AnalyticDB：使用資源群組進行精細化資源控制-最新

資源群組授權的工作原理

您可以使用資源群組（Resource Group）對阿里雲帳號內的資源進行分組管理。例如，為不同的專案建立對應的資源群組，並將資源轉移到對應的組中，以便集中管理各專案的資源。更多資訊，請參見什麼是資源群組。

在完成資源分組後，您可以為不同的RAM授權主體（RAM使用者、RAM使用者組或RAM角色）授予指定資源群組範圍的許可權，從而限定這個授權主體只能管理該資源群組內的資源。更多資訊，請參見資源分組和授權。

這種授權方式的優點有：

• 許可權精細化：確保每個身份能獲得最準確的資源存取權限，避免帳號下的多重專案的資源混合管理。

• 良好的擴充性：後續新增資源時，只需將其加入該資源群組，RAM身份便會自動獲得新資源的相應許可權，無需再次授權。

為RAM使用者授予資源群組層級的許可權

下面以RAM使用者為例，介紹授予指定資源群組內雲原生資料倉儲 AnalyticDB PostgreSQL 版資源許可權的操作步驟。

支援資源群組的資源類型

雲原生資料倉儲 AnalyticDB PostgreSQL 版支援資源群組的資源類型如下表所示：

不支援資源群組層級授權的操作

雲原生資料倉儲 AnalyticDB PostgreSQL 版中不支援資源群組層級授權的操作（Action）如下：

對於不支援資源群組授權的操作，授權時資源範圍選取資源群組層級將無效。如果仍需要RAM使用者有上述操作許可權，您需要建立自訂權限原則，授權時資源範圍選取帳號層級。

以下是兩個自訂權限原則樣本，您可以根據實際需要調整策略內容。

• 允許不支援資源群組層級授權的全部唯讀操作：Action中列舉不支援資源群組層級授權的所有隻讀操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "gpdb:ChatWithKnowledgeBaseStream",
          "gpdb:CheckHadoopDataSource",
          "gpdb:CheckHadoopNetConnection",
          "gpdb:CheckJDBCSourceNetConnection",
          "gpdb:CheckServiceLinkedRole",
          "gpdb:CreateDBInstancePlan",
          "gpdb:CreateSampleData",
          "gpdb:DeleteDBInstancePlan",
          "gpdb:DescribeAccounts",
          "gpdb:DescribeActiveSQLRecords",
          "gpdb:DescribeAvailableResources",
          "gpdb:DescribeBackupJob",
          "gpdb:DescribeBackupPolicy",
          "gpdb:DescribeDBClusterNode",
          "gpdb:DescribeDBClusterPerformance",
          "gpdb:DescribeDBInstanceAttribute",
          "gpdb:DescribeDBInstanceDataBloat",
          "gpdb:DescribeDBInstanceDataSkew",
          "gpdb:DescribeDBInstanceDiagnosisSummary",
          "gpdb:DescribeDBInstanceErrorLog",
          "gpdb:DescribeDBInstanceIPArrayList",
          "gpdb:DescribeDBInstanceIndexUsage",
          "gpdb:DescribeDBInstanceNetInfo",
          "gpdb:DescribeDBInstancePerformance",
          "gpdb:DescribeDBInstancePlans",
          "gpdb:DescribeDBInstanceSQLPatterns",
          "gpdb:DescribeDBInstanceSSL",
          "gpdb:DescribeDBInstanceSupportMaxPerformance",
          "gpdb:DescribeDBInstances",
          "gpdb:DescribeDBResourceGroup",
          "gpdb:DescribeDBResourceManagementMode",
          "gpdb:DescribeDBVersion",
          "gpdb:DescribeDBVersionInfos",
          "gpdb:DescribeDataBackups",
          "gpdb:DescribeDataReDistributeInfo",
          "gpdb:DescribeDataShareInstances",
          "gpdb:DescribeDataSharePerformance",
          "gpdb:DescribeDatabase",
          "gpdb:DescribeDiagnosisDimensions",
          "gpdb:DescribeDiagnosisMonitorPerformance",
          "gpdb:DescribeDiagnosisRecords",
          "gpdb:DescribeDiagnosisSQLInfo",
          "gpdb:DescribeDownloadRecords",
          "gpdb:DescribeDownloadSQLLogs",
          "gpdb:DescribeExtension",
          "gpdb:DescribeExternalDataService",
          "gpdb:DescribeHadoopClustersInSameNet",
          "gpdb:DescribeHadoopConfigs",
          "gpdb:DescribeHadoopDataSource",
          "gpdb:DescribeHealthStatus",
          "gpdb:DescribeHistoryEvents",
          "gpdb:DescribeHistoryEventsStat",
          "gpdb:DescribeIMVInfos",
          "gpdb:DescribeJDBCDataSource",
          "gpdb:DescribeLogBackups",
          "gpdb:DescribeModelService",
          "gpdb:DescribeModifyParameterLog",
          "gpdb:DescribeParameters",
          "gpdb:DescribePrivateRAGService",
          "gpdb:DescribeRebalanceStatus",
          "gpdb:DescribeRoles",
          "gpdb:DescribeSQLCollectorPolicy",
          "gpdb:DescribeSQLLogCount",
          "gpdb:DescribeSQLLogRecords",
          "gpdb:DescribeSQLLogs",
          "gpdb:DescribeSampleData",
          "gpdb:DescribeSpecification",
          "gpdb:DescribeStreamingDataSource",
          "gpdb:DescribeSupportFeatures",
          "gpdb:DescribeTags",
          "gpdb:DescribeUserEncryptionKeyList",
          "gpdb:DescribeWaitingSQLInfo",
          "gpdb:DescribeWaitingSQLRecords",
          "gpdb:DescribeZonesPrivateRAGService",
          "gpdb:DownloadSQLLogsRecords",
          "gpdb:DownloadSlowSQLRecords",
          "gpdb:GetAINode",
          "gpdb:GetAccount",
          "gpdb:GetPrice",
          "gpdb:GetSupabaseProject",
          "gpdb:GetSupabaseProjectApiKeys",
          "gpdb:GetSupabaseProjectDashboardAccount",
          "gpdb:GetSupabaseProjectSpec",
          "gpdb:GetSupabaseUpdateVersion",
          "gpdb:HandleActiveSQLRecord",
          "gpdb:ListAINodePools",
          "gpdb:ListBackupJobs",
          "gpdb:ListDatabaseExtensions",
          "gpdb:ListExternalDataServices",
          "gpdb:ListInstanceDatabases",
          "gpdb:ListInstanceExtensions",
          "gpdb:ListModelServices",
          "gpdb:ListRemoteADBDataSources",
          "gpdb:ListSlowSQLRecords",
          "gpdb:ListSupabaseProjects",
          "gpdb:ListSupportModels",
          "gpdb:ListTagResources",
          "gpdb:ListVirtualClusters",
          "gpdb:ModifyDBInstanceConfig",
          "gpdb:ModifyVectorConfiguration",
          "gpdb:PauseInstance",
          "gpdb:RebalanceDBInstance",
          "gpdb:ResetIMVMonitorData",
          "gpdb:SetDBInstancePlanStatus",
          "gpdb:UnloadSampleData",
          "gpdb:UpdateDBInstancePlan"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允許不支援資源群組層級授權的全部操作：Action中列舉不支援資源群組層級授權的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "gpdb:AddAINode",
          "gpdb:AllocateInstancePublicConnection",
          "gpdb:BindDBResourceGroupWithRole",
          "gpdb:BindToVirtualCluster",
          "gpdb:CancelActiveOperationTasks",
          "gpdb:ChatWithKnowledgeBase",
          "gpdb:ChatWithKnowledgeBaseStream",
          "gpdb:CheckHadoopDataSource",
          "gpdb:CheckHadoopNetConnection",
          "gpdb:CheckJDBCSourceNetConnection",
          "gpdb:CheckServiceLinkedRole",
          "gpdb:CloneDBInstance",
          "gpdb:CreateAccount",
          "gpdb:CreateBackup",
          "gpdb:CreateDBInstance",
          "gpdb:CreateDBInstanceIPArray",
          "gpdb:CreateDBInstancePlan",
          "gpdb:CreateDBResourceGroup",
          "gpdb:CreateDatabase",
          "gpdb:CreateExtensions",
          "gpdb:CreateExternalDataService",
          "gpdb:CreateHadoopDataSource",
          "gpdb:CreateJDBCDataSource",
          "gpdb:CreateModelService",
          "gpdb:CreateOrder",
          "gpdb:CreateRemoteADBDataSource",
          "gpdb:CreateSampleData",
          "gpdb:CreateServiceLinkedRole",
          "gpdb:CreateStreamingDataService",
          "gpdb:CreateStreamingDataSource",
          "gpdb:CreateStreamingJob",
          "gpdb:CreateSupabaseProject",
          "gpdb:CreateVirtualCluster",
          "gpdb:DeleteAINode",
          "gpdb:DeleteBackup",
          "gpdb:DeleteDBInstance",
          "gpdb:DeleteDBInstanceIPArray",
          "gpdb:DeleteDBInstancePlan",
          "gpdb:DeleteDBResourceGroup",
          "gpdb:DeleteDatabase",
          "gpdb:DeleteExtension",
          "gpdb:DeleteExternalDataService",
          "gpdb:DeleteHadoopDataSource",
          "gpdb:DeleteJDBCDataSource",
          "gpdb:DeleteModelService",
          "gpdb:DeletePrivateRAGService",
          "gpdb:DeleteRemoteADBDataSource",
          "gpdb:DeleteStreamingDataService",
          "gpdb:DeleteStreamingDataSource",
          "gpdb:DeleteStreamingJob",
          "gpdb:DeleteSupabaseProject",
          "gpdb:DeleteVirtualCluster",
          "gpdb:DeployPrivateRAGService",
          "gpdb:DescribeAccounts",
          "gpdb:DescribeActiveSQLRecords",
          "gpdb:DescribeAvailableResources",
          "gpdb:DescribeBackupJob",
          "gpdb:DescribeBackupPolicy",
          "gpdb:DescribeDBClusterNode",
          "gpdb:DescribeDBClusterPerformance",
          "gpdb:DescribeDBInstanceAttribute",
          "gpdb:DescribeDBInstanceDataBloat",
          "gpdb:DescribeDBInstanceDataSkew",
          "gpdb:DescribeDBInstanceDiagnosisSummary",
          "gpdb:DescribeDBInstanceErrorLog",
          "gpdb:DescribeDBInstanceIPArrayList",
          "gpdb:DescribeDBInstanceIndexUsage",
          "gpdb:DescribeDBInstanceNetInfo",
          "gpdb:DescribeDBInstancePerformance",
          "gpdb:DescribeDBInstancePlans",
          "gpdb:DescribeDBInstanceSQLPatterns",
          "gpdb:DescribeDBInstanceSSL",
          "gpdb:DescribeDBInstanceSupportMaxPerformance",
          "gpdb:DescribeDBInstances",
          "gpdb:DescribeDBResourceGroup",
          "gpdb:DescribeDBResourceManagementMode",
          "gpdb:DescribeDBVersion",
          "gpdb:DescribeDBVersionInfos",
          "gpdb:DescribeDataBackups",
          "gpdb:DescribeDataReDistributeInfo",
          "gpdb:DescribeDataShareInstances",
          "gpdb:DescribeDataSharePerformance",
          "gpdb:DescribeDatabase",
          "gpdb:DescribeDiagnosisDimensions",
          "gpdb:DescribeDiagnosisMonitorPerformance",
          "gpdb:DescribeDiagnosisRecords",
          "gpdb:DescribeDiagnosisSQLInfo",
          "gpdb:DescribeDownloadRecords",
          "gpdb:DescribeDownloadSQLLogs",
          "gpdb:DescribeExtension",
          "gpdb:DescribeExternalDataService",
          "gpdb:DescribeHadoopClustersInSameNet",
          "gpdb:DescribeHadoopConfigs",
          "gpdb:DescribeHadoopDataSource",
          "gpdb:DescribeHealthStatus",
          "gpdb:DescribeHistoryEvents",
          "gpdb:DescribeHistoryEventsStat",
          "gpdb:DescribeIMVInfos",
          "gpdb:DescribeJDBCDataSource",
          "gpdb:DescribeLogBackups",
          "gpdb:DescribeModelService",
          "gpdb:DescribeModifyParameterLog",
          "gpdb:DescribeParameters",
          "gpdb:DescribePrivateRAGService",
          "gpdb:DescribeRayCluster",
          "gpdb:DescribeRebalanceStatus",
          "gpdb:DescribeRegions",
          "gpdb:DescribeRoles",
          "gpdb:DescribeSQLCollectorPolicy",
          "gpdb:DescribeSQLLogCount",
          "gpdb:DescribeSQLLogRecords",
          "gpdb:DescribeSQLLogs",
          "gpdb:DescribeSampleData",
          "gpdb:DescribeSpecification",
          "gpdb:DescribeStreamingDataService",
          "gpdb:DescribeStreamingDataSource",
          "gpdb:DescribeStreamingJob",
          "gpdb:DescribeSupportFeatures",
          "gpdb:DescribeTags",
          "gpdb:DescribeUserEncryptionKeyList",
          "gpdb:DescribeWaitingSQLInfo",
          "gpdb:DescribeWaitingSQLRecords",
          "gpdb:DescribeZonesPrivateRAGService",
          "gpdb:DisableDBResourceGroup",
          "gpdb:DownloadDiagnosisRecords",
          "gpdb:DownloadSQLLogsRecords",
          "gpdb:DownloadSlowSQLRecords",
          "gpdb:EnableDBResourceGroup",
          "gpdb:GetAINode",
          "gpdb:GetAccount",
          "gpdb:GetPrice",
          "gpdb:GetSupabaseDashboardAccount",
          "gpdb:GetSupabaseProject",
          "gpdb:GetSupabaseProjectApiKeys",
          "gpdb:GetSupabaseProjectDashboardAccount",
          "gpdb:GetSupabaseProjectSpec",
          "gpdb:GetSupabaseUpdateVersion",
          "gpdb:HandleActiveSQLRecord",
          "gpdb:ListAINodePools",
          "gpdb:ListBackupJobs",
          "gpdb:ListDatabaseExtensions",
          "gpdb:ListExternalDataServices",
          "gpdb:ListHeadNodeSpec",
          "gpdb:ListInstanceDatabases",
          "gpdb:ListInstanceExtensions",
          "gpdb:ListModelServices",
          "gpdb:ListRemoteADBDataSources",
          "gpdb:ListSlowSQLRecords",
          "gpdb:ListStreamingDataServices",
          "gpdb:ListStreamingJobs",
          "gpdb:ListSupabaseProjects",
          "gpdb:ListSupportModels",
          "gpdb:ListTagResources",
          "gpdb:ListVirtualClusters",
          "gpdb:ModifyAccountDescription",
          "gpdb:ModifyActiveOperationMaintainConf",
          "gpdb:ModifyActiveOperationTasks",
          "gpdb:ModifyBackupPolicy",
          "gpdb:ModifyDBInstanceConfig",
          "gpdb:ModifyDBInstanceConnectionMode",
          "gpdb:ModifyDBInstanceConnectionString",
          "gpdb:ModifyDBInstanceDeploymentMode",
          "gpdb:ModifyDBInstanceDescription",
          "gpdb:ModifyDBInstanceMaintainTime",
          "gpdb:ModifyDBInstanceNetworkType",
          "gpdb:ModifyDBInstancePayType",
          "gpdb:ModifyDBInstanceResourceGroup",
          "gpdb:ModifyDBInstanceSSL",
          "gpdb:ModifyDBResourceGroup",
          "gpdb:ModifyExternalDataService",
          "gpdb:ModifyHadoopDataSource",
          "gpdb:ModifyJDBCDataSource",
          "gpdb:ModifyMasterSpec",
          "gpdb:ModifyModelServicePublicConnection",
          "gpdb:ModifyModelServiceSecurityIps",
          "gpdb:ModifyParameters",
          "gpdb:ModifyRemoteADBDataSource",
          "gpdb:ModifySQLCollectorPolicy",
          "gpdb:ModifySecurityIps",
          "gpdb:ModifyStreamingDataService",
          "gpdb:ModifyStreamingDataSource",
          "gpdb:ModifyStreamingJob",
          "gpdb:ModifySupabaseProjectSecurityIps",
          "gpdb:ModifyVectorConfiguration",
          "gpdb:PauseDataRedistribute",
          "gpdb:PauseInstance",
          "gpdb:RebalanceDBInstance",
          "gpdb:ReleaseInstancePublicConnection",
          "gpdb:ResetAccountPassword",
          "gpdb:ResetIMVMonitorData",
          "gpdb:ResetSupabaseProjectPassword",
          "gpdb:RestartDBInstance",
          "gpdb:RestartSupabaseProject",
          "gpdb:ResumeDataRedistribute",
          "gpdb:ResumeInstance",
          "gpdb:SetDBInstancePlanStatus",
          "gpdb:SetDataShareInstance",
          "gpdb:SwitchAINodeZone",
          "gpdb:SwitchDBInstanceNetType",
          "gpdb:TagResources",
          "gpdb:UnbindDBResourceGroupWithRole",
          "gpdb:UnloadSampleData",
          "gpdb:UntagResources",
          "gpdb:UpdateDBInstancePlan",
          "gpdb:UpdateSupabaseVersion",
          "gpdb:UpgradeDBInstance",
          "gpdb:UpgradeDBVersion",
          "gpdb:UpgradeExtensions"
        ],
        "Resource": "*"
      }
    ]
  }
  

常見問題