All Products
Search
Document Center

ApsaraDB RDS:RAM authorization

Last Updated:Jun 01, 2023
Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.
This topic describes the elements, such as Action, Resource, and Condition, which are defined by RDS. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate RDS is rds. You can grant permissions on RDS at the RESOURCE.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}
The following list describes the fields in the policy:
  • Effect: specifies the authorization effect. Valid values: Allow, Deny.
  • Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
  • Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
  • Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
    • Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
    • Condition_key: specifies the condition keys.
    • Condition_value: specifies the condition values.

Action

RDS defines the values that you can use in the Action element of a policy statement. The following table describes the values.
  • Operation: the value that you can use in the Action element to specify the operation on a resource.
  • API operation: the API operation that you can call to perform the operation.
  • Access level: the access level of each operation. The levels are read, write, and list.
  • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
    • The required resource types are displayed in bold characters.
    • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
  • Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
  • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
ActionsAPI operationAccess levelResource typeCondition keyAssociated operation
rds:ActivateMigrationTargetInstanceActivateMigrationTargetInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:AddTagsToResourceAddTagsToResourceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:AllocateInstancePublicConnectionAllocateInstancePublicConnectionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:AllocateReadWriteSplittingConnectionAllocateReadWriteSplittingConnectionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CalculateDBInstanceWeightCalculateDBInstanceWeightWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CancelImportCancelImportWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:CheckAccountNameAvailableCheckAccountNameAvailableRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CheckCloudResourceAuthorizedCheckCloudResourceAuthorizedRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CheckCreateDdrDBInstanceCheckCreateDdrDBInstanceRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:CheckDBNameAvailableCheckDBNameAvailableRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CheckInstanceExistCheckInstanceExistRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CheckServiceLinkedRoleCheckServiceLinkedRoleRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
DBInstance
acs:rds:*:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:CloneDBInstanceCloneDBInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CloneParameterGroupCloneParameterGroupWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
NoneNone
rds:ConfirmNotifyConfirmNotifyWrite
NoneNone
rds:CopyDatabaseCopyDatabaseWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CopyDatabaseBetweenInstancesCopyDatabaseBetweenInstancesWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
NoneNone
rds:CreateAccountCreateAccountWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CreateBackupCreateBackupWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CreateCloudMigrationPrecheckTaskCreateCloudMigrationPrecheckTaskRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CreateCloudMigrationTaskCreateCloudMigrationTaskWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CreateDBInstanceCreateDBInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/*
rds:ResourceTag
None
rds:CreateDBInstanceEndpointCreateDBInstanceEndpointWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
rds:ResourceTag
None
rds:CreateDBInstanceEndpointAddressCreateDBInstanceEndpointAddressWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
rds:ResourceTag
None
rds:CreateDBProxyEndpointAddressCreateDBProxyEndpointAddressWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:CreateDatabaseCreateDatabaseWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CreateDdrInstanceCreateDdrInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/*
NoneNone
rds:CreateDiagnosticReportCreateDiagnosticReportWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:CreateGADInstanceCreateGADInstanceWrite
All Resources
acs:rds::{#accountId}:*
NoneNone
rds:CreateGadInstanceMemberCreateGadInstanceMemberWrite
All Resources
acs:rds::{#accountId}:*
NoneNone
rds:CreateMigrateTaskCreateMigrateTaskWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CreateOnlineDatabaseTaskCreateOnlineDatabaseTaskWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CreateParameterGroupCreateParameterGroupWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
NoneNone
rds:CreateReadOnlyDBInstanceCreateReadOnlyDBInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:CreateServiceLinkedRoleCreateServiceLinkedRoleWrite
NoneNone
rds:CreateTempDBInstanceCreateTempDBInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DeleteAccountDeleteAccountWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DeleteBackupDeleteBackupWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DeleteBackupFileDeleteBackupFileWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DeleteDBInstanceDeleteDBInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DeleteDBInstanceEndpointDeleteDBInstanceEndpointWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/{#DBInstanceId}
rds:ResourceTag
None
rds:DeleteDBInstanceEndpointAddressDeleteDBInstanceEndpointAddressWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/{#DBInstanceId}
rds:ResourceTag
None
rds:DeleteDBProxyEndpointAddressDeleteDBProxyEndpointAddressWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DeleteDatabaseDeleteDatabaseWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DeleteGadInstanceDeleteGadInstanceWrite
All Resources
acs:rds::{#accountId}:*
NoneNone
rds:DeleteUserBackupFileDeleteUserBackupFileWrite
BackupFile
acs:rds:*:{#accountId}:backupfile/{#BackupId}
NoneNone
rds:DescribeADInfoDescribeADInfoRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DescribeAccountsDescribeAccountsRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeActionEventPolicyDescribeActionEventPolicyRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
NoneNone
rds:DescribeAnalyticdbByPrimaryDBInstanceDescribeAnalyticdbByPrimaryDBInstanceRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeAvailableClassesDescribeAvailableClassesRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/*
rds:ResourceTag
None
rds:DescribeAvailableCrossRegionDescribeAvailableCrossRegionRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
NoneNone
rds:DescribeAvailableMetricsDescribeAvailableMetricsRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeAvailableRecoveryTimeDescribeAvailableRecoveryTimeRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
NoneNone
rds:DescribeAvailableZonesDescribeAvailableZonesRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/*
NoneNone
rds:DescribeBackupDatabaseDescribeBackupDatabaseRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DescribeBackupPolicyDescribeBackupPolicyRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeBackupTasksDescribeBackupTasksRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeBackupsDescribeBackupsRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeBinlogFilesDescribeBinlogFilesRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeCharacterSetNameDescribeCharacterSetNameRead
NoneNone
rds:DescribeCloudMigrationPrecheckResultDescribeCloudMigrationPrecheckResultRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeCrossBackupMetaListDescribeCrossBackupMetaListRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
NoneNone
rds:DescribeCrossRegionBackupDBInstanceDescribeCrossRegionBackupDBInstanceRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
rds:ResourceTag
None
rds:DescribeCrossRegionBackupsDescribeCrossRegionBackupsRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeCrossRegionLogBackupFilesDescribeCrossRegionLogBackupFilesRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceAttributeDescribeDBInstanceAttributeRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceByTagsDescribeDBInstanceByTagsRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceDetailDescribeDBInstanceDetailRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DescribeDBInstanceEncryptionKeyDescribeDBInstanceEncryptionKeyRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceEndpointsDescribeDBInstanceEndpointsRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/{#DBInstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceHAConfigDescribeDBInstanceHAConfigRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceIPArrayListDescribeDBInstanceIPArrayListRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceIpHostnameDescribeDBInstanceIpHostnameRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceMetricsDescribeDBInstanceMetricsRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceMonitorDescribeDBInstanceMonitorRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceNetInfoDescribeDBInstanceNetInfoRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceNetInfoForChannelDescribeDBInstanceNetInfoForChannelRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstancePerformanceDescribeDBInstancePerformanceRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceProxyConfigurationDescribeDBInstanceProxyConfigurationRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceSSLDescribeDBInstanceSSLRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstanceTDEDescribeDBInstanceTDERead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstancesDescribeDBInstancesRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstancesAsCsvDescribeDBInstancesAsCsvRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstancesByExpireTimeDescribeDBInstancesByExpireTimeRead
All Resources
acs:rds:*:*:*
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstancesByPerformanceDescribeDBInstancesByPerformanceRead
All Resources
acs:rds:*:*:*
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBInstancesForCloneDescribeDBInstancesForCloneRead
NoneNone
rds:DescribeDBMiniEngineVersionsDescribeDBMiniEngineVersionsRead
NoneNone
rds:DescribeDBProxyDescribeDBProxyRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBProxyEndpointDescribeDBProxyEndpointRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDBProxyPerformanceDescribeDBProxyPerformanceRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDTCSecurityIpHostsForSQLServerDescribeDTCSecurityIpHostsForSQLServerRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDatabasesDescribeDatabasesRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeDedicatedHostGroupsDescribeDedicatedHostGroupsRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DescribeDedicatedHostsDescribeDedicatedHostsRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
NoneNone
rds:DescribeDetachedBackupsDescribeDetachedBackupsRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
NoneNone
rds:DescribeDiagnosticReportListDescribeDiagnosticReportListRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DescribeErrorLogsDescribeErrorLogsRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeEventsDescribeEventsRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DescribeGadInstancesDescribeGadInstancesList
All Resources
acs:rds::{#accountId}:*
NoneNone
rds:DescribeHADiagnoseConfigDescribeHADiagnoseConfigRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeHASwitchConfigDescribeHASwitchConfigRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeInstanceAutoRenewalAttributeDescribeInstanceAutoRenewalAttributeRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeInstanceCrossBackupPolicyDescribeInstanceCrossBackupPolicyRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeInstanceKeywordsDescribeInstanceKeywordsRead
NoneNone
rds:DescribeLocalAvailableRecoveryTimeDescribeLocalAvailableRecoveryTimeRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeLogBackupFilesDescribeLogBackupFilesRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeMetaListDescribeMetaListRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeMigrateTaskByIdDescribeMigrateTaskByIdRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeMigrateTasksDescribeMigrateTasksRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeModifyParameterLogDescribeModifyParameterLogRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeOssDownloadsDescribeOssDownloadsRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeParameterGroupDescribeParameterGroupRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DescribeParameterGroupsDescribeParameterGroupsRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
ResourceOwner
None
rds:DescribeParametersDescribeParametersRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeRdsResourceSettingsDescribeRdsResourceSettingsRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DescribeReadDBInstanceDelayDescribeReadDBInstanceDelayRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
NoneNone
rds:DescribeRenewalPriceDescribeRenewalPriceRead
NoneNone
rds:DescribeResourceUsageDescribeResourceUsageRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeSQLCollectorPolicyDescribeSQLCollectorPolicyRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeSQLCollectorRetentionDescribeSQLCollectorRetentionRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:DescribeSQLLogFilesDescribeSQLLogFilesRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeSQLLogRecordsDescribeSQLLogRecordsRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeSQLLogReportListDescribeSQLLogReportListRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeSecurityGroupConfigurationDescribeSecurityGroupConfigurationRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeSlowLogRecordsDescribeSlowLogRecordsRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeSlowLogsDescribeSlowLogsRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeTagsDescribeTagsRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeTasksDescribeTasksRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeUpgradeMajorVersionPrecheckTaskDescribeUpgradeMajorVersionPrecheckTaskRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DescribeUpgradeMajorVersionTasksDescribeUpgradeMajorVersionTasksRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DestroyDBInstanceDestroyDBInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:DetachGadInstanceMemberDetachGadInstanceMemberWrite
All Resources
acs:rds::{#accountId}:*
NoneNone
rds:GetDBInstanceTopologyGetDBInstanceTopologyRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:GetDbProxyInstanceSslGetDbProxyInstanceSslWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:GrantAccountPrivilegeGrantAccountPrivilegeWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:GrantOperatorPermissionGrantOperatorPermissionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ImportDatabaseBetweenInstancesImportDatabaseBetweenInstancesWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:ImportUserBackupFileImportUserBackupFileRead
NoneNone
rds:ListClassesListClassesRead
NoneNone
rds:ListTagResourcesListTagResourcesRead
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ListUserBackupFilesListUserBackupFilesRead
NoneNone
rds:LockAccountLockAccountWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:MigrateDBInstanceMigrateDBInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:MigrateSecurityIPModeMigrateSecurityIPModeWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:MigrateToOtherZoneMigrateToOtherZoneWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyAccountDescriptionModifyAccountDescriptionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyActionEventPolicyModifyActionEventPolicyWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:ModifyBackupPolicyModifyBackupPolicyWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyCollationTimeZoneModifyCollationTimeZoneWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:ModifyDBDescriptionModifyDBDescriptionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceAutoUpgradeMinorVersionModifyDBInstanceAutoUpgradeMinorVersionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceConnectionModeModifyDBInstanceConnectionModeWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:ModifyDBInstanceConnectionStringModifyDBInstanceConnectionStringWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceDelayedReplicationTimeModifyDBInstanceDelayedReplicationTimeWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceDeletionProtectionModifyDBInstanceDeletionProtectionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceDescriptionModifyDBInstanceDescriptionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceEndpointModifyDBInstanceEndpointWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/{#DBInstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceEndpointAddressModifyDBInstanceEndpointAddressWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/{#DBInstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceHAConfigModifyDBInstanceHAConfigWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceMaintainTimeModifyDBInstanceMaintainTimeWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceMetricsModifyDBInstanceMetricsWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceMonitorModifyDBInstanceMonitorWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceNetworkExpireTimeModifyDBInstanceNetworkExpireTimeWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceNetworkTypeModifyDBInstanceNetworkTypeWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstancePayTypeModifyDBInstancePayTypeWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceProxyConfigurationModifyDBInstanceProxyConfigurationWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceSSLModifyDBInstanceSSLWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceSpecModifyDBInstanceSpecWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBInstanceTDEModifyDBInstanceTDEWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBProxyModifyDBProxyWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBProxyEndpointModifyDBProxyEndpointWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBProxyEndpointAddressModifyDBProxyEndpointAddressWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDBProxyInstanceModifyDBProxyInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDTCSecurityIpHostsForSQLServerModifyDTCSecurityIpHostsForSQLServerWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:ModifyDasInstanceConfigModifyDasInstanceConfigWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyDbProxyInstanceSslModifyDbProxyInstanceSslWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyHADiagnoseConfigModifyHADiagnoseConfigWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyHASwitchConfigModifyHASwitchConfigWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyInstanceAutoRenewalAttributeModifyInstanceAutoRenewalAttributeWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyInstanceCrossBackupPolicyModifyInstanceCrossBackupPolicyWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyParameterModifyParameterWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyParameterGroupModifyParameterGroupWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
NoneNone
rds:ModifyReadWriteSplittingConnectionModifyReadWriteSplittingConnectionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifyReadonlyInstanceDelayReplicationTimeModifyReadonlyInstanceDelayReplicationTimeWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/{#DBInstanceId}
NoneNone
rds:ModifyResourceGroupModifyResourceGroupWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifySQLCollectorPolicyModifySQLCollectorPolicyWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifySQLCollectorRetentionModifySQLCollectorRetentionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:ModifySecurityGroupConfigurationModifySecurityGroupConfigurationWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ModifySecurityIpsModifySecurityIpsWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:PurgeDBInstanceLogPurgeDBInstanceLogWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:RebuildDBInstanceRebuildDBInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:ReceiveDBInstanceReceiveDBInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:RecoveryDBInstanceRecoveryDBInstanceWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ReleaseInstanceConnectionReleaseInstanceConnectionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:ReleaseInstancePublicConnectionReleaseInstancePublicConnectionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ReleaseReadWriteSplittingConnectionReleaseReadWriteSplittingConnectionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:RemoveTagsFromResourceRemoveTagsFromResourceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:RenewInstanceRenewInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ResetAccountResetAccountWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:ResetAccountPasswordResetAccountPasswordWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:RestartDBInstanceRestartDBInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:RestoreDdrTableRestoreDdrTableWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:RestoreTableRestoreTableWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:RevokeAccountPrivilegeRevokeAccountPrivilegeWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:RevokeOperatorPermissionRevokeOperatorPermissionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:StartDBInstanceStartDBInstanceWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/{#DBInstanceId}
NoneNone
rds:StopDBInstanceStopDBInstanceWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:SwitchDBInstanceHASwitchDBInstanceHAWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:SwitchDBInstanceNetTypeSwitchDBInstanceNetTypeWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
NoneNone
rds:SwitchDBInstanceVpcSwitchDBInstanceVpcWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:TagResourcesTagResourcesWrite
All Resources
acs:rds:{#regionId}:{#accountId}:*
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:TerminateMigrateTaskTerminateMigrateTaskWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/{#DBInstanceId}
NoneNone
rds:TransformDBInstancePayTypeTransformDBInstancePayTypeWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:UnlockAccountUnlockAccountWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:UntagResourcesUntagResourcesWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:UpdateUserBackupFileUpdateUserBackupFileWrite
BackupFile
acs:rds:*:{#accountId}:backupfile/{#BackupId}
NoneNone
rds:UpgradeDBInstanceEngineVersionUpgradeDBInstanceEngineVersionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:UpgradeDBInstanceKernelVersionUpgradeDBInstanceKernelVersionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:UpgradeDBInstanceMajorVersionUpgradeDBInstanceMajorVersionWrite
DBInstance
acs:rds:*:{#accountId}:dbinstance/{#DBInstanceId}
NoneNone
rds:UpgradeDBInstanceMajorVersionPrecheckUpgradeDBInstanceMajorVersionPrecheckRead
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None
rds:UpgradeDBProxyInstanceKernelVersionUpgradeDBProxyInstanceKernelVersionWrite
DBInstance
acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}
rds:ResourceTag
None

Resource

RDS defines the values that you can use in the Resource. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform a specific operation on a specific resource. The ARN is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:
  • {#}indicates a variable. {#} must be replaced with an actual value. For example, {#ramcode} must be replaced with the actual code of an Alibaba Cloud service in RAM.
  • An asterisk (*) is used as a wildcard. Examples:
    • {#resourceType} is set to *, all resources are specified.
    • {#regionId} is set to *, all regions are specified.
    • {#accountId} is set to *, all Alibaba Cloud accounts are specified.
Resource typeARN
DBInstanceacs:{#ramcode}:{#regionId}:{#accountId}:dbinstance/{#DBInstanceId}
BackupFileacs:{#ramcode}:*:{#accountId}:backupfile/{#BackupId}

Condition

RDS defines the values that you can use in the Condition element of a policy statement. The following table describes the values. The following table describes the service-specific condition keys. The common condition keys that are defined by Alibaba Cloud also apply to RDS. For more information about the common condition keys, see Generic Condition Keyword.
The data type determines the conditional operators that you can use to compare the value in a request with the value in a policy statement. You must use conditional operators that are supported by the data type. Otherwise, you cannot compare the value in the request with the value in the policy statement. In this case, the authorization is invalid. For more information about the conditional operators that are supported by each data type, see Policy elements.
Condition keyDescriptionData type
rds:ResourceTagSTRING

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: