Identity and Access Management 集成（IAM）
第2代
您账户中用户对 Cloud Databases 服务实例的管理访问权限由 IBM Cloud® Identity and Access Management （IAM） 进行控制。 本文档介绍了 Cloud Identity and Access Management 与 Cloud Databases 的集成：Databases for PostgreSQL 和 Databases for MongoDB。
IAM 仅与高级服务访问集成，该访问用于管理执行管理功能所需的权限和操作。 它不管理数据库级别的用户和权限。 数据库访问受数据库提供的标准访问控制机制的约束。 IAM 不管理数据库用户。
有关在 IBM Cloud 中分配用户角色的更多信息，请参阅“管理IAM访问权限”。
第二代 Cloud Databases 使用服务凭据进行访问管理。 这意味着：
- 实例/部署密码已不存在，所有显示的凭据均为 IBM Cloud® 服务凭据，这些凭据可能具有不同的角色（例如，管理员、写入者、读取者）。
- 您可以通过该平台创建新的服务凭据，但不支持更新现有密码。
- 对于数据库级别的用户管理，建议您使用自己习惯的方式直接在数据库中创建和管理用户。
下表概述了映射到平台的各项操作。 服务管理角色使您能够在服务层面上对服务资源执行任务。 例如，为用户分配对服务的访问权，创建或删除服务标识，创建实例以及将实例绑定到应用程序。
| 平台角色 | 操作描述 | 操作示例 |
|---|---|---|
| 查看者 | 作为“查看者”，您可以查看数据库实例，但无法进行配置更改。 | 查看服务概览并查看警报。 |
| 运算符 | 作为运维人员，您可以查看数据库实例并进行配置更改，包括管理数据库凭据。 | 扩展部署，创建新用户密码/服务凭据。 |
| 编辑者 | 作为编辑，您可以执行所有平台操作（包括更改配置和管理凭据），但管理账户和分配访问策略除外。 | 扩展部署，创建新用户密码/服务凭据。 |
| 管理员 | 作为管理员，您可以执行所有平台操作，包括为其他用户分配访问策略。 | 扩展部署、创建新的服务凭据、创建和删除访问策略。 |
Cloud Databases API 的操作
第二代 Cloud Databases 的IAM访问权限不再通过 Cloud Databases API或CLI插件进行管理；现在通过 IBM Cloud 资源控制器进行管理。
对某些 API 端点和请求的访问权限由角色决定。 下文列出了 Cloud Databases 中各个角色的访问策略。
查看者
“查看者”角色的允许操作。
GET /v5/ibm/deployables
Read Deployables
---
GET /v5/ibm/regions
Read Discover available regions
---
GET /v5/ibm/tasks/:task_id
Read a Task
---
GET /v5/ibm/backups/:backup_id
Read a Backup
---
GET /v5/ibm/deployments/:deployment_id
Read a Deployment
---
GET /v5/ibm/deployables/:deployable_id/groups
Read deployable group
---
GET /v5/ibm/deployments/:deployment_id/point_in_time_recovery_data
Read all deployment point-in-time-recovery data
---
GET /v5/ibm/deployments/:deployment_id/tasks
Read all deployment tasks
---
GET /v5/ibm/deployments/:deployment_id/backups
Read all deployment backups
---
GET /v5/ibm/deployments/:deployment_id/remotes
Read all deployment remotes
---
GET /v5/ibm/deployables/:deployable_id/groups
Read all deployment groups
---
GET /v5/ibm/deployments/:deployment_id/configuration/schema
Read deployment configuration schema
---
GET /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Read deployment user connections
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Create deployment user connections
---
GET /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Read Allowlisted IP Addresses
操作员和编辑
在 Cloud Databases 中，“操作员”和“编辑”这两个角色的功能是相同的。 此列表包含“操作员”和“编辑”角色的允许操作。
GET /v5/ibm/deployables
Read Deployables
---
GET /v5/ibm/regions
Read Discover available regions
---
GET /v5/ibm/tasks/:task_id
Read a Task
---
GET /v5/ibm/backups/:backup_id
Read a Backup
---
GET /v5/ibm/deployments/:deployment_id
Read a Deployment
---
GET /v5/ibm/deployables/:deployable_id/groups
Read deployable group
---
GET /v5/ibm/deployments/:deployment_id/point_in_time_recovery_data
Read all deployment point-in-time-recovery data
---
GET /v5/ibm/deployments/:deployment_id/tasks
Read all deployment tasks
---
GET /v5/ibm/deployments/:deployment_id/backups
Read all deployment backups
---
POST /v5/ibm/deployments/:deployment_id/backups
Create an on-demand backup
---
GET /v5/ibm/deployments/:deployment_id/remotes
Read all deployment remotes
---
POST /v5/ibm/deployments/:deployment_id/remotes/resync
Resync remote replica
---
GET /v5/ibm/deployables/:deployable_id/groups
Read all deployment groups
---
PATCH /v5/ibm/deployments/:deployment_id/groups/:group_id
Set scaling values on a specified group.
---
DELETE /v5/ibm/deployments/:deployment_id/management/database_connections
Closes all the connections on a deployment. Available for PostgreSQL and EnterpriseDB ONLY.
---
PATCH /v5/ibm/deployments/:deployment_id/configuration
Update deployment configuration
---
GET /v5/ibm/deployments/:deployment_id/configuration/schema
Read deployment configuration schema
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type
Create a user based on user type
---
DELETE /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id
Remove a user based on user type
---
GET /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Read deployment user connections
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Create deployment user connections
---
GET /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Read Allowlisted IP Addresses
---
POST /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Create an Allowlisted IP Addresses
---
DELETE /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses/:ip_address_id
Remove an Allowlisted IP Addresses
---
PUT /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Bulk allowlist IP addresses
---
POST /v5/ibm/deployments/:deployment_id/elasticsearch/file_syncs
Create elasticsearch file sync
管理员
管理员角色的允许操作。
GET /v5/ibm/deployables
Read Deployables
---
GET /v5/ibm/regions
Read Discover available regions
---
GET /v5/ibm/tasks/:task_id
Read a Task
---
GET /v5/ibm/backups/:backup_id
Read a Backup
---
GET /v5/ibm/deployments/:deployment_id
Read a Deployment
---
GET /v5/ibm/deployables/:deployable_id/groups
Read deployable group
---
GET /v5/ibm/deployments/:deployment_id/point_in_time_recovery_data
Read all deployment point-in-time-recovery data
---
GET /v5/ibm/deployments/:deployment_id/tasks
Read all deployment tasks
---
GET /v5/ibm/backups/:backup_id
Read all deployment backups
---
POST /v5/ibm/deployments/:deployment_id/backups
Create an on-demand backup
---
GET /v5/ibm/deployments/:deployment_id/backups
Read all deployment remotes
---
POST /v5/ibm/deployments/:deployment_id/remotes/resync
Resync remote replica
---
GET /v5/ibm/deployables/:deployable_id/groups
Read all deployment groups
---
PATCH /v5/ibm/deployments/:deployment_id/groups/:group_id
Read deployment group
---
DELETE /v5/ibm/deployments/:deployment_id/management/database_connections
Kill all database connections
---
PATCH /v5/ibm/deployments/:deployment_id/configuration
Update deployment configuration
---
GET /v5/ibm/deployments/:deployment_id/configuration/schema
Read deployment configuration schema
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type
Create a user based on user type
---
PATCH /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id
Update a DeploymentUser
---
DELETE /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id
Remove a user based on user type
---
GET /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Read deployment user connections
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Create deployment user connections
---
GET /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Read Allowlisted IP Addresses
---
POST /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Create an Allowlisted IP Addresses
---
DELETE /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses/:ip_address_id
Remove an Allowlisted IP Addresses
---
PUT /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Bulk allowlist IP addresses
---
POST /v5/ibm/deployments/:deployment_id/elasticsearch/file_syncs
Create elasticsearch file sync
独立备份的 IAM 权限
下表列出了每个角色可执行的操作。
| 操作 | 必需的角色 |
|---|---|
| 创建独立备份 | 独立备份服务上的编辑或管理员 |
| 查看独立备份 | 独立备份服务中的查看者、操作员、编辑者或管理员 |
| 删除独立备份 | 独立备份服务管理员 |
| 从独立备份中恢复 | 独立备份服务中的查看者、操作员、编辑者或管理员 |