AI 助理
文档备案控制台
官方文档
首页

使用资源组进行精细化资源控制

更新时间：
复制 MD 格式
产品详情
我的收藏

当您使用资源组对资源进行分组管理时，可以结合访问控制（RAM），在单个阿里云账号内实现资源的隔离和精细化权限管理。本文总结了云数据库PolarDB对资源组的支持情况，以及资源组级别的授权操作步骤。

说明

  • 只有支持资源组的资源类型和支持资源组级别授权的操作，资源组级别授权才能生效。

  • 对于不支持资源组的资源类型，授予资源组范围的权限将无效。在选择资源范围时，请选择账号级别，进行账号级别授权。具体操作，请参见不支持资源组级别授权的操作。

资源组授权的工作原理

您可以使用资源组（Resource Group）对阿里云账号内的资源进行分组管理。例如，为不同的项目创建对应的资源组，并将资源转移到对应的组中，以便集中管理各项目的资源。更多信息，请参见什么是资源组。

在完成资源分组后，您可以为不同的RAM授权主体（RAM用户、RAM用户组或RAM角色）授予指定资源组范围的权限，从而限定这个授权主体只能管理该资源组内的资源。更多信息，请参见资源分组和授权。

这种授权方式的优点有：

  • 权限精细化：确保每个身份能获得最准确的资源访问权限，避免账号下的多个项目的资源混合管理。

  • 良好的扩展性：后续新增资源时，只需将其加入该资源组，RAM身份便会自动获得新资源的相应权限，无需再次授权。

为RAM用户授予资源组级别的权限

下面以RAM用户为例，介绍授予指定资源组内云数据库PolarDB资源权限的操作步骤。

1. 前置步骤

  1. 创建待使用的RAM用户，可参考：创建RAM用户

  2. 创建资源组并将已有资源划分到目标资源组，可参考：创建资源组，资源自动转组及资源手动转组。

2. 进行资源组级别授权

您可以通过以下任一方式进行资源组级别授权。

方式一：在资源管理控制台中授权

通过资源组的权限管理功能为指定 RAM 用户授权。详情操作可参见为RAM身份授予资源组范围的权限。

  • 登录资源组控制台。

  • 在资源组页面，单击目标资源组操作列的权限管理。

  • 在权限管理页签，单击新增授权。

  • 在新增授权面板，设置授权主体和权限策略。

    • 授权主体：选择已有RAM用户。

    • 权限策略：选择系统策略或已创建的自定义策略，参考创建自定义权限策略。

  • 单击确认新增授权。

方式二：在 RAM 控制台中授权

通过RAM控制台为指定 RAM 用户进行资源组级别授权。详细操作可参见管理RAM用户的权限。

  • 使用阿里云账号（主账号）或RAM管理员登录RAM控制台。

  • 在左侧导航栏，选择身份管理 > 用户。在用户页面，单击目标RAM用户操作列的添加权限。

  • 在新增授权面板，为RAM用户添加权限。

    • 资源范围：选择资源组级别。

    • 授权主体：选择已有 RAM 用户或前面步骤创建的 RAM 用户。

    • 权限策略：选择系统策略或已创建的自定义策略，参考创建自定义权限策略。

  • 单击确认新增授权。

支持资源组的资源类型

云数据库PolarDB支持资源组的资源类型如下表所示：

云服务

云服务代码

资源类型

云数据库PolarDB

polardb

dbcluster : 集群
说明

对于暂不支持资源组的资源类型，如有需要，您可以在资源组控制台提交反馈。

image

不支持资源组级别授权的操作

云数据库PolarDB中不支持资源组级别授权的操作（Action）如下：

操作（Action）

操作描述

polardb:AddPolarClawMCPServer

-

polardb:AddPolarFsPathMapping

-

polardb:AddPolarFsQuota

为PolarFS实例添加新的目录配额规则。

polardb:ApplyApplicationPrompts

-

polardb:AttachApplicationPolarFS

将指定的PolarFS实例挂载到PolarDB应用。

polardb:BindPolarClawAgent

-

polardb:BuyMyBaseOneClusterResource

-

polardb:CancelActiveOperationTasks

批量取消运维事件。

polardb:CancelPolarFsFileQuota

用于删除指定PolarFS实例下的一个或多个文件路径的配额规则。

polardb:CheckPolarClawSkill

-

polardb:CheckPolarFsQuotaConsistency

-

polardb:CheckServiceLinkedRole

调用 CheckServiceLinkedRole 接口查看是否已创建服务关联角色。

polardb:ClonePolarFsBasicSnapshot

-

polardb:CreateAIDBCluster

-

polardb:CreateAIDBClusterApiKey

-

polardb:CreateAIDBClusterTask

-

polardb:CreateActivationCode

生成轻量化版本激活码。

polardb:CreateApplicationBackup

-

polardb:CreateApplicationEndpointAddress

为指定的应用创建一个新的连接地址。

polardb:CreateApplicationPrompt

-

polardb:CreateBatchTask

-

polardb:CreateBudgetPolicy

-

polardb:CreateConsumer

-

polardb:CreateConsumerGroup

-

polardb:CreateCostRule

-

polardb:CreateDataProcessJob

-

polardb:CreateDataProcessJobTemplate

-

polardb:CreateFallBack

-

polardb:CreateGDNAddress

-

polardb:CreateGateway

-

polardb:CreateGlobalDataNetwork

创建一个新的 PolarFS 全球数据网络（GDN）。

polardb:CreateModelApi

-

polardb:CreateModelService

-

polardb:CreateOrGetVirtualLicenseOrder

创建或获取虚拟证书订单。

polardb:CreatePolarClawAgent

-

polardb:CreatePolarClawChannel

-

polardb:CreatePolarClawCronJob

-

polardb:CreatePolarClawSkill

-

polardb:CreatePolarClawSkillTemplate

-

polardb:CreatePolarFs

-

polardb:CreatePolarFsObject

-

polardb:CreateProtectedDB

-

polardb:CreateRateLimitPolicy

-

polardb:CreateServiceLinkedRole

调用 CreateServiceLinkedRole 接口创建服务关联角色。

polardb:CreateStoragePlan

购买存储包。

polardb:DeleteAIDBClusterApiKey

-

polardb:DeleteApplication

删除指定的PolarDB应用，不会删除PolarDB实例本身。

polardb:DeleteApplicationBackup

-

polardb:DeleteApplicationEndpointAddress

用于删除指定PolarDB应用的特定连接地址。

polardb:DeleteApplicationPrompt

-

polardb:DeleteBudgetPolicy

-

polardb:DeleteConsumer

-

polardb:DeleteConsumerGroup

-

polardb:DeleteCostRule

-

polardb:DeleteDataProcessJob

-

polardb:DeleteDataProcessJobTemplate

-

polardb:DeleteDatabaseZonal

删除PolarDB边缘云集群数据库

polardb:DeleteGDNAddress

-

polardb:DeleteGateway

-

polardb:DeleteGlobalDataNetwork

删除 PolarFS 全球数据网络（GDN）。

polardb:DeleteInspectionTask

-

polardb:DeleteModelApi

-

polardb:DeleteModelService

-

polardb:DeletePolarClawAgent

-

polardb:DeletePolarClawChannel

-

polardb:DeletePolarClawCronJob

-

polardb:DeletePolarClawSkill

-

polardb:DeletePolarClawSkillTemplate

-

polardb:DeletePolarFs

-

polardb:DeletePolarFsObjects

-

polardb:DeletePolarFsPathMapping

-

polardb:DeletePolarFsQuota

用于删除指定PolarFS实例下的一个或多个Quota规则。

polardb:DeleteRateLimitPolicy

-

polardb:DescribeAIAgentOrder

-

polardb:DescribeAIDBClusterApiKeys

-

polardb:DescribeAIDBClusterDatasets

-

polardb:DescribeActivationCodeDetails

查询激活码详情。

polardb:DescribeActivationCodes

查询激活码列表。

polardb:DescribeActiveOperationTask

-

polardb:DescribeActiveOperationTaskRegion

-

polardb:DescribeActiveOperationTaskType

-

polardb:DescribeActiveOperationTasks

查询实例的运维事件详情。

polardb:DescribeAnswer

-

polardb:DescribeApplicationAttribute

获取指定PolarDB实例应用的详细信息。

polardb:DescribeApplicationAvailableModels

-

polardb:DescribeApplicationAvailableVersion

-

polardb:DescribeApplicationBackupPolicy

-

polardb:DescribeApplicationBackups

-

polardb:DescribeApplicationComponentPerformance

-

polardb:DescribeApplicationLogs

-

polardb:DescribeApplicationParameters

获取指定应用及其组件的当前参数和模板信息。

polardb:DescribeApplicationPerformance

-

polardb:DescribeApplicationPrompts

-

polardb:DescribeApplicationServerlessConf

查询PolarDB应用Serverless配置

polardb:DescribeApplicationSessionIds

-

polardb:DescribeApplicationSessionLogs

-

polardb:DescribeAvailableCrossRegions

查询跨地域备份可用地域列表。

polardb:DescribeAvailableModels

-

polardb:DescribeBackupRegions

查询备份集所在地域信息。

polardb:DescribeBatchTask

-

polardb:DescribeBatchTasks

-

polardb:DescribeBudgetPolicies

-

polardb:DescribeBudgetUsage

-

polardb:DescribeConsumerGroups

-

polardb:DescribeConsumers

-

polardb:DescribeCostRules

-

polardb:DescribeCrossCloudLevels

查询跨云支持的规格列表。

polardb:DescribeCrossCloudRegion

查询跨云开区信息。

polardb:DescribeCrossCloudRegionMappingToAliyun

查询跨云地域映射。

polardb:DescribeDBClusterAttributeZonal

-

polardb:DescribeDBClusterAvailableResources

-

polardb:DescribeDBClusterBasicInfo

-

polardb:DescribeDBClusterExpireInfo

-

polardb:DescribeDBClusterNodeInfo

-

polardb:DescribeDBClusterUsage

-

polardb:DescribeDBDefaultValueByGcLevel

-

polardb:DescribeDBInstances

-

polardb:DescribeDBMiniEngineVersions

查询可用内核小版本列表

polardb:DescribeDBNodePerformanceDup

-

polardb:DescribeDataProcessJobAttribute

-

polardb:DescribeDataProcessJobTemplates

-

polardb:DescribeDataProcessJobs

-

polardb:DescribeEdgeCloudRegion

-

polardb:DescribeEventMetaInfo

-

polardb:DescribeFileSystems

-

polardb:DescribeGatewayAttribute

-

polardb:DescribeGatewayList

-

polardb:DescribeGlobalDataNetworkList

查询所有地域的 PolarFS 全球数据网络（GDN）详情。

polardb:DescribeHistoryEventsStat

-

polardb:DescribeHotSpotQuestion

-

polardb:DescribeInspectionReportList

-

polardb:DescribeInspectionTaskAttribute

-

polardb:DescribeInspectionTaskList

-

polardb:DescribeInstanceReportAttribute

-

polardb:DescribeInstanceReportLists

-

polardb:DescribeKVCacheInstanceAttribute

-

polardb:DescribeKVCacheInstances

-

polardb:DescribeLicenseOrderDetails

查看License订单详情。

polardb:DescribeLicenseOrders

查询License订单列表。

polardb:DescribeModelApis

-

polardb:DescribeModelServices

-

polardb:DescribePolarAgentChatRecords

-

polardb:DescribePolarAgentSessionStatus

-

polardb:DescribePolarAgentUserSessions

-

polardb:DescribePolarClawAgents

-

polardb:DescribePolarClawChannels

-

polardb:DescribePolarClawCronJobs

-

polardb:DescribePolarClawMCPServers

-

polardb:DescribePolarClawPlugins

-

polardb:DescribePolarClawSkillAssessment

-

polardb:DescribePolarClawSkillTemplate

-

polardb:DescribePolarClawSkillTemplates

-

polardb:DescribePolarClawSkills

-

polardb:DescribePolarClawSkillsMarket

-

polardb:DescribePolarFs

-

polardb:DescribePolarFsAttribute

获取PolarFS实例详情

polardb:DescribePolarFsObjects

-

polardb:DescribePolarFsPerformance

-

polardb:DescribePolarFsQuota

获取指定PolarFS实例下的全部配额规则信息。

polardb:DescribePolarFsQuotaList

-

polardb:DescribeQuestions

-

polardb:DescribeRateLimitPolicy

-

polardb:DescribeRdsVSwitchs

查询虚拟交换机列表

polardb:DescribeRegions

-

polardb:DescribeResourcePackages

查询跨云资源包列表。

polardb:DescribeSqlLogClusters

-

polardb:DescribeTaskInfo

-

polardb:DescribeUpgradeReport

查询校验报告

polardb:DescribeVSwitchList

查询交换机信息

polardb:DisablePolarClawChannel

-

polardb:DisablePolarClawCronJob

-

polardb:DisablePolarClawPlugin

-

polardb:EnablePolarClawChannel

-

polardb:EnablePolarClawCronJob

-

polardb:EnablePolarClawPlugin

-

polardb:ExecuteCrossCloudOpenAPI

调用跨云 OpenAPI。

polardb:GenerateUpgradeReportForSyncClone

生成校验报告

polardb:GetPolarAgent

-

polardb:GetPolarClawConfig

-

polardb:GetPolarClawSkillRegion

-

polardb:InstallPolarClawPlugin

-

polardb:InstallPolarClawSkills

-

polardb:LightQueryPricing

-

polardb:ListPolarClawBindings

-

polardb:ListTagResourcesForRegion

查询region下资源tag。

polardb:LockDBClusterDeletion

-

polardb:ModifyAIDBClusterDataset

-

polardb:ModifyActiveOperationMaintainConf

配置用户的运维信息，目前包括主动运维窗口信息

polardb:ModifyActiveOperationTask

-

polardb:ModifyApplicationBackupPolicy

-

polardb:ModifyApplicationDescription

用于更新PolarDB应用的描述信息。

polardb:ModifyApplicationParameter

用于修改PolarDB应用中指定子组件的配置参数。

polardb:ModifyApplicationPrompt

-

polardb:ModifyApplicationServerlessConf

修改PolarDB应用Serverless配置

polardb:ModifyApplicationWhitelist

用于修改PolarDB应用的IP白名单和安全组配置。

polardb:ModifyBudgetPolicy

-

polardb:ModifyConsumerGroup

-

polardb:ModifyCostRule

-

polardb:ModifyGDNAddress

-

polardb:ModifyModelApi

-

polardb:ModifyModelService

-

polardb:ModifyPolarClawSkill

-

polardb:ModifyPolarFs

-

polardb:ModifyPolarFsInstanceDescription

-

polardb:ModifyRateLimitPolicy

-

polardb:ModifyResourcePackage

配置跨云资源包。

polardb:ModifyTaskInfo

-

polardb:MountPolarFsOnAIDBCluster

-

polardb:MovePolarFsObjects

-

polardb:OperateApplication

-

polardb:PatchPolarClawConfig

-

polardb:ReactivateDBClusterBackup

重新开启备份功能。

polardb:RefreshDBClusterStorageUsage

更新集群实例存储使用量。

polardb:RemoveApplicationEnvironmentVariables

-

polardb:RemovePolarClawMCPServer

-

polardb:ResetConsumerApiKey

-

polardb:ResetGlobalDatabaseNetwork

重建GDN中的从集群网络。

polardb:RestoreApplicationByBackupSet

-

polardb:RunInspectionTask

-

polardb:RunPolarClawCronJob

-

polardb:SearchMemories

-

polardb:SetPolarFsFileQuota

设置PolarFS实例中指定目录的文件配额规则。

polardb:StopDataProcessJob

-

polardb:UnbindPolarClawAgent

-

polardb:UninstallPolarClawPlugin

-

polardb:UninstallPolarClawSkills

-

polardb:UnlockDBClusterDeletion

-

polardb:UnmountPolarFsOnAIDBCluster

-

polardb:UpdateApplicationEnvironmentVariables

-

polardb:UpdatePolarClawAgent

-

polardb:UpdatePolarClawCronJob

-

polardb:UpgradeApplicationVersion

-

polardb:UpgradePolarClawChannel

-

polardb:UpgradePolarClawPlugin

-

polardb:UpgradePolarClawSkills

-

polardb:null

-

对于不支持资源组授权的操作，授权时资源范围选择资源组级别将无效。如果仍需要RAM用户有上述操作权限，您需要创建自定义权限策略，授权时资源范围选择账号级别。

image.png以下是两个自定义权限策略示例，您可以根据实际需要调整策略内容。

  • 允许不支持资源组级别授权的全部只读操作：Action中列举不支持资源组级别授权的所有只读操作。

    {
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "polardb:DescribeAIAgentOrder",
        "polardb:DescribeAIDBClusterApiKeys",
        "polardb:DescribeAIDBClusterDatasets",
        "polardb:DescribeActivationCodeDetails",
        "polardb:DescribeActivationCodes",
        "polardb:DescribeActiveOperationTask",
        "polardb:DescribeActiveOperationTaskRegion",
        "polardb:DescribeActiveOperationTaskType",
        "polardb:DescribeActiveOperationTasks",
        "polardb:DescribeAnswer",
        "polardb:DescribeApplicationAttribute",
        "polardb:DescribeApplicationAvailableModels",
        "polardb:DescribeApplicationAvailableVersion",
        "polardb:DescribeApplicationBackupPolicy",
        "polardb:DescribeApplicationBackups",
        "polardb:DescribeApplicationComponentPerformance",
        "polardb:DescribeApplicationLogs",
        "polardb:DescribeApplicationParameters",
        "polardb:DescribeApplicationPerformance",
        "polardb:DescribeApplicationPrompts",
        "polardb:DescribeApplicationServerlessConf",
        "polardb:DescribeApplicationSessionIds",
        "polardb:DescribeApplicationSessionLogs",
        "polardb:DescribeAvailableCrossRegions",
        "polardb:DescribeAvailableModels",
        "polardb:DescribeBackupRegions",
        "polardb:DescribeBatchTask",
        "polardb:DescribeBatchTasks",
        "polardb:DescribeBudgetPolicies",
        "polardb:DescribeBudgetUsage",
        "polardb:DescribeConsumerGroups",
        "polardb:DescribeConsumers",
        "polardb:DescribeCostRules",
        "polardb:DescribeCrossCloudLevels",
        "polardb:DescribeCrossCloudRegion",
        "polardb:DescribeCrossCloudRegionMappingToAliyun",
        "polardb:DescribeDBClusterAttributeZonal",
        "polardb:DescribeDBClusterAvailableResources",
        "polardb:DescribeDBClusterBasicInfo",
        "polardb:DescribeDBClusterExpireInfo",
        "polardb:DescribeDBClusterNodeInfo",
        "polardb:DescribeDBClusterUsage",
        "polardb:DescribeDBDefaultValueByGcLevel",
        "polardb:DescribeDBInstances",
        "polardb:DescribeDBMiniEngineVersions",
        "polardb:DescribeDBNodePerformanceDup",
        "polardb:DescribeDataProcessJobAttribute",
        "polardb:DescribeDataProcessJobTemplates",
        "polardb:DescribeDataProcessJobs",
        "polardb:DescribeEdgeCloudRegion",
        "polardb:DescribeEventMetaInfo",
        "polardb:DescribeFileSystems",
        "polardb:DescribeGatewayAttribute",
        "polardb:DescribeGatewayList",
        "polardb:DescribeGlobalDataNetworkList",
        "polardb:DescribeHistoryEventsStat",
        "polardb:DescribeHotSpotQuestion",
        "polardb:DescribeInspectionReportList",
        "polardb:DescribeInspectionTaskAttribute",
        "polardb:DescribeInspectionTaskList",
        "polardb:DescribeInstanceReportAttribute",
        "polardb:DescribeInstanceReportLists",
        "polardb:DescribeKVCacheInstanceAttribute",
        "polardb:DescribeKVCacheInstances",
        "polardb:DescribeLicenseOrderDetails",
        "polardb:DescribeLicenseOrders",
        "polardb:DescribeModelApis",
        "polardb:DescribeModelServices",
        "polardb:DescribePolarAgentChatRecords",
        "polardb:DescribePolarAgentSessionStatus",
        "polardb:DescribePolarAgentUserSessions",
        "polardb:DescribePolarClawAgents",
        "polardb:DescribePolarClawChannels",
        "polardb:DescribePolarClawCronJobs",
        "polardb:DescribePolarClawMCPServers",
        "polardb:DescribePolarClawPlugins",
        "polardb:DescribePolarClawSkillAssessment",
        "polardb:DescribePolarClawSkillTemplate",
        "polardb:DescribePolarClawSkillTemplates",
        "polardb:DescribePolarClawSkills",
        "polardb:DescribePolarClawSkillsMarket",
        "polardb:DescribePolarFs",
        "polardb:DescribePolarFsAttribute",
        "polardb:DescribePolarFsObjects",
        "polardb:DescribePolarFsPerformance",
        "polardb:DescribePolarFsQuota",
        "polardb:DescribePolarFsQuotaList",
        "polardb:DescribeQuestions",
        "polardb:DescribeRateLimitPolicy",
        "polardb:DescribeRdsVSwitchs",
        "polardb:DescribeRegions",
        "polardb:DescribeResourcePackages",
        "polardb:DescribeSqlLogClusters",
        "polardb:DescribeTaskInfo",
        "polardb:DescribeUpgradeReport",
        "polardb:DescribeVSwitchList"
      ],
      "Resource": "*"
    }
  ]
}

  • 允许不支持资源组级别授权的全部操作：Action中列举不支持资源组级别授权的全部操作。

    {
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "polardb:AddPolarClawMCPServer",
        "polardb:AddPolarFsPathMapping",
        "polardb:AddPolarFsQuota",
        "polardb:ApplyApplicationPrompts",
        "polardb:AttachApplicationPolarFS",
        "polardb:BindPolarClawAgent",
        "polardb:BuyMyBaseOneClusterResource",
        "polardb:CancelActiveOperationTasks",
        "polardb:CancelPolarFsFileQuota",
        "polardb:CheckPolarClawSkill",
        "polardb:CheckPolarFsQuotaConsistency",
        "polardb:CheckServiceLinkedRole",
        "polardb:ClonePolarFsBasicSnapshot",
        "polardb:CreateAIDBCluster",
        "polardb:CreateAIDBClusterApiKey",
        "polardb:CreateAIDBClusterTask",
        "polardb:CreateActivationCode",
        "polardb:CreateApplicationBackup",
        "polardb:CreateApplicationEndpointAddress",
        "polardb:CreateApplicationPrompt",
        "polardb:CreateBatchTask",
        "polardb:CreateBudgetPolicy",
        "polardb:CreateConsumer",
        "polardb:CreateConsumerGroup",
        "polardb:CreateCostRule",
        "polardb:CreateDataProcessJob",
        "polardb:CreateDataProcessJobTemplate",
        "polardb:CreateFallBack",
        "polardb:CreateGDNAddress",
        "polardb:CreateGateway",
        "polardb:CreateGlobalDataNetwork",
        "polardb:CreateModelApi",
        "polardb:CreateModelService",
        "polardb:CreateOrGetVirtualLicenseOrder",
        "polardb:CreatePolarClawAgent",
        "polardb:CreatePolarClawChannel",
        "polardb:CreatePolarClawCronJob",
        "polardb:CreatePolarClawSkill",
        "polardb:CreatePolarClawSkillTemplate",
        "polardb:CreatePolarFs",
        "polardb:CreatePolarFsObject",
        "polardb:CreateProtectedDB",
        "polardb:CreateRateLimitPolicy",
        "polardb:CreateServiceLinkedRole",
        "polardb:CreateStoragePlan",
        "polardb:DeleteAIDBClusterApiKey",
        "polardb:DeleteApplication",
        "polardb:DeleteApplicationBackup",
        "polardb:DeleteApplicationEndpointAddress",
        "polardb:DeleteApplicationPrompt",
        "polardb:DeleteBudgetPolicy",
        "polardb:DeleteConsumer",
        "polardb:DeleteConsumerGroup",
        "polardb:DeleteCostRule",
        "polardb:DeleteDataProcessJob",
        "polardb:DeleteDataProcessJobTemplate",
        "polardb:DeleteDatabaseZonal",
        "polardb:DeleteGDNAddress",
        "polardb:DeleteGateway",
        "polardb:DeleteGlobalDataNetwork",
        "polardb:DeleteInspectionTask",
        "polardb:DeleteModelApi",
        "polardb:DeleteModelService",
        "polardb:DeletePolarClawAgent",
        "polardb:DeletePolarClawChannel",
        "polardb:DeletePolarClawCronJob",
        "polardb:DeletePolarClawSkill",
        "polardb:DeletePolarClawSkillTemplate",
        "polardb:DeletePolarFs",
        "polardb:DeletePolarFsObjects",
        "polardb:DeletePolarFsPathMapping",
        "polardb:DeletePolarFsQuota",
        "polardb:DeleteRateLimitPolicy",
        "polardb:DescribeAIAgentOrder",
        "polardb:DescribeAIDBClusterApiKeys",
        "polardb:DescribeAIDBClusterDatasets",
        "polardb:DescribeActivationCodeDetails",
        "polardb:DescribeActivationCodes",
        "polardb:DescribeActiveOperationTask",
        "polardb:DescribeActiveOperationTaskRegion",
        "polardb:DescribeActiveOperationTaskType",
        "polardb:DescribeActiveOperationTasks",
        "polardb:DescribeAnswer",
        "polardb:DescribeApplicationAttribute",
        "polardb:DescribeApplicationAvailableModels",
        "polardb:DescribeApplicationAvailableVersion",
        "polardb:DescribeApplicationBackupPolicy",
        "polardb:DescribeApplicationBackups",
        "polardb:DescribeApplicationComponentPerformance",
        "polardb:DescribeApplicationLogs",
        "polardb:DescribeApplicationParameters",
        "polardb:DescribeApplicationPerformance",
        "polardb:DescribeApplicationPrompts",
        "polardb:DescribeApplicationServerlessConf",
        "polardb:DescribeApplicationSessionIds",
        "polardb:DescribeApplicationSessionLogs",
        "polardb:DescribeAvailableCrossRegions",
        "polardb:DescribeAvailableModels",
        "polardb:DescribeBackupRegions",
        "polardb:DescribeBatchTask",
        "polardb:DescribeBatchTasks",
        "polardb:DescribeBudgetPolicies",
        "polardb:DescribeBudgetUsage",
        "polardb:DescribeConsumerGroups",
        "polardb:DescribeConsumers",
        "polardb:DescribeCostRules",
        "polardb:DescribeCrossCloudLevels",
        "polardb:DescribeCrossCloudRegion",
        "polardb:DescribeCrossCloudRegionMappingToAliyun",
        "polardb:DescribeDBClusterAttributeZonal",
        "polardb:DescribeDBClusterAvailableResources",
        "polardb:DescribeDBClusterBasicInfo",
        "polardb:DescribeDBClusterExpireInfo",
        "polardb:DescribeDBClusterNodeInfo",
        "polardb:DescribeDBClusterUsage",
        "polardb:DescribeDBDefaultValueByGcLevel",
        "polardb:DescribeDBInstances",
        "polardb:DescribeDBMiniEngineVersions",
        "polardb:DescribeDBNodePerformanceDup",
        "polardb:DescribeDataProcessJobAttribute",
        "polardb:DescribeDataProcessJobTemplates",
        "polardb:DescribeDataProcessJobs",
        "polardb:DescribeEdgeCloudRegion",
        "polardb:DescribeEventMetaInfo",
        "polardb:DescribeFileSystems",
        "polardb:DescribeGatewayAttribute",
        "polardb:DescribeGatewayList",
        "polardb:DescribeGlobalDataNetworkList",
        "polardb:DescribeHistoryEventsStat",
        "polardb:DescribeHotSpotQuestion",
        "polardb:DescribeInspectionReportList",
        "polardb:DescribeInspectionTaskAttribute",
        "polardb:DescribeInspectionTaskList",
        "polardb:DescribeInstanceReportAttribute",
        "polardb:DescribeInstanceReportLists",
        "polardb:DescribeKVCacheInstanceAttribute",
        "polardb:DescribeKVCacheInstances",
        "polardb:DescribeLicenseOrderDetails",
        "polardb:DescribeLicenseOrders",
        "polardb:DescribeModelApis",
        "polardb:DescribeModelServices",
        "polardb:DescribePolarAgentChatRecords",
        "polardb:DescribePolarAgentSessionStatus",
        "polardb:DescribePolarAgentUserSessions",
        "polardb:DescribePolarClawAgents",
        "polardb:DescribePolarClawChannels",
        "polardb:DescribePolarClawCronJobs",
        "polardb:DescribePolarClawMCPServers",
        "polardb:DescribePolarClawPlugins",
        "polardb:DescribePolarClawSkillAssessment",
        "polardb:DescribePolarClawSkillTemplate",
        "polardb:DescribePolarClawSkillTemplates",
        "polardb:DescribePolarClawSkills",
        "polardb:DescribePolarClawSkillsMarket",
        "polardb:DescribePolarFs",
        "polardb:DescribePolarFsAttribute",
        "polardb:DescribePolarFsObjects",
        "polardb:DescribePolarFsPerformance",
        "polardb:DescribePolarFsQuota",
        "polardb:DescribePolarFsQuotaList",
        "polardb:DescribeQuestions",
        "polardb:DescribeRateLimitPolicy",
        "polardb:DescribeRdsVSwitchs",
        "polardb:DescribeRegions",
        "polardb:DescribeResourcePackages",
        "polardb:DescribeSqlLogClusters",
        "polardb:DescribeTaskInfo",
        "polardb:DescribeUpgradeReport",
        "polardb:DescribeVSwitchList",
        "polardb:DisablePolarClawChannel",
        "polardb:DisablePolarClawCronJob",
        "polardb:DisablePolarClawPlugin",
        "polardb:EnablePolarClawChannel",
        "polardb:EnablePolarClawCronJob",
        "polardb:EnablePolarClawPlugin",
        "polardb:ExecuteCrossCloudOpenAPI",
        "polardb:GenerateUpgradeReportForSyncClone",
        "polardb:GetPolarAgent",
        "polardb:GetPolarClawConfig",
        "polardb:GetPolarClawSkillRegion",
        "polardb:InstallPolarClawPlugin",
        "polardb:InstallPolarClawSkills",
        "polardb:LightQueryPricing",
        "polardb:ListPolarClawBindings",
        "polardb:ListTagResourcesForRegion",
        "polardb:LockDBClusterDeletion",
        "polardb:ModifyAIDBClusterDataset",
        "polardb:ModifyActiveOperationMaintainConf",
        "polardb:ModifyActiveOperationTask",
        "polardb:ModifyApplicationBackupPolicy",
        "polardb:ModifyApplicationDescription",
        "polardb:ModifyApplicationParameter",
        "polardb:ModifyApplicationPrompt",
        "polardb:ModifyApplicationServerlessConf",
        "polardb:ModifyApplicationWhitelist",
        "polardb:ModifyBudgetPolicy",
        "polardb:ModifyConsumerGroup",
        "polardb:ModifyCostRule",
        "polardb:ModifyGDNAddress",
        "polardb:ModifyModelApi",
        "polardb:ModifyModelService",
        "polardb:ModifyPolarClawSkill",
        "polardb:ModifyPolarFs",
        "polardb:ModifyPolarFsInstanceDescription",
        "polardb:ModifyRateLimitPolicy",
        "polardb:ModifyResourcePackage",
        "polardb:ModifyTaskInfo",
        "polardb:MountPolarFsOnAIDBCluster",
        "polardb:MovePolarFsObjects",
        "polardb:OperateApplication",
        "polardb:PatchPolarClawConfig",
        "polardb:ReactivateDBClusterBackup",
        "polardb:RefreshDBClusterStorageUsage",
        "polardb:RemoveApplicationEnvironmentVariables",
        "polardb:RemovePolarClawMCPServer",
        "polardb:ResetConsumerApiKey",
        "polardb:ResetGlobalDatabaseNetwork",
        "polardb:RestoreApplicationByBackupSet",
        "polardb:RunInspectionTask",
        "polardb:RunPolarClawCronJob",
        "polardb:SearchMemories",
        "polardb:SetPolarFsFileQuota",
        "polardb:StopDataProcessJob",
        "polardb:UnbindPolarClawAgent",
        "polardb:UninstallPolarClawPlugin",
        "polardb:UninstallPolarClawSkills",
        "polardb:UnlockDBClusterDeletion",
        "polardb:UnmountPolarFsOnAIDBCluster",
        "polardb:UpdateApplicationEnvironmentVariables",
        "polardb:UpdatePolarClawAgent",
        "polardb:UpdatePolarClawCronJob",
        "polardb:UpgradeApplicationVersion",
        "polardb:UpgradePolarClawChannel",
        "polardb:UpgradePolarClawPlugin",
        "polardb:UpgradePolarClawSkills",
        "polardb:null"
      ],
      "Resource": "*"
    }
  ]
}
重要

获得账号级别权限的RAM用户或RAM角色，能够操作整个账号范围内的相关资源。请务必确认所授予的权限是否符合预期，遵从最小授权原则谨慎分配权限。

常见问题

如何查看当前资源属于哪个资源组？

  • 方式一：单击资源名称，进入资源的详情页面，即可查看到当前资源的资源组。

  • 方式二：登录资源管理控制台，单击资源中心 > 资源搜索，在左侧选择目标资源所属账号（默认为当前账号），通过筛选条件定位目标资源，即可查看其所属资源组。

如何查看当前产品在某个资源组下的所有资源？

  • 方式一：登录资源管理控制台，单击资源中心 > 资源搜索，然后在左侧的资源所属账号（默认为当前账号）下选择单击目标资源组名称，最后在右侧的选择资源类型中选择当前产品，即可查看当前产品在某个资源组下的所有资源。

  • 方式二：登录资源管理控制台，单击资源组 > 资源组，然后找到目标资源组，单击其所在行的操作列下的资源管理，最后在资源管理页面上方的产品下拉框中选择当前产品，即可查看当前产品在某个资源组下的所有资源。

如何批量修改多个资源的资源组？

登录资源管理控制台，单击资源组 > 资源组，在目标资源组所在行的操作列下，单击资源管理以进入资源管理页面。通过筛选条件定位多个目标资源，批量勾选第一列的复选框后单击下方转移资源组，并按页面提示完成资源组修改。

上一篇：云原生数据库PolarDB自定义权限策略参考下一篇：PolarDB-X服务关联角色