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:CreateGlobalDataNetwork	CreateGlobalDataNetwork	create	All Resource ``	None	None
polardb:CreateGlobalDatabaseNetwork	CreateGlobalDatabaseNetwork	create	*GlobalDatabaseNetwork `acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}`	None	None
polardb:ModifyGlobalSecurityIPGroupRelation	ModifyGlobalSecurityIPGroupRelation	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:ListOrders	ListOrders	list	All Resource ``	None	None
polardb:ModifyApplicationParameter	ModifyApplicationParameter	none	All Resource ``	None	None
polardb:ReactivateDBClusterBackup	ReactivateDBClusterBackup	none	All Resource ``	None	None
polardb:ModifyDBNodesParameters	ModifyDBNodesParameters	update	*DBCluster `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:DeleteDBLink	DeleteDBLink	delete	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId}`	None	None
polardb:RemoveDBClusterFromGDN	RemoveDBClusterFromGDN	delete	*DBCluster `acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId}`	None	None
polardb:DeleteGlobalDataNetwork	DeleteGlobalDataNetwork	delete	All Resource ``	None	None
polardb:DescribeHALogs	DescribeHALogs	get	All Resource ``	None	None
polardb:DescribeHistoryTasks	DescribeHistoryTasks	get	All Resource ``	None	None
polardb:CreateColdStorageInstance	CreateColdStorageInstance	create	*ColdStorageInstance `acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}`	None	None
polardb:CreateActivationCode	CreateActivationCode	create	All Resource ``	None	None
polardb:CreateServiceLinkedRole	CreateServiceLinkedRole	none	All Resource ``	None	None
polardb:GenerateUpgradeReportForSyncClone	GenerateUpgradeReportForSyncClone	create	All Resource ``	None	None

Resource

The following table lists the resources defined by PolarDB. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
DBCluster	acs:polardb:{#regionId}:{#accountId}:dbcluster/{#DbClusterId} acs:polardb::{#accountId}:{#resource-type}/{#resource-id} acs:polardb:{#regionId}:{#accountId}:{#resource-type}/ acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id} acs:polardb::{#accountId}:dbcluster/{#dbclusterId} acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DBClusterId} acs:polardb::{#accountId}:{#resource-type}/*
dbcluster	acs:polardb:{#regionId}:{#accountId}:dbcluster/{#dbclusterId} acs:polardb:{#regionId}:{#accountId}:dbcluster/* acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}
GlobalDatabaseNetwork	acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}
ParameterGroup	acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}
Endpoint	acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId}
DBNode	acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id} acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DbClusterId} acs:polardb:{#regionId}:{#accountId}:dbnode/{#DBNodeId}
Account	acs:polardb:*:{#accountId}:account/{#AccountId}
Backup	acs:polardb:{#regionId}:{#accountId}:DBCluster/{#DBClusterId} acs:polardb:{#regionId}:{#accountId}:backup/{#DBClusterId}
ColdStorageInstance	acs:polardb:*:{#accountId}:coldstorageinstance/{#OssClusterId} acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}
DBClusterParameter	acs:polardb:*:{#accountId}:dbclusterparameter/{#ParameterGroupId}

Condition

The following table lists the product-level condition keys defined by PolarDB. You can also use Alibaba Cloud's Common condition keys. Specify these keys in the Condition element of RAM policy statements to define granular authorization rules. In the condition key, specify the condition values in the Condition_value element of the policy.

Each condition key has a specific data type, such as string, number, Boolean, or IP address. The data type determines which conditional operators can be used to compare the request values against policy values. You must specify the conditional operators compatible with the data type of the condition key. Mismatched operators will invalidate the policy. See Condition operator for valid combinations.

Condition key	Description	Data type
polardb:EncryptionRequired	Whether TDE needs to be enabled during creation	Boolean

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: