AnalyticDB:RAM users and permissions

Use cases

In this case, you can create RAM users and grant them the required permissions. Then, your users can access or manage your AnalyticDB for MySQL clusters through RAM users.

Procedure

Create a RAM user

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User. Enter a Logon Name and a Display Name.

   Note

   Click Add User to create multiple RAM users at a time.

4. In the Access Mode section, select Console Access or Open API Access.

   • Console Access: allows you to configure basic logon security settings, including auto-generated or custom logon passwords, whether to require a password reset upon next logon, and whether to enable multi-factor authentication (MFA).

   • Open API Access: automatically creates an AccessKey pair for the RAM user. The RAM user can then use development tools to access AnalyticDB for MySQL clusters.

   For account security, we recommend that you select only one access mode for each RAM user. This prevents a RAM user from accessing your AnalyticDB for MySQL clusters through AccessKey pairs after the user leaves your organization.

5. Click OK to create the RAM user.

Grant permissions to a RAM user

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Add Permissions on the right side of the target RAM user.

4. On the Add Permissions page, set the permission type to System Policy. Enter a policy name to find the target policy and click it to add it to the Selected section.

   Warning

   Do not grant excessive permissions. Over-privileged operators can perform arbitrary operations, which may cause security risks or losses.

   Policy descriptions:

   • Enterprise Edition, Basic Edition, and Data Lakehouse Edition cluster permissions:

     • AliyunADBReadOnlyAccess: grants read-only access to Enterprise Edition, Basic Edition, and Data Lakehouse Edition clusters.

     • AliyunADBFullAccess: grants permissions to manage Enterprise Edition, Basic Edition, and Data Lakehouse Edition clusters.

     • AliyunADBDeveloperAccess: grants developer permissions for Enterprise Edition, Basic Edition, and Data Lakehouse Edition clusters. Compared with the AliyunADBFullAccess policy, AliyunADBDeveloperAccess does not include permissions to create, modify, or delete clusters, or to bind RAM users.

   • Data Warehouse Edition cluster permissions:

     • AliyunADBReadOnlyAccess: grants read-only access to Data Warehouse Edition clusters.

     • AliyunADBFullAccess: grants permissions to manage Data Warehouse Edition clusters.

5. Click OK to grant permissions to the RAM user.

   After you grant the required permissions to a RAM user, the RAM user can access or manage your AnalyticDB for MySQL clusters.

Create a custom policy

If you need to grant fine-grained instance-level operation permissions to RAM users, you must create custom policies in RAM.

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Permissions > Policies.

3. Click Create Policy. This topic uses the creation of a management policy for AnalyticDB for MySQL clusters as an example.

4. Set the configuration mode to Script.

5. Enter the configuration script. The following examples show the script content.

   Manage the permissions on the am-xxx instance:

   {
       "Version": "1",
       "Statement": [
           {
               "Action": ["adb:DescribeDBClusters", "adb:ListTagResources"],
               "Resource": "acs:adb:*:*:dbcluster/*",
               "Effect": "Allow"
           },
           {
               "Action": "adb:*",
               "Resource": ["acs:adb:*:*:dbcluster/am-xxx"],
               "Effect": "Allow"
           }
       ]
   }

   Read-only permissions on the am-xxx instance:

   {
       "Version": "1",
       "Statement": [
           {
               "Action": ["adb:DescribeDBClusters", "adb:ListTagResources"],
               "Resource": "acs:adb:*:*:dbcluster/*",
               "Effect": "Allow"
           },
           {
               "Action": "adb:Describe*",
               "Resource": ["acs:adb:*:*:dbcluster/am-xxx"],
               "Effect": "Allow"
           }
       ]
   }

   If a RAM user needs to manage or have read-only access to multiple clusters, add the corresponding cluster IDs to the "Resource": ["acs:adb:*:*:dbcluster/am-xxx"] field in the script. For example, "Resource": ["acs:adb:*:*:dbcluster/am-xxx", "acs:adb:*:*:dbcluster/am-yyy"].

   After the custom policy is created, attach it to the corresponding RAM user.

6. Click OK.

7. Enter a policy name and description, and then click OK.

References

• When you use AnalyticDB for MySQL Enterprise Edition, Basic Edition, and Data Lakehouse Edition, you can bind a RAM user to a database standard account to perform database development directly in the SQL editor or Spark editor of the AnalyticDB for MySQL console.

• When a RAM user no longer needs certain permissions or leaves your organization, you can remove the permissions or disable or delete the RAM user.