ApsaraDB RDS:Granting RAM users access to RDS instances

Procedure

1. Create a custom policy.

   1. Log on to the RAM console.

   2. In the left navigation bar, select Permission Management > Policy.

   3. Click Create Policy.

   4. Select Visual Editor or Script editing.

      Visual editor

      Parameter	Description
      Effect	Allow or deny the RAM user to perform subsequent settings. For example, Allow.
      Services	Select the target product or service. For example, select ApsaraDB RDS.
      Action	Select an action type: All Actions or Specified Operations. If you select Specified Operations, you must select the allowed actions from the All Actions section and add them to the Selected Actions section. We recommend that you also select DescribeDBInstances, which is under Read. Otherwise, you cannot view the instance list. Important If the policy document exceeds the length limit because you selected too many actions, you can submit a ticket to request a limit increase. For example, select all Read.
      Resources	Select resources. You can choose All Resources or Specified Resources. If you select Specified Resources, you must add specific resources. Click Add Resource on the right to match the resources based on the resource ARN format. The specific method is as follows: Important To ensure that a permission policy takes effect, the console marks the required resource ARNs for an action as Required. We strongly recommend that you configure these resource ARNs. For example, the acs:rds:*:{#accountId}:dbinstance/* ARN is required. If you do not configure this ARN, the RAM user cannot view any instances in the instance list. acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId} (Required): Matches resources by region, account, and instance ID. acs:rds:{#regionId}:{#accountId}:dbinstance/*: Matches resources by region and account. acs:rds:*:{#accountId}:dbinstance/* (Required): Matches resources by account. acs:rds:*:{#accountId}:dbinstance/{#dbinstanceId} (Required): Matches resources by account and instance ID. Note RAM supports fine-grained authorization using multiple methods, such as ARN, resource group authorization, and tag-based authorization. For an example of how to grant a RAM user read-only permissions on a specific RDS instance, see Grant a RAM user read-only permissions on a specific RDS instance.
      Condition	You can add conditions to further restrict access, such as by source IP address. For more information, see Elements of a policy.

      JSON

      Enter the following content in the editor:

      {
          "Version": "1",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": "rds:Describe*",
                  "Resource": "*"
              }
          ]
      }

      Note

      Compared to the Visual Editor, it is more convenient to directly use Describe* for the relevant operations.

   5. Click OK, and in the Create Policy dialog box, enter a Policy Name and Note, confirm that the policy content is correct, and then click OK again.

2. Attach the custom policy to the RAM user.

   1. In the left navigation bar, select Identities > Users.

   2. Find the target user, and in the Action column on the right, click Add Permissions.

   3. In the Policies section, click Custom Policy, search for the policy that you created, and select the policy.

   4. Click OK.

The configuration is complete. You can now use the RAM user to log on to the console and view RDS instance configurations. You can also grant other permissions to the RAM user as your business requires.

• For a list of RDS API operations, see API overview.

• For more information about the elements of a policy, see Elements of a policy.