When you contact Alibaba Cloud technical support to troubleshoot issues on your ApsaraDB RDS for MariaDB instance, you must grant temporary access to a service account if it is necessary for support engineers to operate on your instance. This lets support engineers diagnose and resolve issues. You choose which permissions to grant, set an expiration time, and revoke access at any time. When the service account expires, ApsaraDB RDS automatically deletes it.
What support engineers can access by default
Without authorization, the Alibaba Cloud after-sales team and DBA team can only view basic resource, billing, and performance information for your ApsaraDB RDS instance — including purchase time, expiration time, CPU, memory, storage capacity and consumption, backup space, Internet traffic, and SQL Audit data. They cannot view or modify your configuration or user data.
Permission types
Grant one or both permission types depending on the issue you are troubleshooting.
| Permission | When to use | Scope |
|---|---|---|
| Configure permissions | Issues related to RDS whitelists, data replication modes, backup policies, or database parameters | View and modify configuration settings in a user-defined time period |
| Data permissions | Performance issues caused by application behavior | View database and table structure, index fields, data samples, and SQL History data in a custom time period |
In all cases, the after-sales team and DBA team will not change connection information (including IP address and database account) or modify database structure, index fields, or data without your explicit authorization.
Grant permissions to the service account
-
Log on to the ApsaraDB RDS console. In the top navigation bar, select the region where your ApsaraDB RDS instance resides. Find the instance and click its ID.
-
In the left-side navigation pane, click Accounts.
-
Click the Service Account tab. Find the permission type you want to grant and turn on the switch in the Permission Status column.
-
In the dialog box that appears, set the expiration time and click OK.
Revoke permissions or change the expiration time
On the Service Account tab, turn off the switch for the permission you want to revoke, or update the expiration time. Permissions are automatically revoked when the validity period expires. You can also revoke permissions at any time.