Custom policies for ApsaraDB for SelectDB-ApsaraDB for SelectDB(SelectDB)-阿里云帮助中心

When system policies don't give you the granularity your business requires, create custom RAM policies to enforce least privilege. Use the sample policies below as a starting point for common permission scenarios.

What is a custom policy?

Resource Access Management (RAM) policies fall into two categories: system policies and custom policies. Unlike system policies, custom policies are created, versioned, and deleted by you.

Key behaviors:

A custom policy grants permissions only after you attach it to a RAM user, RAM user group, or RAM role.
To delete a policy already attached to a principal, detach it first, then delete it.
RAM provides built-in version management for custom policies so you can track and roll back changes.

References

Permission control scope

Important

ApsaraDB for SelectDB supports operation-specific permission control only. Resource-specific permission control is not supported.

Sample policies

The following examples cover the most common permission scenarios. Each policy uses a single statement with "Effect": "Allow" and targets all instances ("Resource": ["*"]).

Allow whitelist management

Grants a RAM user permission to list all SelectDB instances and view or modify their IP whitelists.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "selectdb:DescribeDBInstances",
        "selectdb:DescribeSecurityIPList",
        "selectdb:ModifySecurityIPList"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {}
    }
  ]
}

Field	Value	Description
`Effect`	`Allow`	Permits the listed actions.
`Action`	Three `selectdb:` actions	`DescribeDBInstances` lists instances; `DescribeSecurityIPList` reads the whitelist; `ModifySecurityIPList` updates it.
`Resource`	`"*"`	Applies to all SelectDB instances in the Alibaba Cloud account. Resource-specific scoping is not supported.
`Condition`	`{}`	No additional conditions.

Allow public endpoint management

Grants a RAM user permission to list all SelectDB instances and view, request, or release their public endpoints.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "selectdb:DescribeDBInstances",
        "selectdb:AllocateInstancePublicConnection",
        "selectdb:ReleaseInstancePublicConnection",
        "selectdb:DescribeDBInstanceNetInfo"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {}
    }
  ]
}

Field	Value	Description
`Effect`	`Allow`	Permits the listed actions.
`Action`	Four `selectdb:` actions	`DescribeDBInstances` lists instances; `DescribeDBInstanceNetInfo` reads network details; `AllocateInstancePublicConnection` enables a public endpoint; `ReleaseInstancePublicConnection` removes it.
`Resource`	`"*"`	Applies to all SelectDB instances in the Alibaba Cloud account.
`Condition`	`{}`	No additional conditions.

Authorization information

For the full list of supported actions, see RAM authorization.