访问控制-子账号授权

  1. 云栖社区>
  2. 博客>
  3. 正文

访问控制-子账号授权

金澎 2019-04-22 15:13:59 浏览246
展开阅读全文

RAM资源授权
https://help.aliyun.com/document_detail/26307.html?spm=5176.11065259.1996646101.searchclickresult.35524bf5S9Ti4d

RDS 标签授权

{
"Statement": [

{
  "Action": "rds:*",
  "Effect": "Allow",
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "rds:ResourceTag/team": "dev"
    }
  }
},
{
  "Action": "rds:DescribeTag*",
  "Effect": "Allow",
  "Resource": "*"
}

],
"Version": "1"
}

下载备份的权限
{

"Version": "1",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "rds:ModifyBackupPolicy"
        ],
        "Resource": [
            "*"
        ],
        "Condition": {}
    }
]

}

RDS修改白名单权限
{

"Statement": [
    {
        "Action": "rds:ModifySecurityIps",
        "Effect": "Allow",
        "Resource": [
            "*"
        ]
    },
    {
        "Action": "rds:Describe*",
        "Effect": "Allow",
        "Resource": "*"
    }
],
"Version": "1"

}

cloudDBA相关的接口不支持标签授权。可通过单独授权的方式把这相关操作的权限加上。策略示例如下: 注意使用的时候要把“$InstanceId”换成实际的实例Id
{

"Version": "1",
"Statement": [
    {
        "Action": [
            "rds:DescribeCloudDBAService",
            "rds:DescribeDiagnosticReportList",
            "rds:DescribeResourceDiagnosis",
            "rds:DescribeSQLDiagnosisList"
        ],
        "Resource": "acs:rds:*:*:*/$InstanceID",
        "Effect": "Allow"
    }
]

}

网友评论

登录后评论
0/500
评论
金澎
+ 关注