Docs

RDS for PostgreSQL

Managing instances

Access control

RDS for PostgreSQL supports multi-identity permission control through a multi-user permission management system - Identity and Access Management (IAM). IAM improves the security of operation and maintenance and the products integrated on the client side and the server side to guarantee the compliance and safety of coordinated service calls. This topic describes how to use IAM to manage RDS for PostgreSQL resources, permissions, and identities.

Basic concepts

Basic concepts in access control include the following:

User A user is an identity in access control, created by an account (Account) or a user with permissions. After a user is granted permissions (Policy), they can log in to the console or use an Access Key to call an API to access cloud resources. An account (also known as the primary account) can be regarded as a special user (called the root user), owning cloud service resources and serving as the subject for resource metering and billing. The primary account has all permissions under the account by default.

User group A user group is a collection of users. A user can belong to multiple user groups. After a user group is associated with a policy, users within the group will also have the corresponding permissions granted by the policy.

Role a role is an identity within the IAM System whose permissions are defined by the associated policy or policies. Roles are typically used to grant trust for account permissions, allowing the trusted entities to access account resources.

Policy a policy is a description of privileges. IAM provides identity-based policies and resource-based policies. Users, user groups, and roles must be granted permissions by associating policies. IAM supports two types of policies: system preset policies and custom policies.

Project a project is a virtual concept that includes a set of resources, users, and roles. A project allows you to view and manage a group of resources in a unified manner and control the permissions of users and roles to these resources.

Identity management

Identity and Access Management provides three identity types: users, user groups, and roles, which can be managed based on different identity dimensions according to the actual business needs. For example, in scenarios with few and fixed users, management can be done by user or role dimension. In scenarios with many users and frequent changes, management can be done by user group dimension.

Create user

Create user group

Create role

Resource management

To facilitate permission and consumption management of resources, use the project management feature of resource management to add different resources to different projects.

Create project

Add instance to project

Permissions management

After completing identity management and resource management deployment, authorize selected identities to resources (projects).

Add project permissions

Last updated: 2025.11.17 20:31:11