All Products
Search
Document Center

ApsaraDB RDS:ModifyPGHbaConfig

Last Updated:Mar 13, 2024

Modifies the pg_hba.conf file of an ApsaraDB RDS for PostgreSQL instance.

Operation description

Supported database engines

RDS PostgreSQL

References

Note : Before you call this operation, carefully read the following documentation. Make sure that you fully understand the prerequisites and impacts for calling this operation.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

  • Operation: the value that you can use in the Action element to specify the operation on a resource.
  • Access level: the access level of each operation. The levels are read, write, and list.
  • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
    • The required resource types are displayed in bold characters.
    • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
  • Condition Key: the condition key that is defined by the cloud service.
  • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
OperationAccess levelResource typeCondition keyAssociated operation
rds:ModifyPGHbaConfigWrite
  • DBInstance
    acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
  • rds:ResourceTag
none

Request parameters

ParameterTypeRequiredDescriptionExample
ClientTokenstringNo

A reserved parameter. You do not need to specify this parameter.

1
DBInstanceIdstringYes

The instance ID. You can call the DescribeDBInstances operation to query the instance ID.

pgm-bp1lymyn1v3i****
OpsTypestringYes

The method that you use to modify the pg_hba.conf file. Valid values:

  • add: adds one or more records. If you use this method, make sure that the value of the PriorityId parameter for each new record is different from the value of the PriorityId parameter for any existing record.
  • delete: deletes one or more records. If you use this method, the record that corresponds to the specified value of the PriorityId parameter is deleted from the pg_hba.conf file.
  • modify: modifies one or more records. If you use this method, the record that corresponds to the specified value of the PriorityId parameter is modified.
  • update: overwrites the existing configuration in the pg_hba.conf file by using the new configuration.
add
HbaItemobject []Yes

An array that consists of the details of the AD domain services.

TypestringYes

The connection type.

Valid values:

  • host: The record matches TCP/IP connections, including SSL connections and non-SSL connections.
  • hostssl: The record matches only TCP/IP connections that are established over SSL.
  • hostnossl: The record matches only TCP/IP connections that are not established over SSL connections.
Note You can set this parameter to hostssl only when SSL encryption is enabled for the instance. For more information, see Configure SSL encryption for an ApsaraDB RDS for PostgreSQL instance.
host
MaskstringNo

The mask of the IP address. If the value of the Address parameter is an IP address, you can use this parameter to specify the mask of the IP address.

0
DatabasestringYes

The name of the database. If you set this parameter to all, the specified users are allowed to access all databases on the instance.

If you specify multiple entries, separate the entries with commas (,).

all
PriorityIdintegerYes

The priority of the record. If you set this parameter to 0, the record has the highest priority. Valid values: 0 to 10000.

This parameter is used to identify each record. When you add a record, the value of the PriorityId parameter for the new record must be different from the value of the PriorityId parameter of any existing record. When you modify or delete a record, you must also modify or delete the value of the PriorityId parameter for this record.

2
AddressstringYes

The IP addresses from which the specified users can access the specified databases. If you set this parameter to 0.0.0.0/0, the specified users are allowed to access the specified databases from all IP addresses.

0.0.0.0/0
UserstringYes

The user who is allowed to access the specified databases. You must specify the user that is used to log on to the RDS instance. If you specify multiple entries, separate the entries with commas (,).

ldapuser
MethodstringYes

The authentication method. Valid values:

  • trust
  • reject
  • scram-sha-256
  • md5
  • password
  • gss
  • sspi
  • ldap
  • radius
  • cert
  • pam
ldap
OptionstringNo

The options of the authentication method. In this topic, LDAP is used as an example. You must configure this parameter. For more information, see Authentication Methods.

ldapserver=The private IP address of the ECS instance ldapbasedn="CN=Users,DC=pgsqldomain,DC=net" ldapbinddn="CN=The username of the administrator user of the AD domain controller, CN=Users,DC=pgsqldomain,DC=net" ldapbindpasswd="The password of the administrator user of the AD domain controller" ldapsearchattribute="sAMAccountName"

Response parameters

ParameterTypeDescriptionExample
object

The response parameters.

RequestIdstring

The ID of the request.

458E0781-C46C-55F5-A0E5-1DD284B28A3F

Examples

Sample success responses

JSONformat

{
  "RequestId": "458E0781-C46C-55F5-A0E5-1DD284B28A3F"
}

Error codes

HTTP status codeError codeError messageDescription
400HbaItem.InvalidTypeSpecified hba item type is invalid.-
400HbaItem.InvalidMethodSpecified hba item auth method is invalid.The specified HBA identity authentication method is invalid.
400HbaItem.InvalidIPMaskSpecified hba item ip mask is invalid.-
400HbaItem.InvalidPrioritySpecified hba item priorityId is out of range or duplicate.-
400HbaItemOpsType.InvalidSpecified hba opsType is invalid.-
400InvalidConfigValueThe ConfigValue is not valid-
400MinorVersionNotSupportThe current database minor version does not support the operation.The operation is not supported for the minor engine version of the instance.
400InvalidDBInstanceName.NotFoundThe specified DB instance name does not exist.The instance name does not exist.
400IncorrectDBInstanceTypeCurrent DB instance type does not support this operation.The operation failed. The RDS instance is not in a ready state.
403HbaItemPriorityIdAlreadyExistSpecified hba item priorityId is exist.-
403IncorrectDBInstanceStateCurrent DB instance state does not support this operation.-
404HbaItemPriorityIdNotFoundSpecified hba item priorityId is not found.-
404IncorrectDBInstanceLockModeCurrent DB instance lock mode does not support this operation.The operation failed. The RDS instance is locked.

For a list of error codes, visit the Service error codes.

Change history

Change timeSummary of changesOperation
2022-02-14The Error code has changedsee changesets
Change itemChange content
Error CodesThe Error code has changed.
    Error Codes 400 change
    delete Error Codes: 403
    delete Error Codes: 404