描述

您通過雲帳號建立的RDS執行個體，都是該帳號自己擁有的資源。預設情況下，帳號對自己的資源擁有完整的操作許可權。

通過使用阿里雲的RAM（Resource Access Management）服務，您可以將您雲帳號下RDS資源的訪問及系統管理權限授予RAM中的子使用者。

目前，可以在RAM中進行授權的資源類型只有dbinstance。在通過RAM進行授權時，資源的描述方式如下：

請求參數

資源類型 授權策略中的資源描述方式
dbinstance acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid

acs:rds:$regionid:$accountid:dbinstance/

acs:rds:::dbinstance/

參數說明：

參數名稱 說明 
$regionid
 地區的ID，可以用*代替。 
$dbinstanceid
 執行個體的名稱，可以用*代替。 
$accountid
 雲帳號的數字ID，可以用*代替。

RDS API的鑒權規則

當子使用者通過API訪問RDS時，RDS後台會向RAM進行許可權檢查，以確保調用者擁有相應許可權。每個API會根據涉及到的資源以及API的語義來確定需要檢查哪些資源的許可權。每個API的鑒權規則如下表所示：

API 鑒權規則
CreateDBInstance acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DeleteDBInstance acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeDBInstances acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
SwitchDBInstanceNetType acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
ModifyDBInstanceDescription acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
ModifyDBInstanceMaintainTime acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
PurgeDBInstanceLog acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DeleteDatabase acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
ModifyDBDescription acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeFilesForSQLServer acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeImportsForSQLServer acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
CancelImport acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
ResetAccountPassword acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
RevokeAccountPrivilege acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DeleteAccount acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
CreateBackup acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
CreateTempDBInstance acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
ModifyBackupPolicy acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeDBInstancePerformance acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeSlowLogRecords acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeBinlogFiles acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeSQLLogRecords acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeOptimizeAdviceOnMissPK acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeOptimizeAdviceOnMissIndex acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeParameters acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
CreatePrepaidDBInstanceForChannel acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
ModifyPrepaidDBInstanceSpec acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
CreatePostpaidDBInstanceForChannel acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
ModifyPostpaidDBInstanceSpec acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeDBInstanceAttribute acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
RestartDBInstance acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
ModifySecurityIps acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
UpgradeDBInstanceEngineVersion acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
CreateDatabase acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeDatabases acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
CreateUploadPathForSQLServer acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
ImportDataBaseBetweenInstances acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
CreateAccount acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
GrantAccountPrivilege acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeAccounts acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
ModifyAccountDescription acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeBackups acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeBackupPolicy acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeResourceUsage acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeSlowLogs acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeErrorLogs acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeSQLLogReports acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeOptimizeAdviceOnStorage acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeOptimizeAdviceOnExcessIndex acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
DescribeOptimizeAdviceByDBA acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid
ModifyeParameter acs:rds:$regionid:$accountid:dbinstance/$dbinstanceid