Identity and Access Management 통합

계정의 사용자를 위한 IBM Cloud® Databases 서비스 인스턴스에 대한 액세스는 IBM Cloud Identity and Access Management(IAM)에서 제어됩니다.

본 문서는 IAM과 Cloud Databases, Databases for PostgreSQL Databases for MongoDB, Databases for Redis, Databases for Elasticsearch, IBM Cloud® Databases for MySQL, 및 의 통합을 Messages for RabbitMQ 다룹니다.

IAM은 API Cloud Databases 및 CLI Cloud Databases 플러그인 에서 사용 가능한 권한과 작업을 제어하는 고급 서비스 액세스 기능과만 통합됩니다. 데이터베이스 레벨의 사용자와 권한은 통제하지 않습니다. 데이터베이스 액세스는 데이터베이스에서 제공하는 표준 액세스 제어를 통해 통제됩니다. IAM은 데이터베이스 사용자를 제어하지 않습니다.

IBM Cloud에서 사용자 역할 지정에 대한 자세한 정보는 IAM 액세스 관리를 참조하십시오.

다음 표는 서비스 관리 역할에 맵핑된 조치의 일반 개요를 제공합니다. 서비스 관리 역할을 통해 사용자는 서비스 레벨에서 서비스 리소스에 대한 태스크를 수행할 수 있습니다. 예를 들어, 서비스에 대한 사용자 액세스를 지정하고, 서비스 ID를 작성 또는 삭제하고, 인스턴스를 작성하며, 인스턴스를 애플리케이션에 바인딩하십시오.

IAM 사용자 역할 및 조치
서비스 관리 역할	조치에 대한 설명	예제 조치
뷰어	뷰어로서 데이터베이스 인스턴스를 볼 수 있지만 구성을 변경할 수는 없습니다.	서비스 개요 보기 및 알림 보기.
운영자	운영자로서 데이터베이스 인스턴스를 보고 데이터베이스 인증 정보 관리를 포함하는 구성 변경사항을 작성할 수 있습니다.	배포를 확장하고 배포의 암호를 변경합니다.
편집자	편집자로서 계정을 관리하고 액세스 정책을 지정하는 것을 제외한 모든 플랫폼 조치(구성 변경 및 인증 정보 관리 포함)를 수행할 수 있습니다.	배포를 확장하고 배포의 암호를 변경합니다.
관리자	관리자로서 다른 사용자에게 액세스 정책 지정을 포함한 모든 플랫폼 조치를 수행할 수 있습니다.	배포를 확장하고, 배포의 암호를 변경하며, 액세스 정책을 할당합니다.

Cloud Databases API에 대한 조치

특정 API 엔드포인트 및 요청에 대한 액세스는 역할에 의해 통제됩니다. 다음은 IBM Cloud® Databases에 대한 각 역할의 액세스 정책 목록입니다.

뷰어

뷰어 역할에 허용되는 조치입니다.

GET /v5/ibm/deployables
Read Deployables
---
GET /v5/ibm/regions
Read Discover available regions
---
GET /v5/ibm/tasks/:task_id
Read a Task
---
GET /v5/ibm/backups/:backup_id
Read a Backup
---
GET /v5/ibm/deployments/:deployment_id
Read a Deployment
---
GET /v5/ibm/deployables/:deployable_id/groups
Read deployable group
---
GET /v5/ibm/deployments/:deployment_id/point_in_time_recovery_data
Read all deployment point-in-time-recovery data
---
GET /v5/ibm/deployments/:deployment_id/tasks
Read all deployment tasks
---
GET /v5/ibm/deployments/:deployment_id/backups
Read all deployment backups
---
GET /v5/ibm/deployments/:deployment_id/remotes
Read all deployment remotes
---
GET /v5/ibm/deployables/:deployable_id/groups
Read all deployment groups
---
GET /v5/ibm/deployments/:deployment_id/configuration/schema
Read deployment configuration schema
---
GET /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Read deployment user connections
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Create deployment user connections
---
GET /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Read Allowlisted IP Addresses

운영자 및 편집자

운영자 및 편집자 역할은 Cloud Databases에 대해 기능적으로 동일합니다. 이 목록에는 운영자 및 편집자 역할에 허용되는 조치가 포함됩니다.

GET /v5/ibm/deployables
Read Deployables
---
GET /v5/ibm/regions
Read Discover available regions
---
GET /v5/ibm/tasks/:task_id
Read a Task
---
GET /v5/ibm/backups/:backup_id
Read a Backup
---
GET /v5/ibm/deployments/:deployment_id
Read a Deployment
---
GET /v5/ibm/deployables/:deployable_id/groups
Read deployable group
---
GET /v5/ibm/deployments/:deployment_id/point_in_time_recovery_data
Read all deployment point-in-time-recovery data
---
GET /v5/ibm/deployments/:deployment_id/tasks
Read all deployment tasks
---
GET /v5/ibm/deployments/:deployment_id/backups
Read all deployment backups
---
POST /v5/ibm/deployments/:deployment_id/backups
Create an on-demand backup
---
GET /v5/ibm/deployments/:deployment_id/remotes
Read all deployment remotes
---
POST /v5/ibm/deployments/:deployment_id/remotes/resync
Resync remote replica
---
GET /v5/ibm/deployables/:deployable_id/groups
Read all deployment groups
---
PATCH /v5/ibm/deployments/:deployment_id/groups/:group_id
Set scaling values on a specified group.
---
DELETE /v5/ibm/deployments/:deployment_id/management/database_connections
Closes all the connections on a deployment. Available for PostgreSQL ONLY.
---
PATCH /v5/ibm/deployments/:deployment_id/configuration
Update deployment configuration
---
GET /v5/ibm/deployments/:deployment_id/configuration/schema
Read deployment configuration schema
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type
Create a user based on user type
---
DELETE /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id
Remove a user based on user type
---
GET /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Read deployment user connections
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Create deployment user connections
---
GET /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Read Allowlisted IP Addresses
---
POST /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Create an Allowlisted IP Addresses
---
DELETE /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses/:ip_address_id
Remove an Allowlisted IP Addresses
---
PUT /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Bulk allowlist IP addresses
---
POST /v5/ibm/deployments/:deployment_id/elasticsearch/file_syncs
Create elasticsearch file sync

관리자

관리자 역할에 허용되는 조치입니다.

GET /v5/ibm/deployables
Read Deployables
---
GET /v5/ibm/regions
Read Discover available regions
---
GET /v5/ibm/tasks/:task_id
Read a Task
---
GET /v5/ibm/backups/:backup_id
Read a Backup
---
GET /v5/ibm/deployments/:deployment_id
Read a Deployment
---
GET /v5/ibm/deployables/:deployable_id/groups
Read deployable group
---
GET /v5/ibm/deployments/:deployment_id/point_in_time_recovery_data
Read all deployment point-in-time-recovery data
---
GET /v5/ibm/deployments/:deployment_id/tasks
Read all deployment tasks
---
GET /v5/ibm/backups/:backup_id
Read all deployment backups
---
POST /v5/ibm/deployments/:deployment_id/backups
Create an on-demand backup
---
GET /v5/ibm/deployments/:deployment_id/backups
Read all deployment remotes
---
POST /v5/ibm/deployments/:deployment_id/remotes/resync
Resync remote replica
---
GET /v5/ibm/deployables/:deployable_id/groups
Read all deployment groups
---
PATCH /v5/ibm/deployments/:deployment_id/groups/:group_id
Read deployment group
---
DELETE /v5/ibm/deployments/:deployment_id/management/database_connections
Kill all database connections
---
PATCH /v5/ibm/deployments/:deployment_id/configuration
Update deployment configuration
---
GET /v5/ibm/deployments/:deployment_id/configuration/schema
Read deployment configuration schema
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type
Create a user based on user type
---
PATCH /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id
Update a DeploymentUser
---
DELETE /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id
Remove a user based on user type
---
GET /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Read deployment user connections
---
POST /v5/ibm/deployments/:deployment_id/users/:user_type/:user_id/connections/:endpoint_type
Create deployment user connections
---
GET /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Read Allowlisted IP Addresses
---
POST /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Create an Allowlisted IP Addresses
---
DELETE /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses/:ip_address_id
Remove an Allowlisted IP Addresses
---
PUT /v5/ibm/deployments/:deployment_id/allowlists/ip_addresses
Bulk allowlist IP addresses
---
POST /v5/ibm/deployments/:deployment_id/elasticsearch/file_syncs
Create elasticsearch file sync