All Products
Search

This Product

    ApsaraDB RDS:ModifyPGHbaConfig

    Document Center

    ApsaraDB RDS:ModifyPGHbaConfig

    Last Updated:Nov 07, 2024

    Modifies the pg_hba.conf file of an ApsaraDB RDS for PostgreSQL instance.

    Operation description

    Supported database engines

    RDS PostgreSQL

    References

    Note : Before you call this operation, carefully read the following documentation. Make sure that you fully understand the prerequisites and impacts for calling this operation.

    Debugging

    You can run this interface directly in OpenAPI Explorer, saving you the trouble of calculating signatures. After running successfully, OpenAPI Explorer can automatically generate SDK code samples.

    Authorization information

    The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

    • Operation: the value that you can use in the Action element to specify the operation on a resource.
    • Access level: the access level of each operation. The levels are read, write, and list.
    • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
      • The required resource types are displayed in bold characters.
      • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
    • Condition Key: the condition key that is defined by the cloud service.
    • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
    OperationAccess levelResource typeCondition keyAssociated operation
    rds:ModifyPGHbaConfigupdate
    • DBInstance
      acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
    • rds:ResourceTag
    		none

    Request parameters

    ParameterTypeRequiredDescriptionExample
    ClientTokenstringNo

    A reserved parameter. You do not need to specify this parameter.

    		1
    DBInstanceIdstringYes

    The instance ID. You can call the DescribeDBInstances operation to query the instance ID.

    		pgm-bp1lymyn1v3i****
    OpsTypestringYes

    The method that you use to modify the pg_hba.conf file. Valid values:

    • add: adds one or more records. If you use this method, make sure that the value of the PriorityId parameter for each new record is different from the value of the PriorityId parameter for any existing record.
    • delete: deletes one or more records. If you use this method, the record that corresponds to the specified value of the PriorityId parameter is deleted from the pg_hba.conf file.
    • modify: modifies one or more records. If you use this method, the record that corresponds to the specified value of the PriorityId parameter is modified.
    • update: overwrites the existing configuration in the pg_hba.conf file by using the new configuration.
    		add
    HbaItemarray<object>Yes

    An array that consists of the details of the AD domain services.

    objectYes
    TypestringYes

    The connection type.

    Valid values:

    • host: The record matches TCP/IP connections, including SSL connections and non-SSL connections.
    • hostssl: The record matches only TCP/IP connections that are established over SSL.
    • hostnossl: The record matches only TCP/IP connections that are not established over SSL connections.
    Note You can set this parameter to hostssl only when SSL encryption is enabled for the instance. For more information, see Configure SSL encryption for an ApsaraDB RDS for PostgreSQL instance.
    		host
    MaskstringNo

    The mask of the IP address. If the value of the Address parameter is an IP address, you can use this parameter to specify the mask of the IP address.

    		0
    DatabasestringYes

    The name of the database. If you set this parameter to all, the specified users are allowed to access all databases on the instance.

    If you specify multiple entries, separate the entries with commas (,).

    		all
    PriorityIdintegerYes

    The priority of the record. If you set this parameter to 0, the record has the highest priority. Valid values: 0 to 10000.

    This parameter is used to identify each record. When you add a record, the value of the PriorityId parameter for the new record must be different from the value of the PriorityId parameter of any existing record. When you modify or delete a record, you must also modify or delete the value of the PriorityId parameter for this record.

    		2
    AddressstringYes

    The IP addresses from which the specified users can access the specified databases. If you set this parameter to 0.0.0.0/0, the specified users are allowed to access the specified databases from all IP addresses.

    		0.0.0.0/0
    UserstringYes

    The user who is allowed to access the specified databases. You must specify the user that is used to log on to the RDS instance. If you specify multiple entries, separate the entries with commas (,).

    		ldapuser
    MethodstringYes

    The authentication method. Valid values:

    • trust
    • reject
    • scram-sha-256
    • md5
    • password
    • gss
    • sspi
    • ldap
    • radius
    • cert
    • pam
    		ldap
    OptionstringNo

    The options of the authentication method. In this topic, LDAP is used as an example. You must configure this parameter. For more information, see Authentication Methods.

    		ldapserver=The private IP address of the ECS instance ldapbasedn="CN=Users,DC=pgsqldomain,DC=net" ldapbinddn="CN=The username of the administrator user of the AD domain controller, CN=Users,DC=pgsqldomain,DC=net" ldapbindpasswd="The password of the administrator user of the AD domain controller" ldapsearchattribute="sAMAccountName"

    Response parameters

    ParameterTypeDescriptionExample
    object

    The response parameters.

    RequestIdstring

    The ID of the request.

    		458E0781-C46C-55F5-A0E5-1DD284B28A3F

    Examples

    Sample success responses

    JSONformat

    {
  "RequestId": "458E0781-C46C-55F5-A0E5-1DD284B28A3F"
}

    Error codes

    HTTP status codeError codeError messageDescription
    400HbaItem.InvalidTypeSpecified hba item type is invalid.-
    400HbaItem.InvalidMethodSpecified hba item auth method is invalid.The specified HBA identity authentication method is invalid.
    400HbaItem.InvalidIPMaskSpecified hba item ip mask is invalid.-
    400HbaItem.InvalidPrioritySpecified hba item priorityId is out of range or duplicate.-
    400HbaItemOpsType.InvalidSpecified hba opsType is invalid.-
    400InvalidConfigValueThe ConfigValue is not valid-
    400MinorVersionNotSupportThe current database minor version does not support the operation.The operation is not supported for the minor engine version of the instance.
    400InvalidDBInstanceName.NotFoundThe specified DB instance name does not exist.The instance name does not exist.
    400IncorrectDBInstanceTypeCurrent DB instance type does not support this operation.The operation failed. The RDS instance is not in a ready state.
    403HbaItemPriorityIdAlreadyExistSpecified hba item priorityId is exist.-
    403IncorrectDBInstanceStateCurrent DB instance state does not support this operation.-
    404HbaItemPriorityIdNotFoundSpecified hba item priorityId is not found.-
    404IncorrectDBInstanceLockModeCurrent DB instance lock mode does not support this operation.The operation failed. The RDS instance is locked.

    For a list of error codes, visit the Service error codes.

    Change history

    Change timeSummary of changesOperation
    2022-02-14The Error code has changedView Change Details