Data Management (DMS) provides features that can be used to perform fine-grained management of data security in a centralized manner. You can manage permissions on resources such as database instances, databases, tables, rows, and sensitive columns. This topic describes how to manage permissions by using different roles.
Usage notes
You can manage permissions on resources, such as database instances, databases, tables, rows, and sensitive columns, only for instances that are managed in Security Collaboration mode. You can apply for or grant only the logon permissions for instances that are managed in Flexible Management or Stable Change mode. You can use the account management feature to manage other types of permissions for database accounts. For more information, see Account permission management.
DMS provides the account management feature only for MySQL, PostgreSQL, and MongoDB databases. For the databases of other engines, you can go to the corresponding console to manage the database accounts.
Permission management methods for different roles
System role | Permission management method |
Regular user | In DMS, regular users except those for whom access control is enabled can submit a ticket to apply for the operation permissions or data permissions on a specific resource. For more information, see the Apply for permissions by using a ticket section of this topic. |
DMS administrator and database administrator (DBA) |
Note DBAs can only manage permissions by using the instance management feature. DMS administrators can manage permissions by using the four preceding methods. |
Schema read-only | Users who assume the schema read-only role can query the metadata of all instances, databases, and tables, without the need to obtain the query, change, or export permissions on the instances, databases, and tables. |
You can click the
icon in the upper-right corner of the console homepage to view your system roles. DMS records all permission change operations except metadata access control in operation logs. For example, if you applied for, granted, released, or revoked permissions, you can view the permission change records in DMS operation logs. To view operation logs, choose in the top navigation bar. Then, click the Operation Logs tab.
Permission types
Permission type | Description |
Logon permissions | After you obtain the logon permission on a database instance that is managed in Flexible Management or Stable Change mode, you can use the corresponding database account or password to log on to the database instance. |
Performance viewing permissions | After you obtain the permission to view the performance of a database instance that is managed in Security Collaboration mode, you can view the performance of the database instance. For more information, see View the performance details of a database instance. |
Query permissions | After you obtain the query permission on a database instance that is managed in Security Collaboration mode, you can execute SQL statements on the SQLConsole tab to query the data of the database instance. |
Change permissions | After you obtain the change permission on a database instance that is managed in Security Collaboration mode,
|
Export permissions | After you obtain the export permission on a database instance that is managed in Security Collaboration mode, you can submit tickets to export data from the database instance. However, you cannot export data without approval. |
Submit a ticket to apply for permissions
DMS users except those for whom access control is enabled can submit a ticket to apply for permissions on a specific resource.
- Log on to the DMS console V5.0.
In the top navigation bar, click Security and Specifications. In the left-side navigation pane, choose Permission Center > Permission Tickets.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose . On the Access applyTickets page, click Access apply and select a permission category from the drop-down list.
On the Access apply Tickets page, configure the query, export, and change permissions for resources, including databases and tables, based on your business requirements.
Parameter
Supported permission category
Description
Flexible Management and Stable Change
Instances-Logon
Enter the endpoint or name of a database instance in the search box and click Search.
In the search results, select the database instance on which you want to apply for permissions.
Click the
icon to add the selected instance to the Selected Databases/Tables/Columns section on the right side of the page.
Security Collaboration
Database-Permission
Table-Permission
Sensitive Column-Permission
Database-OWNER
Table-OWNER
Programmable Object
Instances-Performance
Instances-OWNER
Row-Permission
The following example shows how to apply for permissions on a database.
Enter the database name in the search box and click Search. You can use the percent sign (
%) as a placeholder to search for a database in fuzzy match mode. Example:dms%test.In the search results, select the database on which you want to apply for permissions.
Click the
icon to add the selected instance to the Selected Databases/Tables/Columns section on the right side of the page.
After you configure the parameters, click Submit.
After the ticket is approved, the system automatically grants you the permissions that you applied for.
Related operations
In the top navigation bar, click Security and Specifications. In the left-side navigation pane, choose Permission Center Permissions.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose . On the Ordinary Permissions tab, select a permission category from the first drop-down list on the left. In the permission list, you can view the permissions that you have.
NoteThe permissions on a database instance include the permission to log on to the database instance and the permission to view the performance of the database instance.
You cannot query or release permissions on a programmable object.
The owner of a resource can view and manage the permissions on the resource, and evaluate whether the permissions are properly granted.
In the top navigation bar, click Security and Specifications. In the left-side navigation pane, choose Permission Center Permissions.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose . Click the My Resources tab.
Select Owner's instance, My Databases, or My Tables from the first drop-down list on the left.
In the resource list, view the resources on which you have permissions.
In the top navigation bar, click Security and Specifications. In the left-side navigation pane, choose Permission Center Permissions.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose . Click the My Resources tab.
In the Actions column of a resource, you can perform the following operations on the resource: manage permissions, change owners, view tables, and configure logical databases.
Manage permissions as a DMS administrator or DBA
DMS administrators and DBAs can use the instance management feature to manage the permissions on database instances and databases.
- Log on to the DMS console V5.0.
In the top navigation bar, choose .
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose . Manage permissions on instances.
Click the Instance List tab, and choose in the Actions column of the instance that you want to manage.
In the dialog box that appears, you can view and revoke permissions from a user, and grant a user the permissions to log on to the database instance or view instance performance in the Actions column.
Manage permissions on databases.
Click the Database List tab, and choose in the Actions column of the database that you want to manage.
In the dialog box that appears, select a Classification. You can view and revoke the permissions from a user in the Actions column. You can also click Grant Permissions on Database or Grant Permissions on Table to add permissions of a user on a database or table.
Manage permissions as a DMS administrator
DMS administrators can use the user management feature to grant permissions to or revoke permissions from a user. The types of permissions that can be added or revoked include the permissions on instance logon, performance viewing, databases, tables, rows, and sensitive columns.
- Log on to the DMS console V5.0.
In the top navigation bar, click O&M. In the left-side navigation pane, click Users.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose All functions > O&M > Users. Grant permissions to a user.
Click Authorize in the Actions column of the user account to which you want to grant permissions.
In the dialog box that appears, configure the parameters and click OK.
Revoke permissions from a user.
In the Actions column of the user account from which you want to revoke permissions, choose .
In the User Permissions dialog box, click the Ordinary Permissions tab and select an instance permission.
Select the instance that you want to manage and click Release permissions.
In the Permission Operation dialog box, choose the permission type that you want to revoke or release and click OK.
FAQ
Q: A Resource Access Management (RAM) user has the permissions to log on to an ApsaraDB RDS instance in the DMS console. When I log on to the instance in the DMS console as the RAM user, a message is displayed that indicates that the RAM user does not have the permissions to log on to the instance. What do I do?
A: Make sure that you add the ApsaraDB RDS instance to DMS by using your Alibaba Cloud account. Then, you can log on to the ApsaraDB RDS instance as the RAM user. For more information about how to add an instance, see Register an ApsaraDB instance.