当子用户通过API 进行资源访问时,后台向RAM进行权限检查,以确保调用者拥有相应权限。
当用户通过 OpenAPI 进行跨账户的 AnalyticDB for PostgreSQL资源访问时, AnalyticDB for PostgreSQL后台向RAM进行权限检查,以确保资源拥有者已经将相关资源的相关权限授予调用者。每个不同的OpenAPI会根据涉及到的资源以及API的语义来确定需要检查哪些资源的权限。具体每个API的鉴权规则参见表 1。
Action | 鉴权规则 |
---|---|
CreateDBInstance | acs:gpdb:$regionid: dbinstance /$* |
DeleteDBInstance | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeDBInstanceAttribute | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeDBInstances | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeRegions | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeResourceUsage | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
ModifyDBInstanceConnectionMode | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
ModifyDBInstanceDescription | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
ModifyDBInstanceMaintainTime | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
RestartDBInstance | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DeleteDatabase | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeAccounts | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
ModifyAccountDescription | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
CreateAccount | acs:gpdb:$regionid: dbinstance /$* |
ResetAccountPassword | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeDBInstanceIPArrayList | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeDBClusterIPArrayList | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
ModifySecurityIps | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeSlowLogRecords | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeSQLCollectorPolicy | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeSQLLogFiles | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeSQLLogRecords | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
ModifySQLCollectorPolicy | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeDBInstancePerformance | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
AllocateInstancePublicConnection | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
DescribeDBInstanceNetInfo | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
ReleaseClusterPublicConnection | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
ModifyDBInstanceConnectionString | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
ModifyDBInstanceNetworkType | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |
ReleaseInstancePublicConnection | acs:gpdb:$regionid: $accountid:dbinstance/$dbinstanceid |