Docs

RDS for PostgreSQL

Managing tags

Limiting the instance scope of IAM user management by tags

You can bind tags to different PostgreSQL instances, then authorize different IAM users by tags through custom IAM permission policies. This restricts IAM users from viewing or managing only PostgreSQL instances with specified tags.

Precautions

IAM users with configured tag permission restrictions: the instance list is empty by default when they first enter the instances page. Manual tag filtering is required, after which the instance list with corresponding permissions is displayed.

IAM users without configured tag permission restrictions: all instances are displayed by default when first entering the instances page, but they can only access the details pages of authorized instances and cannot view instances without permissions. After manual tag filtering, only instances bound with the corresponding tags are displayed.

Procedure

Take IAM user Account-user as an example, allowing management only of PostgreSQL instances tagged with Department:RD, with no permissions to view or manage other PostgreSQL instances.

Create an IAM user. The IAM user in this topic is Account-user.

Authorize the IAM user. This topic grants view and management permissions for PostgreSQL instances.

Create a custom permission policy. The policy names in this topic are TagPermissionPolicy and PostgresqlPolicy.

TagPermissionPolicy: grants the IAM user permissions for the tag service to ensure normal use of the tag service. Otherwise, the user cannot filter tags.

PostgresqlPolicy: grants the IAM user instance management permissions with the tag Department:RD.

Grant the IAM user the custom policies TagPermissionPolicy and PostgresqlPolicy.

Result verification

In the upper-left corner of the top menu bar, select the project and region for the instance.

tip

If the project of the instance has not been set, the project should be selected as All resources.

On the Instances page, click the filter icon on the right of the Tag column.

In the pop-up text box, set the tag key and tag value for filtering.

When first entering the instances, it is empty by default with a prompt indicating no permission.

Manually filter PostgreSQL instances with the tag Department:RD, and the filtered list shows instances you have permission for.

Last updated: 2026.06.04 15:17:16