RAM authorization-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by ApsaraDB RDS for RAM permission policies. The RAM code (RamCode) for ApsaraDB RDS is rds , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by ApsaraDB RDS. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
rds:AttachRCDisk	AttachRCDisk	none	All Resource ``	None	None
rds:ValidateImportTask	ValidateImportTask	none	All Resource ``	None	None
rds:ModifyImportTask	ModifyImportTask	update	All Resource ``	None	None
rds:DescribeAnalyticdbByPrimaryDBInstance	DescribeAnalyticdbByPrimaryDBInstance	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeReplicationLinkLogs	DescribeReplicationLinkLogs	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeDBInstanceProxyConfiguration	DescribeDBInstanceProxyConfiguration	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeSQLServerUpgradeVersions	DescribeSQLServerUpgradeVersions	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:ModifyDBInstanceSpec	ModifyDBInstanceSpec	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DeleteRCSnapshot	DeleteRCSnapshot	delete	All Resource ``	None	None
rds:UpgradeDBInstanceMajorVersionPrecheck	UpgradeDBInstanceMajorVersionPrecheck	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeCrossRegionBackupDBInstance	DescribeCrossRegionBackupDBInstance	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:CreateCloudMigrationPrecheckTask	CreateCloudMigrationPrecheckTask	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DeleteSecret	DeleteSecret	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:CheckRegionSupportBackupEncryption	CheckRegionSupportBackupEncryption	get	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:GrantOperatorPermission	GrantOperatorPermission	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CreateRCDisk	CreateRCDisk	create	All Resource ``	None	None
rds:ModifyDBInstance	ModifyDBInstance	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:ModifyDBProxyEndpoint	ModifyDBProxyEndpoint	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeDBInstancePerformance	DescribeDBInstancePerformance	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeDBInstanceIpHostname	DescribeDBInstanceIpHostname	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeDBInstanceByTags	DescribeDBInstanceByTags	get	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DetachRCDisk	DetachRCDisk	update	All Resource ``	None	None
rds:ModifyParameterTimedScheduleTask	ModifyParameterTimedScheduleTask	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:CreateDBInstanceSecurityGroupRule	CreateDBInstanceSecurityGroupRule	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeRCSnapshots	DescribeRCSnapshots	get	All Resource ``	None	None
rds:DescribeCloudMigrationResult	DescribeCloudMigrationResult	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:ModifyEventInfo	ModifyEventInfo	update	All Resource ``	None	None
rds:DeleteDBNodes	DeleteDBNodes	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeSQLCollectorRetention	DescribeSQLCollectorRetention	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeActiveOperationMaintainConf	DescribeActiveOperationMaintainConf	get	All Resource ``	None	None
rds:DeleteRCDeploymentSet	DeleteRCDeploymentSet	none	*CustomDeploymentSet `acs:rds:{#regionId}:{#accountId}:customdeploymentset/{#CustomDeploymentSetId}`	None	None
rds:DescribeDBInstanceReplication	DescribeDBInstanceReplication	get	All Resource ``	None	None
rds:StopRCInstance	StopRCInstance	update	*Custom `acs:rds:{#regionId}:{#accountId}:custom/{#InstanceId}`	None	None
rds:RunRCInstances	RunRCInstances	update	Custom `acs:rds:{#regionId}:{#accountId}:custom/`	None	None
rds:UpdateUserBackupFile	UpdateUserBackupFile	update	All Resource ``	None	None
rds:DescribeDBInstanceNetInfoForChannel	DescribeDBInstanceNetInfoForChannel	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescibeImportsFromDatabase	DescibeImportsFromDatabase	list	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeHistoryTasks	DescribeHistoryTasks	get	All Resource ``	None	None
rds:DescribeVpcs	DescribeVpcs	get	All Resource ``	None	None
rds:ReplaceRCInstanceSystemDisk	ReplaceRCInstanceSystemDisk	none	All Resource ``	None	None
rds:ModifyRCInstance	ModifyRCInstance	update	All Resource ``	None	None
rds:RebuildDBInstance	RebuildDBInstance	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeRCInstanceVncUrl	DescribeRCInstanceVncUrl	none	All Resource ``	None	None
rds:DescribeTags	DescribeTags	get	All Resource ``	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifyAccountMaskingPrivilege	ModifyAccountMaskingPrivilege	update	All Resource ``	None	None
rds:DescribeInstanceKeywords	DescribeInstanceKeywords	get	All Resource ``	None	None
rds:DescribeRCImageList	DescribeRCImageList	none	All Resource ``	None	None
rds:DescribeRCDisks	DescribeRCDisks	get	*CustomDisk `acs:rds:{#regionId}:{#accountId}:customdisk/{#DiskId}`	None	None
rds:ModifyParameterGroup	ModifyParameterGroup	update	All Resource ``	None	None
rds:ModifyMaskingRules	ModifyMaskingRules	update	All Resource ``	None	None
rds:RestoreTable	RestoreTable	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:AttachRCInstances	AttachRCInstances	create	All Resource ``	None	None
rds:ListTagResources	ListTagResources	get	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}` *Custom `acs:rds:{#regionId}:{#accountId}:custom/{#InstanceId}`	None	None
rds:MigrateDBNodes	MigrateDBNodes	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:CreateGADInstance	CreateGADInstance	create	GadInstance `acs:rds::{#accountId}:gadinstance/`	None	None
rds:CreateDBProxyEndpointAddress	CreateDBProxyEndpointAddress	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:DBProxyConnectStringNetType	None
rds:ModifyDBInstanceDescription	ModifyDBInstanceDescription	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:UpgradeDBInstanceMajorVersion	UpgradeDBInstanceMajorVersion	update	DBInstance `acs:rds::{#accountId}:dbinstance/{#DBInstanceId}`	None	None
rds:DescribeParameterGroup	DescribeParameterGroup	get	All Resource ``	None	None
rds:DeleteDBInstance	DeleteDBInstance	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifyInstanceAutoRenewalAttribute	ModifyInstanceAutoRenewalAttribute	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:ModifyResourceGroup	ModifyResourceGroup	update	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}` Custom `acs:rds:{#regionId}:{#accountId}:custom/{#InstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:AuthorizeRCSecurityGroupPermission	AuthorizeRCSecurityGroupPermission	update	All Resource ``	None	None
rds:ModifyDBInstanceMetrics	ModifyDBInstanceMetrics	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:DescribeInstanceLinkedWhitelistTemplate	DescribeInstanceLinkedWhitelistTemplate	get	All Resource ``	None	None
rds:CheckAccountNameAvailable	CheckAccountNameAvailable	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:RenewRCInstance	RenewRCInstance	create	All Resource ``	None	None
rds:RecoveryDBInstance	RecoveryDBInstance	create	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeSQLLogRecords	DescribeSQLLogRecords	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:SwitchOverMajorVersionUpgrade	SwitchOverMajorVersionUpgrade	update	All Resource ``	None	None
rds:DescribeModifyPGHbaConfigLog	DescribeModifyPGHbaConfigLog	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:AllocateInstancePublicConnection	AllocateInstancePublicConnection	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CreateImportTask	CreateImportTask	create	All Resource ``	None	None
rds:DescribeSQLLogFiles	DescribeSQLLogFiles	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:DescribeDBInstancePromoteActivity	DescribeDBInstancePromoteActivity	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeUpgradeMajorVersionTasks	DescribeUpgradeMajorVersionTasks	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:CreateDBInstanceEndpoint	CreateDBInstanceEndpoint	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:ModifyDBProxyEndpointAddress	ModifyDBProxyEndpointAddress	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:DBProxyConnectStringNetType	None
rds:DescribeSecrets	DescribeSecrets	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DeleteDBInstanceSecurityGroupRule	DeleteDBInstanceSecurityGroupRule	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeResourceDetails	DescribeResourceDetails	get	All Resource ``	None	None
rds:ModifyDBInstanceConfig	ModifyDBInstanceConfig	none	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:ModifySQLCollectorPolicy	ModifySQLCollectorPolicy	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DeleteReplicationLink	DeleteReplicationLink	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeParameters	DescribeParameters	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifyComputeBurstConfig	ModifyComputeBurstConfig	none	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:UpgradeDBInstanceKernelVersion	UpgradeDBInstanceKernelVersion	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CreateOrderForDeleteDBNodes	CreateOrderForDeleteDBNodes	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:CreateDBInstanceEndpointAddress	CreateDBInstanceEndpointAddress	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeCrossBackupMetaList	DescribeCrossBackupMetaList	get	All Resource ``	None	None
rds:DescribeActionEventPolicy	DescribeActionEventPolicy	get	All Resource ``	None	None
rds:DeleteParameterGroup	DeleteParameterGroup	delete	All Resource ``	None	None
rds:CheckInstanceExist	CheckInstanceExist	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeSlowLogs	DescribeSlowLogs	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:PurgeDBInstanceLog	PurgeDBInstanceLog	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:AllocateReadWriteSplittingConnection	AllocateReadWriteSplittingConnection	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:RenewInstance	RenewInstance	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeCrossRegionLogBackupFiles	DescribeCrossRegionLogBackupFiles	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CheckCloudResourceAuthorized	CheckCloudResourceAuthorized	get	All Resource ``	rds:ResourceTag	None
rds:DescribePGHbaConfig	DescribePGHbaConfig	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CreateRCNodePool	CreateRCNodePool	create	All Resource ``	None	None
rds:ResetAccountPassword	ResetAccountPassword	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeRenewalPrice	DescribeRenewalPrice	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:StartDBInstance	StartDBInstance	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeInstanceAutoRenewalAttribute	DescribeInstanceAutoRenewalAttribute	get	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeHADiagnoseConfig	DescribeHADiagnoseConfig	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeDBInstanceAttribute	DescribeDBInstanceAttribute	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeHostWebShell	DescribeHostWebShell	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:ModifyDBInstanceNetworkExpireTime	ModifyDBInstanceNetworkExpireTime	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:ModifyRCInstanceDescription	ModifyRCInstanceDescription	update	All Resource ``	None	None
rds:DescribeMarketingActivity	DescribeMarketingActivity	get	All Resource ``	None	None
rds:DetachGadInstanceMember	DetachGadInstanceMember	update	*GadInstance `acs:rds::{#accountId}:gadinstance/{#GadInstanceName}`	None	None
rds:DescribeDBInstanceMonitor	DescribeDBInstanceMonitor	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeWhitelistTemplate	DescribeWhitelistTemplate	get	All Resource ``	None	None
rds:DescribeDBInstanceHAConfig	DescribeDBInstanceHAConfig	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CreateReplicationLink	CreateReplicationLink	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	rds:ResourceTag	None
rds:TerminateMigrateTask	TerminateMigrateTask	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:UpgradeDBProxyInstanceKernelVersion	UpgradeDBProxyInstanceKernelVersion	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeReadDBInstanceDelay	DescribeReadDBInstanceDelay	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeRdsResourceSettings	DescribeRdsResourceSettings	get	All Resource ``	None	None
rds:ModifyDBInstanceTDE	ModifyDBInstanceTDE	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:TDEStatus	None
rds:ModifyDbProxyInstanceSsl	ModifyDbProxyInstanceSsl	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:DbProxySslEnabled	None
rds:ImportUserBackupFile	ImportUserBackupFile	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeMigrateTasks	DescribeMigrateTasks	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:AuthorizeBackupEncryption	AuthorizeBackupEncryption	update	All Resource ``	None	None
rds:CheckServiceLinkedRole	CheckServiceLinkedRole	get	All Resource ``	None	None
rds:DeleteRCClusterNodes	DeleteRCClusterNodes	delete	All Resource ``	None	None
rds:ModifySQLCollectorRetention	ModifySQLCollectorRetention	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeCloudMigrationPrecheckResult	DescribeCloudMigrationPrecheckResult	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:UntagResources	UntagResources	delete	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}` Custom `acs:rds:{#regionId}:{#accountId}:custom/{#InstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeDBProxyEndpoint	DescribeDBProxyEndpoint	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:QueryNotify	QueryNotify	get	All Resource ``	None	None
rds:ModifyADInfo	ModifyADInfo	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeDBMiniEngineVersions	DescribeDBMiniEngineVersions	get	All Resource ``	None	None
rds:ModifyRCDiskAttribute	ModifyRCDiskAttribute	update	All Resource ``	None	None
rds:DescribeParameterTimedScheduleTask	DescribeParameterTimedScheduleTask	list	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DeleteDatabase	DeleteDatabase	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifyDasInstanceConfig	ModifyDasInstanceConfig	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DeleteBackupFile	DeleteBackupFile	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:CreateTempDBInstance	CreateTempDBInstance	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeAvailableCrossRegion	DescribeAvailableCrossRegion	get	All Resource ``	None	None
rds:AddTagsToResource	AddTagsToResource	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:ModifyDBInstanceSecurityGroupRule	ModifyDBInstanceSecurityGroupRule	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:ActivateMigrationTargetInstance	ActivateMigrationTargetInstance	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:ModifyParameter	ModifyParameter	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:TLSVersion	None
rds:CreatePostgresExtensions	CreatePostgresExtensions	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:MigrateDBInstance	MigrateDBInstance	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:ModifyDBDescription	ModifyDBDescription	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:CalculateDBInstanceWeight	CalculateDBInstanceWeight	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifyDBNode	ModifyDBNode	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:ModifyDatabaseConfig	ModifyDatabaseConfig	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DeleteMaskingRules	DeleteMaskingRules	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeADInfo	DescribeADInfo	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeDBInstanceSSL	DescribeDBInstanceSSL	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifyPGHbaConfig	ModifyPGHbaConfig	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeHistoryTasksStat	DescribeHistoryTasksStat	get	All Resource ``	None	None
rds:RemoveTagsFromResource	RemoveTagsFromResource	delete	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}` DatabaseInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DBInstanceId}`	None	None
rds:CreateCloudMigrationTask	CreateCloudMigrationTask	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeHistoryEventsStat	DescribeHistoryEventsStat	list	All Resource ``	None	None
rds:CreateReadOnlyDBInstance	CreateReadOnlyDBInstance	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:MigrateToOtherZone	MigrateToOtherZone	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:ModifyActiveOperationTasks	ModifyActiveOperationTasks	update	All Resource ``	None	None
rds:ModifyBackupPolicy	ModifyBackupPolicy	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:EnableBackupLog rds:BackupLog	None
rds:DescribeDBInstancesByExpireTime	DescribeDBInstancesByExpireTime	get	All Resource ``	rds:ResourceTag	None
rds:PreCheckCreateOrderForDeleteDBNodes	PreCheckCreateOrderForDeleteDBNodes	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DeleteParameterTimedScheduleTask	DeleteParameterTimedScheduleTask	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:ModifyInstanceCrossBackupPolicy	ModifyInstanceCrossBackupPolicy	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:BackupEnabled rds:LogBackupEnabled	None
rds:CreateMigrateTask	CreateMigrateTask	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:ModifyDBInstanceConnectionString	ModifyDBInstanceConnectionString	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeHostGroupElasticStrategyParameters	DescribeHostGroupElasticStrategyParameters	get	All Resource ``	None	None
rds:DescribeHASwitchConfig	DescribeHASwitchConfig	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DeleteRCDisk	DeleteRCDisk	delete	*CustomDisk `acs:rds:{#regionId}:{#accountId}:customdisk/{#DiskId}`	None	None
rds:CreateAccount	CreateAccount	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CloneParameterGroup	CloneParameterGroup	create	All Resource ``	rds:ResourceTag	None
rds:ResizeRCInstanceDisk	ResizeRCInstanceDisk	update	*CustomDisk `acs:rds:{#regionId}:{#accountId}:customdisk/{#DiskId}`	None	None
rds:DeleteDBInstanceEndpointAddress	DeleteDBInstanceEndpointAddress	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeHistoryEvents	DescribeHistoryEvents	list	All Resource ``	None	None
rds:MigrateSecurityIPMode	MigrateSecurityIPMode	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:CancelActiveOperationTasks	CancelActiveOperationTasks	update	All Resource ``	rds:ResourceTag	None
rds:CheckBackupEncryptionAuthorized	CheckBackupEncryptionAuthorized	get	All Resource ``	rds:ResourceTag	None
rds:CreateParameterGroup	CreateParameterGroup	create	All Resource ``	None	None
rds:ModifyDBInstanceVectorSupportStatus	ModifyDBInstanceVectorSupportStatus	update	All Resource ``	None	None
rds:CreateRCSnapshot	CreateRCSnapshot	create	All Resource ``	None	None
rds:GetDBInstanceTopology	GetDBInstanceTopology	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeMaskingRules	DescribeMaskingRules	list	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:ReleaseInstancePublicConnection	ReleaseInstancePublicConnection	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:TagResources	TagResources	create	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}` *Custom `acs:rds:{#regionId}:{#accountId}:custom/{#InstanceId}`	None	None
rds:SwitchDBInstanceNetType	SwitchDBInstanceNetType	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:LockAccount	LockAccount	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeDatabases	DescribeDatabases	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:GetDbProxyInstanceSsl	GetDbProxyInstanceSsl	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeSlowLogRecords	DescribeSlowLogRecords	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifyDBInstanceDelayedReplicationTime	ModifyDBInstanceDelayedReplicationTime	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:CreateMaskingRules	CreateMaskingRules	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:EvaluateLocalExtendDisk	EvaluateLocalExtendDisk	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeBackupPolicy	DescribeBackupPolicy	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:RebuildReplicationLink	RebuildReplicationLink	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	rds:ResourceTag	None
rds:ModifyDBInstanceNetworkType	ModifyDBInstanceNetworkType	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:InstanceNetworkType	None
rds:ModifyHASwitchConfig	ModifyHASwitchConfig	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:DescribeDBInstanceSwitchLog	DescribeDBInstanceSwitchLog	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeKmsAssociateResources	DescribeKmsAssociateResources	get	All Resource ``	None	None
rds:ModifyDBInstanceEndpointAddress	ModifyDBInstanceEndpointAddress	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:ModifyDBInstanceCLS	ModifyDBInstanceCLS	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:ReleaseInstanceConnection	ReleaseInstanceConnection	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:ModifyDBInstanceReplicationSwitch	ModifyDBInstanceReplicationSwitch	update	All Resource ``	None	None
rds:DescribeDBInstanceConnectivity	DescribeDBInstanceConnectivity	get	All Resource ``	None	None
rds:ModifyReadonlyInstanceDelayReplicationTime	ModifyReadonlyInstanceDelayReplicationTime	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DBInstanceId}`	None	None
rds:DescribeModifyParameterLog	DescribeModifyParameterLog	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DeleteSlot	DeleteSlot	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeResourceUsage	DescribeResourceUsage	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeVSwitches	DescribeVSwitches	get	All Resource ``	None	None
rds:ReleaseReadWriteSplittingConnection	ReleaseReadWriteSplittingConnection	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DeleteDBProxyEndpointAddress	DeleteDBProxyEndpointAddress	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:ModifyCustinsResource	ModifyCustinsResource	update	All Resource ``	rds:ResourceTag	None
rds:ModifyActionEventPolicy	ModifyActionEventPolicy	update	All Resource ``	rds:EnableEventLog	None
rds:DescribeUpgradeMajorVersionPrecheckTask	DescribeUpgradeMajorVersionPrecheckTask	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeSlots	DescribeSlots	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeRCInstanceIpAddress	DescribeRCInstanceIpAddress	get	All Resource ``	None	None
rds:CreateRCImage	CreateRCImage	none	All Resource ``	None	None
rds:ModifyAccountCheckPolicy	ModifyAccountCheckPolicy	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeAvailableRecoveryTime	DescribeAvailableRecoveryTime	get	All Resource ``	None	None
rds:CopyDatabase	CopyDatabase	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeLocalAvailableRecoveryTime	DescribeLocalAvailableRecoveryTime	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifyDBProxyInstance	ModifyDBProxyInstance	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:DescribeDBProxyPerformance	DescribeDBProxyPerformance	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CreateDdrInstance	CreateDdrInstance	create	All Resource ``	None	None
rds:DescribeDTCSecurityIpHostsForSQLServer	DescribeDTCSecurityIpHostsForSQLServer	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DeleteAccount	DeleteAccount	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeParameterTemplates	DescribeParameterTemplates	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:UnlockAccount	UnlockAccount	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:ModifyHADiagnoseConfig	ModifyHADiagnoseConfig	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CreateServiceLinkedRole	CreateServiceLinkedRole	create	All Resource ``	None	None
rds:DescribeLogBackupFiles	DescribeLogBackupFiles	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:UpdatePostgresExtensions	UpdatePostgresExtensions	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:ModifyTaskInfo	ModifyTaskInfo	update	All Resource ``	None	None
rds:ModifyDBInstanceMonitor	ModifyDBInstanceMonitor	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CreateDBInstanceForRebuild	CreateDBInstanceForRebuild	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeActiveOperationTasks	DescribeActiveOperationTasks	get	All Resource ``	None	None
rds:DescribeRCClusterConfig	DescribeRCClusterConfig	get	All Resource ``	None	None
rds:CreateGadInstanceMember	CreateGadInstanceMember	create	All Resource ``	None	None
rds:DescribeDedicatedHosts	DescribeDedicatedHosts	get	All Resource ``	None	None
rds:ResetAccount	ResetAccount	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeWhitelistTemplateLinkedInstance	DescribeWhitelistTemplateLinkedInstance	get	All Resource ``	None	None
rds:RestoreDdrTable	RestoreDdrTable	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:PrecheckDuckDBDependency	PrecheckDuckDBDependency	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribePostgresExtensions	DescribePostgresExtensions	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:MigrateConnectionToOtherZone	MigrateConnectionToOtherZone	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DeleteBackup	DeleteBackup	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:ModifyDBInstanceMaintainTime	ModifyDBInstanceMaintainTime	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:TransformDBInstancePayType	TransformDBInstancePayType	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeCurrentModifyOrder	DescribeCurrentModifyOrder	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:ModifyDBInstanceAutoUpgradeMinorVersion	ModifyDBInstanceAutoUpgradeMinorVersion	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeSecurityGroupConfiguration	DescribeSecurityGroupConfiguration	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CreateBackup	CreateBackup	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeDBInstanceSecurityGroupRule	DescribeDBInstanceSecurityGroupRule	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DeleteADSetting	DeleteADSetting	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:ModifyBackupSetExpireTime	ModifyBackupSetExpireTime	update	All Resource ``	None	None
rds:ModifyDBInstanceSSL	ModifyDBInstanceSSL	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:SSLEnabled	None
rds:CloneDBInstance	CloneDBInstance	create	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeDBInstanceEncryptionKey	DescribeDBInstanceEncryptionKey	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeAvailableMetrics	DescribeAvailableMetrics	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeDBInstanceNetInfo	DescribeDBInstanceNetInfo	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifySecurityGroupConfiguration	ModifySecurityGroupConfiguration	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeDBInstanceMetrics	DescribeDBInstanceMetrics	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:EnableBackupEncryption	EnableBackupEncryption	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:DescribeTasks	DescribeTasks	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:StopDBInstance	StopDBInstance	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeParameterGroups	DescribeParameterGroups	get	All Resource ``	None	None
rds:DescribeBackupTasks	DescribeBackupTasks	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifySecurityIps	ModifySecurityIps	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CheckCreateDdrDBInstance	CheckCreateDdrDBInstance	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeAccountMaskingPrivilege	DescribeAccountMaskingPrivilege	list	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeRCInstanceAttribute	DescribeRCInstanceAttribute	get	All Resource ``	None	None
rds:DescribeDedicatedHostGroups	DescribeDedicatedHostGroups	get	All Resource ``	None	None
rds:DescribeRCMetricList	DescribeRCMetricList	none	All Resource ``	None	None
rds:GrantAccountPrivilege	GrantAccountPrivilege	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:StartRCInstance	StartRCInstance	update	All Resource ``	None	None
rds:CreateDBInstance	CreateDBInstance	create	All Resource ``	rds:ResourceTag rds:Engine rds:EngineVersion rds:DBInstanceClass rds:DBInstanceStorage	None
rds:DescribeCustinsResourceInfo	DescribeCustinsResourceInfo	get	All Resource ``	None	None
rds:CreateSecret	CreateSecret		*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeRCInstanceDdosCount	DescribeRCInstanceDdosCount	get	All Resource ``	None	None
rds:DescribeImportTaskValidation	DescribeImportTaskValidation	get	All Resource ``	None	None
rds:DescribeDBInstances	DescribeDBInstances	get	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CreateDBNodes	CreateDBNodes	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeDetachedBackups	DescribeDetachedBackups	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeComputeBurstConfig	DescribeComputeBurstConfig	none	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeAccounts	DescribeAccounts	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifyRCInstanceChargeType	ModifyRCInstanceChargeType	none	All Resource ``	None	None
rds:ModifyDBInstanceEndpoint	ModifyDBInstanceEndpoint	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DetachWhitelistTemplateToInstance	DetachWhitelistTemplateToInstance	delete	All Resource ``	None	None
rds:RestartDBInstance	RestartDBInstance	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:CreateOnlineDatabaseTask	CreateOnlineDatabaseTask	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeGadInstances	DescribeGadInstances	get	GadInstance `acs:rds::{#accountId}:gadinstance/`	None	None
rds:DescribeRCInstances	DescribeRCInstances	get	All Resource ``	None	None
rds:DescribeRCNodePool	DescribeRCNodePool	list	All Resource ``	None	None
rds:DescribeOssDownloads	DescribeOssDownloads	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeCrossRegionBackups	DescribeCrossRegionBackups	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:RevokeAccountPrivilege	RevokeAccountPrivilege	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DeleteRCInstances	DeleteRCInstances	delete	All Resource ``	None	None
rds:DeleteUserBackupFile	DeleteUserBackupFile	delete	All Resource ``	None	None
rds:DescribeDBInstancesByPerformance	DescribeDBInstancesByPerformance	get	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeSQLLogReportList	DescribeSQLLogReportList	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeDBInstanceIPArrayList	DescribeDBInstanceIPArrayList	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeDBInstanceEndpoints	DescribeDBInstanceEndpoints	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:AssociateEipAddressWithRCInstance	AssociateEipAddressWithRCInstance	none	All Resource ``	None	None
rds:ListImportTasks	ListImportTasks	list	All Resource ``	None	None
rds:SwitchDBInstanceVpc	SwitchDBInstanceVpc	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:SwitchReplicationLink	SwitchReplicationLink	update	All Resource ``	None	None
rds:RevokeOperatorPermission	RevokeOperatorPermission	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:ModifyDBInstancePayType	ModifyDBInstancePayType	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeMetaList	DescribeMetaList	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:DescribeImportTask	DescribeImportTask	get	All Resource ``	None	None
rds:DescribeInstanceCrossBackupPolicy	DescribeInstanceCrossBackupPolicy	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifyCollationTimeZone	ModifyCollationTimeZone	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:ConfirmNotify	ConfirmNotify	get	All Resource ``	None	None
rds:UpgradeDBInstanceEngineVersion	UpgradeDBInstanceEngineVersion	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:CheckDBNameAvailable	CheckDBNameAvailable	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribeSQLCollectorPolicy	DescribeSQLCollectorPolicy	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:ModifyDBProxy	ModifyDBProxy	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:InstanceNetworkType	None
rds:ListUserBackupFiles	ListUserBackupFiles	get	All Resource ``	None	None
rds:ModifyDTCSecurityIpHostsForSQLServer	ModifyDTCSecurityIpHostsForSQLServer	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeBackupDatabase	DescribeBackupDatabase	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:CreateYouhuiForOrder	CreateYouhuiForOrder	create	All Resource ``	None	None
rds:DescribeErrorLogs	DescribeErrorLogs	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:SwitchDBInstanceHA	SwitchDBInstanceHA	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:ModifyAccountDescription	ModifyAccountDescription	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:DescribeBackups	DescribeBackups	get	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeEvents	DescribeEvents	get	All Resource ``	None	None
rds:ModifyWhitelistTemplate	ModifyWhitelistTemplate	update	All Resource ``	None	None
rds:DescribeDBInstanceCLS	DescribeDBInstanceCLS	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DescribePrice	DescribePrice	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DeletePostgresExtensions	DeletePostgresExtensions	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DeleteGadInstance	DeleteGadInstance	delete	*GadInstance `acs:rds::{#accountId}:gadinstance/{#GadInstanceName}`	None	None
rds:CreateDatabase	CreateDatabase	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:DeleteDBInstanceEndpoint	DeleteDBInstanceEndpoint	delete	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeAllWhitelistTemplate	DescribeAllWhitelistTemplate	get	All Resource ``	None	None
rds:DescribeAvailableClasses	DescribeAvailableClasses	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:CopyDatabaseBetweenInstances	CopyDatabaseBetweenInstances	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeDBInstancesAsCsv	DescribeDBInstancesAsCsv	get	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:ModifyReadWriteSplittingConnection	ModifyReadWriteSplittingConnection	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:ModifyDBInstanceHAConfig	ModifyDBInstanceHAConfig	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:DescribeMigrateTaskById	DescribeMigrateTaskById	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:QueryRecommendByCode	QueryRecommendByCode	get	All Resource ``	None	None
rds:DescribeDBInstancesForClone	DescribeDBInstancesForClone	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:ReceiveDBInstance	ReceiveDBInstance	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:ModifyDBInstanceDeletionProtection	ModifyDBInstanceDeletionProtection	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag	None
rds:DescribeSupportOnlineResizeDisk	DescribeSupportOnlineResizeDisk	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeDBInstanceTDE	DescribeDBInstanceTDE	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None
rds:AttachWhitelistTemplateToInstance	AttachWhitelistTemplateToInstance	create	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DestroyDBInstance	DestroyDBInstance	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag	None
rds:ModifyAccountSecurityPolicy	ModifyAccountSecurityPolicy	update	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#DbInstanceId}`	None	None
rds:DescribeDBInstanceDetail	DescribeDBInstanceDetail	get	DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
rds:DescribeBinlogFiles	DescribeBinlogFiles	get	*DBInstance `acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	rds:ResourceTag rds:ResourceTag rds:ResourceTag rds:ResourceTag	None

Resource

The following table lists the resources defined by ApsaraDB RDS. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
DBInstance	acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId} acs:rds:{#regionId}:{#accountId}:dbinstance/* acs:rds::{#accountId}:dbinstance/{#DBInstanceId} acs:rds::{#accountId}:dbinstance/* acs:rds:{#Region}:{#AccountId}:dbinstance/{#DbInstanceId}
CustomDisk	acs:rds:{#regionId}:{#accountId}:customdisk/{#DiskId}
CustomDeploymentSet	acs:rds:{#regionId}:{#accountId}:customdeploymentset/{#CustomDeploymentSetId}
Custom	acs:rds:{#regionId}:{#accountId}:custom/{#InstanceId} acs:rds:{#regionId}:{#accountId}:custom/*
GadInstance	acs:rds::{#accountId}:gadinstance/* acs:rds::{#accountId}:gadinstance/{#GadInstanceName}
DatabaseInstance	acs:rds:{#regionId}:{#accountId}:dbinstance/{#DBInstanceId}

Condition

The following table lists the product-level condition keys defined by ApsaraDB RDS. You can also use Alibaba Cloud's Common condition keys. Specify these keys in the Condition element of RAM policy statements to define granular authorization rules. In the condition key, specify the condition values in the Condition_value element of the policy.

Each condition key has a specific data type, such as string, number, Boolean, or IP address. The data type determines which conditional operators can be used to compare the request values against policy values. You must specify the conditional operators compatible with the data type of the condition key. Mismatched operators will invalidate the policy. See Condition operator for valid combinations.

Condition key	Description	Data type
rds:ResourceTag	The resource tag, which forms the condition key rds:ResourceTag/<tag-key> together with the tag key. Example: If the tag is team:dev, the condition key and value are written as \\\\\\"rds:ResourceTag/team\\\\\\": \\\\\\"dev\\\\\\".	STRING
rds:EnableEventLog	Specifies whether historical event recording is enabled.	String
rds:DBInstanceStorage	The cloud disk size.	Numeric
rds:Engine	The database engine.	String
rds:InstanceNetworkType	The network type of the instance.	String
rds:LogBackupEnabled	Specifies whether cross-region log backup is enabled.	String
rds:TDEStatus	The TDE status.	String
rds:DBProxyConnectStringNetType	The network type of the dedicated proxy connection address.	String
rds:BackupLog	Specifies whether log backup is enabled.	String
rds:DiskEncryptionRequired	Specifies whether the cloud disk is encrypted.	String
rds:DbProxySslEnabled	The Secure Sockets Layer (SSL) encryption configuration.	String
rds:EngineVersion	The database engine version.	String
rds:DBInstanceClass	The instance type.	String
rds:BackupEnabled	Specifies whether the cross-region backup feature is enabled.	String
rds:EnableBackupLog	Specifies whether log backup is enabled.	String
rds:SSLEnabled	Specifies whether SSL is enabled.	String
rds:TLSVersion	The TLS version. Example: TLSv1,TLSv1.1,TLSv1.2.	String

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: