DMS access control permissions - Data Management - Alibaba Cloud Documentation Center

Permission categories and types

Permission category	Permission type	Description	Requires security hosting
Operation permissions (regular permissions)	Permissions on database instances	Logon permissions for a database instance. Available only when security hosting is disabled. After obtaining logon permissions, you can access the instance with the database account and password. Note Database credentials are managed by relevant owners in your organization.	No
		Permissions to view database instance performance. Database performance.	Yes
		Permissions to query, export, and change instance data, excluding data in access-controlled sensitive columns and rows.
	Permissions on databases	Permissions to query, export, and change database data, excluding data in access-controlled sensitive columns and rows.
	Permissions on tables	Permissions to query, export, and change table data, excluding data in access-controlled sensitive columns and rows.
	Permissions on sensitive columns	Permissions to query, export, and change sensitive column data. Note Before applying for sensitive column permissions: The sensitive data protection feature is enabled. Enable the sensitive data protection feature. You have permissions on the database and table that contain the sensitive column. Manage permissions.
	Permissions on rows	Permissions to query, export, and change row data. Row-level control. Note Before applying for row permissions, you must have permissions on the database and table that contain the row.
	Permissions on programmable objects	Permissions to query, export, and change programmable object data. When security hosting is enabled, you must obtain these permissions before accessing programmable objects. Programmable objects.
Data permissions (resource owner permissions)	Instance owner	Owner permissions on a resource (instance, database, or table). Owners can view, grant, and revoke resource permissions, and query resource data, excluding data in access-controlled sensitive columns and rows. Note When security hosting is disabled, only DMS administrators and DBAs can manage instance owners. In the DMS console, right-click a database instance in the left-side Database Instances section and choose Instance Owner > Set Owner.	Yes
	Database owner
	Table owner
Metadata access control	Metadata access control	Instance access control: Only authorized users can query and access an access-controlled instance. Unauthorized users cannot apply for permissions. Database access control: Only authorized users can query and access an access-controlled database. Unauthorized users cannot apply for permissions. User access control: An access-controlled user can only query and access instances and databases on which they have permissions, and cannot apply for additional permissions. Note Having any data or operation permission on an instance or database counts as having permissions on that resource.	Yes

Permissions:

Query: the permission to run SQL queries in the SQL Console.
Change: the permission to run change statements in the SQL Console and submit data change and database and table synchronization tickets.
Export: the permission to submit data export tickets.

Note
Not required for exporting SQL result sets from the SQL Console.

Permission verification

When you perform operations on a database in DMS with an Alibaba Cloud account or as a RAM user, DMS verifies your permissions. DMS checks fine-grained permissions first, then RAM user permissions.

Note

To prevent unauthorized users from searching for instances and databases, enable access control for the database instances. Only authorized users can then search for these resources. Enable metadata access control.

Disable RAM permission verification and enable metadata access control

Disable RAM permission verification.

Choose O&M > Configuration Management and turn off RAM permission verification. RAM users can then no longer use existing RAM permissions to operate on instances in DMS.
Enable access control for database instances.

Note
Access control is available only for instances managed in Secure Collaboration mode.

Choose Data Assets > Instances. On the Instance List tab, find the target instance, choose More > Secure Access Proxy in the Actions column, and enable access control.

What to do next

You can perform the following operations:

Manage resource permissions by role. Manage permissions.
View your granted operation and data permissions. Manage permissions.
Configure permission approval processes for different scenarios:
- Use strict approval for production data and core business databases.
- Use simple approval or no-approval access for non-core business and test data.
Configure approval processes.
Manage other database account permissions with the account management feature. Account permission management.

Note
Account management is available only for MySQL, PostgreSQL, and MongoDB. For other engines, manage database accounts in the corresponding console.

FAQ

Q: Why do I still receive a "permission denied" error for a query after being granted logon permission for an instance in DMS?

A: In non-secure-hosting mode, users only need logon permission to perform operations. After switching to secure hosting mode, users must apply for specific permissions (query, export, change). Manage user permissions on the Manage access control permissions page.