In the RAM console, you can authorize RAM users to call the following operations on an ApsaraDB for MongoDB resource.
| Action | CreateDBInstance | ModifyNodeSpecBatch | ModifySecurityGroupConfiguration |
| DeleteDBInstance | createNodeBatch | CheckCloudResourceAuthorized | |
| CreateShardingDBInstance | UpgradeDBInstanceEngineVersion | DescribeUserEncryptionKeyList | |
| ModifyNodeSpec | UpgradeDBInstanceKernelVersion | DescribeDBInstanceEncryptionKey | |
| RestartDBInstance | SwitchDBInstanceHA | DescribeDBInstanceTDEInfo | |
| ModifyDBInstanceDescription | DestroyInstance | ModifyDBInstanceTDE | |
| DescribeReplicaSetRole | DescribeDBInstancesOverview | ModifyDBInstanceSSL | |
| ModifyDBInstanceNetworkType | DescribeAvailableEngineVersion | DescribeDBInstanceSSL | |
| DescribeAccounts | DescribeRoleZoneInfo | DescribeAuditPolicy | |
| DescribeSecurityIps | DescribeInstanceAutoRenewalAttribute | ModifyAuditLogFilter | |
| DescribeAuditRecords | DescribeActiveOperationTaskCount | DescribeAuditLogFilter | |
| DescribeBackupPolicy | DescribeActiveOperationTaskType | ModifyAuditPolicy | |
| CreateBackup | EvaluateResource | DescribeMongoDBLogConfig | |
| RestoreDBInstance | DescribeAvailableResource | DescribeSlowLogRecords | |
| DescribeDBInstances | ModifyResourceGroup | DescribeErrorLogRecords | |
| ModifyDBInstanceSpec | MigrateToOtherZone | DescribeRunningLogRecords | |
| RenewDBInstance | MigrateAvailableZone | ModifyDBInstanceMonitor | |
| DeleteNode | AllocatePublicNetworkAddress | DescribeDBInstanceMonitor | |
| CreateNode | ReleasePublicNetworkAddress | DescribeParameterModificationHistory | |
| ModifyDBInstanceMaintainTime | ModifyInstanceVpcAuthMode | DescribeParameters | |
| DescribeDBInstanceAttribute | ModifyDBInstanceConnectionString | CheckRecoveryCondition | |
| DescribeShardingNetworkAddress | ReleaseNodePrivateNetworkAddress | ModifyInstanceAutoRenewalAttribute | |
| ModifyDBInstanceNetExpireTime | AllocateNodePrivateNetworkAddress | TransformToPrePaid | |
| ResetAccountPassword | TagResources | RenewDBInstance | |
| ModifySecurityIps | ListTagResources | DescribeRenewalPrice | |
| DescribeAuditFiles | DescribeTags | DescribeDBInstancePerformance | |
| ModifyBackupPolicy | UntagResources | DescribeSecurityGroupConfiguration | |
| DescribeBackups | ModifyAccountDescription | - |
For the DescribeDBInstances operation, you must grant the permissions to call the operation on all instances. No authentication is required for the DescribeRegions operation.