PolarDB:Authorize PolarDB to access KMS

Create the AliyunRDSInstanceEncryptionRolePolicy policy

1. Log on to the Policies page in the RAM console.

2. Click Create Policy.

   Note

   A permission policy is a set of permissions written in a specific syntax that precisely defines authorized resources, allowed operations, and authorization conditions.

3. Click the JSON tab and paste the following policy document into the code editor.

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "kms:List*",
                   "kms:DescribeKey",
                   "kms:TagResource",
                   "kms:UntagResource"
               ],
               "Resource": [
                   "acs:kms:*:*:*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "kms:Encrypt",
                   "kms:Decrypt",
                   "kms:GenerateDataKey"
               ],
               "Resource": [
                   "acs:kms:*:*:*"
               ],
               "Effect": "Allow",
               "Condition": {
                   "StringEqualsIgnoreCase": {
                       "kms:tag/acs:rds:instance-encryption": "true"
                   }
               }
           }
       ]
   }

4. Click OK and configure the following parameters:

   Parameter	Description
   Policy name	Enter AliyunRDSInstanceEncryptionRolePolicy.
   Note	Enter a description, such as "Allows PolarDB to access KMS."

5. Click OK.

Create and authorize the AliyunRDSInstanceEncryptionDefaultRole RAM role

After creating the policy, attach it to a RAM role to allow PolarDB to access KMS resources.

1. Navigate to the Roles page in the RAM console.

2. Click Create Role.

3. For Trusted entity type, select Cloud service.

4. From the Trusted Entity Name dropdown list, search for and select ApsaraDB RDS / RDS, and then click OK.

5. Enter AliyunRDSInstanceEncryptionDefaultRole in the RAM Role Name field and click OK.

6. After the role is created, on the role details page, click the Permissions tab and then click Add Permissions.

7. On the Add Permissions page, search for and click the AliyunRDSInstanceEncryptionRolePolicy permission policy you created to add it to the Selected list.

8. Click OK.