How an Alibaba Cloud account grants permissions to a RAM user-ApsaraDB for OceanBase (Deprecated)(OceanBase)-阿里云帮助中心

Before a Resource Access Management (RAM) user can call an Alibaba Cloud API, the Alibaba Cloud account must grant permissions to the RAM user by creating an authorization policy.

Resource authorization

By default, RAM users cannot call Alibaba Cloud APIs to create or modify cloud resources. To grant these permissions, you must create an authorization policy and attach it to the RAM user.

When you create an authorization policy, you must specify the resources to authorize using an Aliyun Resource Name (ARN). An ARN is a globally unique name that Alibaba Cloud defines for each resource.

The ARN format is as follows:

acs: 
service-name: 
region: 
account-id: 
resource-relative-id:

Where:

acs: An acronym for Alibaba Cloud Service. It indicates the Alibaba Cloud public platform.
service-name: The name of the Alibaba Cloud service, such as OceanBase, ECS, OSS, or SLB.
region: The region of the resource. If this field is not supported, use an asterisk (*) as a wildcard character.
account-id: The ID of the Alibaba Cloud account, such as 123456789***.
resource-relative-id: A description of the specific resource. The format of this description varies by Alibaba Cloud product. For more information, see the developer documentation for each product.
For example, acs:oceanbase:cn-shanghai:123456789***:instance/obtestid** indicates an OceanBase resource where the object name is instance/obtestid** and the owner's UID is 123456789***.

Authorizable OceanBase resource types

Permissions are hierarchical. From highest to lowest, the levels are instance, tenant, and database. A higher-level permission includes all lower-level permissions.

An asterisk (*) can be used as a wildcard character to match all values in a field.

Resource type	Resource description method in an authorization policy
INSTANCE	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
	acs:oceanbase:{region}:{accountId}:*
	acs:oceanbase:{region}::
	acs:oceanbase:::*
TENANT	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
	acs:oceanbase:{region}:{accountId}:*
	acs:oceanbase:{region}::
	acs:oceanbase:::*
DATABASE	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}/database/{databaseName}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}/database/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
	acs:oceanbase:{region}:{accountId}:*
	acs:oceanbase:{region}::
	acs:oceanbase:::*

Authorizable OceanBase service APIs

The following tables list the authorizable APIs for the OceanBase service and how they are specified in an authorization policy:

Cluster operations

API	Resource description
CreateInstance	None. The result is passed to the PayOrderCallBack callback.
DescribeInstances	acs:oceanbase:{region}:{accountId}:instance/*
DescribeInstance	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
DescribeInstance	acs:oceanbase:{region}:{accountId}:instance/*
DescribeInstanceTopology	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
DescribeInstanceTopology	acs:oceanbase:{region}:{accountId}:instance/*

Tenant operations

API	Resource description
CreateTenant	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
CreateTenant	acs:oceanbase:{region}:{accountId}:instance/*
DescribeTenant	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
CreateTenantReadOnlyConnection	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
ModifyTenantPrimaryZone	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
DeleteTenants	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
ModifyTenantResource	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
DescribeInstanceAvailableZones	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
DescribeInstanceAvailableZones	acs:oceanbase:{region}:{accountId}:instance/*
DescribeAvailableCpuResource	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
DescribeAvailableCpuResource	acs:oceanbase:{region}:{accountId}:instance/*
DescribeAvailableMemResource	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
DescribeAvailableMemResource	acs:oceanbase:{region}:{accountId}:instance/*
DescribeInstanceTenantModes	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
DescribeInstanceTenantModes	acs:oceanbase:{region}:{accountId}:instance/*

Database operations

API	Resource description
DescribeDatabases	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
CreateDatabase	cs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
ModifyDatabaseUserRoles	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
ModifyDatabaseDescription	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
DeleteDatabases	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}/database/{databaseName}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}/database/*
	acs:oceanbase:{region}: {accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*

Account operations

API	Resource description
DescribeTenantUsers	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
CreateTenantUser	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
DescribeTenantUserRoles	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
ModifyTenantUserDescription	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
ModifyTenantUserPassword	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
ModifyTenantUserRoles	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
ModifyTenantUserStatus	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*
DeleteTenantUsers	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/{tenantId}
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}/tenant/*
	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
	acs:oceanbase:{region}:{accountId}:instance/*

Parameter management

API	Resource description
DescribeParameters	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
DescribeParameters	acs:oceanbase:{region}:{accountId}:instance/*
DescribeParametersHistory	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
DescribeParametersHistory	acs:oceanbase:{region}:{accountId}:instance/*
ModifyParameters	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
ModifyParameters	acs:oceanbase:{region}:{accountId}:instance/*

Security

API	Resource description
CreateSecurityIpGroup	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
CreateSecurityIpGroup	acs:oceanbase:{region}:{accountId}:instance/*
ModifySecurityIps	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
ModifySecurityIps	acs:oceanbase:{region}:{accountId}:instance/*
DeleteSecurityIpGroup	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
DeleteSecurityIpGroup	acs:oceanbase:{region}:{accountId}:instance/*
DescribeSecurityIpGroups	acs:oceanbase:{region}:{accountId}:instance/{instanceId}
DescribeSecurityIpGroups	acs:oceanbase:{region}:{accountId}:instance/*