Identity and Access Management 整合（IAM）

第 2 代

您帳戶中使用者對 Cloud Databases 服務實例的管理存取權限，由「身分與存取管理 」（ IBM Cloud® Identity and Access Management，簡稱 IAM） 進行控制。 本文件說明 Cloud Identity and Access Management 與 Cloud Databases 的整合：Databases for PostgreSQL 及 Databases for MongoDB。

IAM 僅與高階服務存取功能整合，該功能用於管理執行管理職能所需的權限與操作。 它不管理資料庫層級的使用者與權限。 資料庫存取受資料庫所提供的標準存取控制機制所規範。 IAM 並不會管理資料庫使用者。

有關在 IBM Cloud 中指派使用者角色的更多資訊，請參閱《 管理 IAM 存取權限 》。

第二代 Cloud Databases 採用服務憑證進行存取管理。 這表示：

  • 實例／部署密碼已不復存在，所有顯示的憑證皆為 IBM Cloud® 服務憑證，這些憑證可能具有不同的角色（例如：管理員、寫入者、讀取者）。
  • 您可以透過該平台建立新的服務憑證，但不支援更新現有密碼。
  • 關於資料庫層級的用戶管理，建議您使用自己偏好的方式，直接在資料庫內建立及管理用戶。

下表概述了與平台對應的各項操作。 服務管理角色可讓您在服務層級上對服務資源執行各項任務。 例如，指派使用者對服務的存取權、建立或刪除服務 ID、建立實例，以及將實例連結至應用程式。

IAM 使用者角色與動作
平台角色 動作的說明 範例動作
檢視者 身為「檢視者」，您可以檢視資料庫執行個體，但無法進行設定變更。 檢視服務概覽並查看警示。
操作員 身為系統管理員，您可以檢視資料庫執行個體，並進行配置變更，其中包括管理資料庫憑證。 擴展部署規模，建立新的使用者密碼／服務憑證。
編輯者 身為編輯者，您可以執行所有平台操作（包括變更設定及管理憑證），唯獨無法管理帳戶及指派存取政策。 擴展部署規模，建立新的使用者密碼／服務憑證。
管理者 身為管理員，您可以執行所有平台操作，包括為其他使用者指派存取權限政策。 擴展部署、建立新的服務憑證、建立及刪除存取政策。

Cloud Databases API 的操作

第二代 Cloud Databases 的 IAM 存取權限不再透過 Cloud Databases API 或 CLI 外掛程式進行管理；現在改由 IBM Cloud 資源控制器處理。

對特定 API 端點及請求的存取權限，由角色所決定。 以下列出 Cloud Databases 中各角色的存取政策。

檢視者

「檢視者」角色的允許操作。

GET /v5/ibm/deployables
Read Deployables
---
GET /v5/ibm/regions
Read Discover available regions
---
GET /v5/ibm/tasks/:task_id
Read a Task
---
GET /v5/ibm/backups/:backup_id
Read a Backup
---
GET /v5/ibm/deployments/:deployment_id
Read a Deployment
---
GET /v5/ibm/deployables/:deployable_id/groups
Read deployable group
---
GET /v5/ibm/deployments/:deployment_id/point_in_time_recovery_data
Read all deployment point-in-time-recovery data
---
GET /v5/ibm/deployments/:deployment_id/tasks
Read all deployment tasks
---
GET /v5/ibm/deployments/:deployment_id/backups
Read all deployment backups
---
GET /v5/ibm/deployments/:deployment_id/remotes
Read all deployment remotes
---
GET /v5/ibm/deployables/:deployable_id/groups
Read all deployment groups
---
GET /v5/ibm/deployments/:deployment_id/configuration/schema
Read deployment configuration schema
---
GET /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Read deployment user connections
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Create deployment user connections
---
GET /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Read Allowlisted IP Addresses

操作員與編輯

在 Cloud Databases 中，「操作員」與「編輯」這兩個角色的功能是相同的。 此清單列出了「操作員」與「編輯者」角色可執行的動作。

GET /v5/ibm/deployables
Read Deployables
---
GET /v5/ibm/regions
Read Discover available regions
---
GET /v5/ibm/tasks/:task_id
Read a Task
---
GET /v5/ibm/backups/:backup_id
Read a Backup
---
GET /v5/ibm/deployments/:deployment_id
Read a Deployment
---
GET /v5/ibm/deployables/:deployable_id/groups
Read deployable group
---
GET /v5/ibm/deployments/:deployment_id/point_in_time_recovery_data
Read all deployment point-in-time-recovery data
---
GET /v5/ibm/deployments/:deployment_id/tasks
Read all deployment tasks
---
GET /v5/ibm/deployments/:deployment_id/backups
Read all deployment backups
---
POST /v5/ibm/deployments/:deployment_id/backups
Create an on-demand backup
---
GET /v5/ibm/deployments/:deployment_id/remotes
Read all deployment remotes
---
POST /v5/ibm/deployments/:deployment_id/remotes/resync
Resync remote replica
---
GET /v5/ibm/deployables/:deployable_id/groups
Read all deployment groups
---
PATCH /v5/ibm/deployments/:deployment_id/groups/:group_id
Set scaling values on a specified group.
---
DELETE /v5/ibm/deployments/:deployment_id/management/database_connections
Closes all the connections on a deployment. Available for PostgreSQL and EnterpriseDB ONLY.
---
PATCH /v5/ibm/deployments/:deployment_id/configuration
Update deployment configuration
---
GET /v5/ibm/deployments/:deployment_id/configuration/schema
Read deployment configuration schema
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type
Create a user based on user type
---
DELETE /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id
Remove a user based on user type
---
GET /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Read deployment user connections
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Create deployment user connections
---
GET /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Read Allowlisted IP Addresses
---
POST /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Create an Allowlisted IP Addresses
---
DELETE /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses/:ip_address_id
Remove an Allowlisted IP Addresses
---
PUT /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Bulk allowlist IP addresses
---
POST /v5/ibm/deployments/:deployment_id/elasticsearch/file_syncs
Create elasticsearch file sync

管理者

「管理員」角色可執行的操作。

GET /v5/ibm/deployables
Read Deployables
---
GET /v5/ibm/regions
Read Discover available regions
---
GET /v5/ibm/tasks/:task_id
Read a Task
---
GET /v5/ibm/backups/:backup_id
Read a Backup
---
GET /v5/ibm/deployments/:deployment_id
Read a Deployment
---
GET /v5/ibm/deployables/:deployable_id/groups
Read deployable group
---
GET /v5/ibm/deployments/:deployment_id/point_in_time_recovery_data
Read all deployment point-in-time-recovery data
---
GET /v5/ibm/deployments/:deployment_id/tasks
Read all deployment tasks
---
GET /v5/ibm/backups/:backup_id
Read all deployment backups
---
POST /v5/ibm/deployments/:deployment_id/backups
Create an on-demand backup
---
GET /v5/ibm/deployments/:deployment_id/backups
Read all deployment remotes
---
POST /v5/ibm/deployments/:deployment_id/remotes/resync
Resync remote replica
---
GET /v5/ibm/deployables/:deployable_id/groups
Read all deployment groups
---
PATCH /v5/ibm/deployments/:deployment_id/groups/:group_id
Read deployment group
---
DELETE /v5/ibm/deployments/:deployment_id/management/database_connections
Kill all database connections
---
PATCH /v5/ibm/deployments/:deployment_id/configuration
Update deployment configuration
---
GET /v5/ibm/deployments/:deployment_id/configuration/schema
Read deployment configuration schema
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type
Create a user based on user type
---
PATCH /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id
Update a DeploymentUser
---
DELETE /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id
Remove a user based on user type
---
GET /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Read deployment user connections
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Create deployment user connections
---
GET /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Read Allowlisted IP Addresses
---
POST /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Create an Allowlisted IP Addresses
---
DELETE /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses/:ip_address_id
Remove an Allowlisted IP Addresses
---
PUT /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Bulk allowlist IP addresses
---
POST /v5/ibm/deployments/:deployment_id/elasticsearch/file_syncs
Create elasticsearch file sync

獨立備份的 IAM 權限

下表列出了各角色可執行的操作。

獨立備份的 IAM 權限
動作 必要角色
建立獨立備份 獨立備份服務上的編輯者或管理員
檢視獨立備份 獨立備份服務中的「檢視者」、「操作員」、「編輯者」或「管理員」
刪除獨立備份 獨立備份服務的管理員
從獨立備份還原 獨立備份服務中的「檢視者」、「操作員」、「編輯者」或「管理員」

服務對服務授權

獨立備份服務需要針對以下操作進行服務對服務（ S2S ）授權：

  • 提供自動備份及自動備份副本。
  • 撤銷自動備份及自動備份副本的配置。
  • 當資料庫服務中「保留備份」的設定設為 false 時，將解除按需備份的配置。

您需要設定以下服務對服務的授權政策。

  1. 資料庫服務與獨立備份服務之間的服務對服務授權：

    • 來源服務：資料庫服務（例如，databases-for-postgresql ）
    • 目標服務：Databases independent backups
    • 角色： Editor

  2. 資料庫服務與資源群組之間的服務對服務授權：

    • 來源服務：資料庫服務（例如，databases-for-postgresql ）
    • 目標服務：Resource group only
    • 角色： Viewer

有關設定服務對服務授權的更多資訊，請參閱《 使用授權授予服務間的存取權限 》。