ApsaraDB RDS:Grant read-only permissions on a specific RDS instance

Create a policy.

1. Log on to the RAM console.

2. In the navigation pane on the left, choose Permissions > Policies.

3. Click Create Policy.

4. Select the visual editor tab or the Edit Script tab.

   Visual editor

   1. Set Effect to Allow and Services to ApsaraDB RDS / RDS.

   2. For Actions, select all Describe-related permissions from the Read category. You can find these permissions by searching for "Describe".

      Important

      If the policy document exceeds the length limit because you selected too many permissions, you can submit a ticket to request a limit increase.

   3. For Resources, select Specify Resources and set the ARN option to acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId} to configure the Resources as the specific instance that requires authorization. You do not need to configure Condition.

   4. Click Add Statement. Set Effect to Allow and Services to ApsaraDB RDS / RDS.

   5. Set Actions to rds:DescribeDBInstances. Set Resources to All Resources. Do not configure Condition.

   Script editor

   In the script editor window, enter the following content:

   {
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "rds:Describe*",
         "Resource": "acs:rds:*:*:dbinstance/"
       },
       {
         "Effect": "Allow",
         "Action": "rds:DescribeDBInstances",
         "Resource": "*"
       }
     ],
     "Version": "1"
   }

5. Click OK. In the Create Policy panel, enter a Policy Name and Description. Confirm that the policy content is correct and click OK.

Attach the policy to the RAM user.

1. In the navigation pane on the left, choose Identities > User.

2. Find the target user and click Add Permissions in the Actions column.

3. For Grant Scope, specify the resource group that you created for this example. Then, in the Policies section, click Custom Policy, search for and select the policy that you created.

4. Click OK.

Log on to the ApsaraDB RDS console as the RAM user and view the instance.

1. As the RAM user, go to the Instances page. Select a region at the top to view the instance list.

2. Click the authorized instance. You can view its details.

   Note

   With this authorization method, the RAM user can see all instances on the instance list page but can only view the details of the specifically authorized instance. Attempting to view other unauthorized instances results in an "insufficient permissions" error.

Create a resource group.

1. Log on to the Resource Management console. In the navigation pane on the left, click Resource Group.

2. Click Create Resource Group, enter a Resource Group Identifier and Resource Group Name, and then click OK.

Move the target instance to the new resource group.

1. Find the target instance in its current resource group. For example, if the instance is in the Default Resource Group, click Resource Management in the Actions column of the default resource group.

2. Find the target instance by its ID, select the instance, and click Transfer Resource Group.

3. In the Transfer Resource Group window, select the resource group that you created in Step 1, and then click OK.

4. In the success window, click OK.

   The transfer is complete when the target instance appears in the new resource group.

Create a policy.

1. Log on to the RAM console.

2. In the navigation pane on the left, choose Permissions > Policies.

3. Click Create Policy.

4. Select the visual editor tab or the Edit Script tab.

   Visual editor

   1. Set Effect to Allow and Services to ApsaraDB RDS / RDS.

   2. For Actions, select Describe-related permissions from the Read category. You can search for "Describe" and select all related permissions.

      Important

      If the policy document exceeds the length limit because you selected too many permissions, you can submit a ticket to request a limit increase.

   3. Set Resources to All Resources. Do not configure Condition.

   Script editor

   In the script editor window, enter the following content:

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "rds:Describe*"
               ],
               "Resource": "*"
           }
       ]
   }

5. Click OK. In the Create Policy panel, enter a Policy Name and Description. Confirm that the policy content is correct and click OK.

Attach the custom policy to the specified RAM user.

1. In the navigation pane on the left, choose Identities > User.

2. Find the target user and click Add Permissions in the Actions column.

3. For Grant Scope, specify the resource group that you created for this example. Then, in the Policies section, click Custom Policy, search for and select the policy that you created.

4. Click OK.

Log on to the ApsaraDB RDS console as the RAM user and view the instance.

1. As the RAM user, go to the Instances page and select a region at the top.

2. Select the resource group that you created in Step 1. The target instance is displayed. Click the instance to view its details.

Add a tag to the RDS instance.

1. Go to the Instances page, select a region at the top, and find the target instance.

2. In the Tags column, click the icon, and then click Edit.

3. Set the tag key and tag value, and then click OK.

   This example uses test-ram as the tag key and rds-mysql as the tag value. We recommend that you use meaningful tag keys and tag values.

   The tag test-ram: rds-mysql appears in the Tags column for the instance, indicating the tag was added successfully.

Create a policy.

1. Log on to the RAM console.

2. In the navigation pane on the left, choose Permissions > Policies.

3. Click Create Policy.

4. Select the visual editor tab or the Edit Script tab.

   Visual editor

   1. Set Effect to Allow and Services to ApsaraDB RDS / RDS.

   2. For Actions, select Describe-related permissions from the Read category. You can search for "Describe" and select all related permissions.

      Important

      If the policy document exceeds the length limit because you selected too many permissions, you can submit a ticket to request a limit increase.

   3. Set Resources to All Resources. Click Add Condition, and set the Condition Key, Operators, and Condition Value.

      Note

      In the Condition parameters, set Condition Key to rds:ResourceTag and Operators to StringEquals. For Condition Value, enter the Tag Key and Tag Value that you added to the RDS instance in Step 1.

   Script editor

   In the script editor window, enter the following content:

   Note

   In the following script, test-ram and rds-mysql are only examples. You must replace them with the tag key and tag value that you bound to the RDS instance in Step 1.

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "rds:Describe*"
         ],
         "Resource": [
           "*"
         ],
         "Condition": {
           "StringEquals": {
             "rds:ResourceTag/test-ram": [
               "rds-mysql"
             ]
           }
         }
       }
     ]
   }

5. Click OK. In the Create Policy panel, enter a Policy Name and Description. Confirm that the policy content is correct and click OK.

Attach the custom policy to the specified RAM user.

1. In the navigation pane on the left, choose Identities > User.

2. Find the target user and click Add Permissions in the Actions column.

3. For Grant Scope, specify the resource group that you created for this example. Then, in the Policies section, select Custom Policy, search for and select the policy that you created.

4. Click OK.

Log on to the ApsaraDB RDS console as the RAM user and view the instance.

1. As the RAM user, go to the Instances page and select a region at the top.

2. To find the tagged instance, use the Filter by Tag feature: Click Filter by Tag, then select the tag key test-ram and tag value rds-mysql. The filter results show only the RDS instances that the RAM user has permissions to access.