- Release Notes
- Product Introduction
- Purchase Guide
- Getting Started
- Operation Guide
- TcaplusDB Client
- TcaplusDB SDK
- TcaplusDB RESTful APIs
- Practical Tutorial
- FAQs
- API Documentation
- History
- Introduction
- API Category
- Making API Requests
- Table Group APIs
- Other APIs
- Table APIs
- VerifyIdlFiles
- RollbackTables
- RecoverRecycleTables
- ModifyTables
- ModifyTableQuotas
- ModifyTableMemos
- DescribeTablesInRecycle
- DescribeTables
- DescribeIdlFileInfos
- DeleteTables
- CreateTables
- CreateBackup
- CompareIdlFiles
- ClearTables
- ModifyTableTags
- DescribeTableTags
- SetTableIndex
- DeleteTableIndex
- ModifySnapshots
- ImportSnapshots
- DescribeSnapshots
- DeleteSnapshots
- CreateSnapshots
- UpdateApply
- MergeTablesData
- SetTableDataFlow
- DeleteTableDataFlow
- SetBackupExpireRule
- DeleteBackupRecords
- Cluster APIs
- Data Types
- Error Codes
- Service Agreement
- Glossary
- Contact Us
- Release Notes
- Product Introduction
- Purchase Guide
- Getting Started
- Operation Guide
- TcaplusDB Client
- TcaplusDB SDK
- TcaplusDB RESTful APIs
- Practical Tutorial
- FAQs
- API Documentation
- History
- Introduction
- API Category
- Making API Requests
- Table Group APIs
- Other APIs
- Table APIs
- VerifyIdlFiles
- RollbackTables
- RecoverRecycleTables
- ModifyTables
- ModifyTableQuotas
- ModifyTableMemos
- DescribeTablesInRecycle
- DescribeTables
- DescribeIdlFileInfos
- DeleteTables
- CreateTables
- CreateBackup
- CompareIdlFiles
- ClearTables
- ModifyTableTags
- DescribeTableTags
- SetTableIndex
- DeleteTableIndex
- ModifySnapshots
- ImportSnapshots
- DescribeSnapshots
- DeleteSnapshots
- CreateSnapshots
- UpdateApply
- MergeTablesData
- SetTableDataFlow
- DeleteTableDataFlow
- SetBackupExpireRule
- DeleteBackupRecords
- Cluster APIs
- Data Types
- Error Codes
- Service Agreement
- Glossary
- Contact Us
Resource-Level Permission Overview
Resource-level permission can be used to specify which resources a user can manipulate. TcaplusDB supports certain resource-level permissions, i.e., allowing the user to perform operations or use specified resources.
In Cloud Access Management (CAM), the types of TcaplusDB resources that can be authorized are as follows:
Resource Type | Resource Description Method in Authorization Policy |
qcs::tcaplusdb:$region:$account:cluster/$clusterId | |
qcs::tcaplusdb:$region:$account:tablegroup/$clusterId/$tablegroupId | |
qcs::tcaplusdb:$region:$account:table/$tableId |
The TcaplusDB cluster APIs, TcaplusDB table group APIs, and TcaplusDB table APIs sections below describe the TcaplusDB API operations which currently support resource-level permission control as well as the resources and condition keys supported by each operation. When setting the resource path, you need to replace the variable parameters such as
$region and $account with your real parameter information. You can also use the \\* wildcard in the path. For related operation examples, please see TcaplusDB Access Control Examples.For a TcaplusDB API operation that does not support authorization at the resource level, you can still authorize a user to perform it, but you must specify\\*as the resource element in the policy statement.
List of APIs Not Supporting Resource-Level Permission
API Operation | API Description |
CreateBackup | Creates backup |
CompareIdlFiles | Uploads and verifies table modification file |
VerifyIdlFiles | Uploads and verifies table creation file |
DescribeUinInWhitelist | Queries whether the current user is in the allowlist |
DescribeRegions | Queries region list |
DeleteIdlFiles | Deletes IDL description file |
DescribeIdlFileInfos | Queries table description file details |
DescribeIdlFileInfos | Queries task list |
List of APIs Supporting Resource-Level Permission
TcaplusDB cluster APIs
API Operation | Resource Path |
qcs::tcaplusdb:$region:$account:cluster/*qcs::tcaplusdb:$region:$account:cluster/$clusterId | |
qcs::tcaplusdb:$region:$account:cluster/*qcs::tcaplusdb:$region:$account:cluster/$clusterId | |
qcs::tcaplusdb:$region:$account:cluster/*qcs::tcaplusdb:$region:$account:cluster/$clusterId | |
qcs::tcaplusdb:$region:$account:cluster/*qcs::tcaplusdb:$region:$account:cluster/$clusterId | |
qcs::tcaplusdb:$region:$account:cluster/*qcs::tcaplusdb:$region:$account:cluster/$clusterId |
TcaplusDB table group APIs
API Operation | Resource Path |
qcs::tcaplusdb:$region:$account:tablegroup/*qcs::tcaplusdb:$region:$account:tablegroup/$clusterId/$tablegroupId | |
qcs::tcaplusdb:$region:$account:tablegroup/*qcs::tcaplusdb:$region:$account:tablegroup/$clusterId/$tablegroupId | |
qcs::tcaplusdb:$region:$account:tablegroup/*qcs::tcaplusdb:$region:$account:tablegroup/$clusterId/$tablegroupId | |
qcs::tcaplusdb:$region:$account:tablegroup/*qcs::tcaplusdb:$region:$account:tablegroup/$clusterId/$tablegroupId |
TcaplusDB table APIs
API Operation | Resource Path |
qcs::tcaplusdb:$region:$account:table/*qcs::tcaplusdb:$region:$account:table/$tableId | |
qcs::tcaplusdb:$region:$account:table/*qcs::tcaplusdb:$region:$account:table/$tableId | |
qcs::tcaplusdb:$region:$account:table/*qcs::tcaplusdb:$region:$account:table/$tableId | |
qcs::tcaplusdb:$region:$account:table/*qcs::tcaplusdb:$region:$account:table/$tableId | |
qcs::tcaplusdb:$region:$account:table/*qcs::tcaplusdb:$region:$account:table/$tableId | |
qcs::tcaplusdb:$region:$account:table/*qcs::tcaplusdb:$region:$account:table/$tableId | |
qcs::tcaplusdb:$region:$account:table/*qcs::tcaplusdb:$region:$account:table/$tableId | |
qcs::tcaplusdb:$region:$account:table/*qcs::tcaplusdb:$region:$account:table/$tableId | |
qcs::tcaplusdb:$region:$account:table/*qcs::tcaplusdb:$region:$account:table/$tableId | |
qcs::tcaplusdb:$region:$account:table/*qcs::tcaplusdb:$region:$account:table/$tableId |
Yes
No
Was this page helpful?