Available in VPC
You can set different access permissions for DB & Server Access Control using NAVER Cloud Platform's Sub Account service. Sub Account offers both system-managed (System Managed) and user-defined (User Created) policies to help you configure management and operation permissions.
Sub Account is a free service with no additional charges. For more information about Sub Account, see the Services > Management & Governance > Sub Account menu and the Sub Account user guide in the NAVER Cloud Platform portal.
System-managed policies
System-managed policies are pre-built, role-based policies that NAVER Cloud Platform provides for your convenience. When you assign one of these policies to a sub account, that account gets access to DB & Server Access Control. Here are the available system-managed policies for DB & Server Access Control:
| Policy name | Policy description |
|---|---|
| NCP_ADMINISTRATOR | Access to all services with the same scope as the main account |
| NCP_INFRA_MANAGER | Access to all services, except the console's My Account > Manage billing information and expense > Manage billing and payment |
| NCP_FINANCE_MANAGER | Access only to Cost Explorer and the My Account > Manage billing information and expense > Manage billing and payment menu in the console |
| NCP_VPC_DB_&_SERVER_ACCESS_CONTROL_MANAGER | Full access to all DB & Server Access Control features on the VPC platform |
| NCP_VPC_DB_&_SERVER_ACCESS_CONTROL_VIEWER | View-only access to all DB & Server Access Control features on the VPC platform |
User-defined policies
User-defined policies let you create custom permissions. When you assign a user-defined policy to a sub account, that account can only perform the specific actions you've allowed. Here are the available user-defined policies for DB & Server Access Control:
| Type | Action | Related action | Resource type | Group by resource type | Action description |
|---|---|---|---|---|---|
| View | View/getVPCList | - | - | VPC | View VPCs for DB & Server Access Control proxy configuration. |
| View | View/getVPCDetail | View/getVPCList | VPC: VPC | VPC | View VPC details for DB & Server Access Control proxy configuration. |
| View | View/getSubnetList | - | - | Subnet | View subnets for DB & Server Access Control proxy configuration. |
| View | View/getSubnetDetail | View/getSubnetList | VPC: Subnet | Subnet | View subnet details for DB & Server Access Control proxy configuration. |
| View | View/getDSACProxySpec | - | - | DB & Server Access Control | View DB & Server Access Control proxy specifications. |
| View | View/getDSACProxyDetail | - | - | DB & Server Access Control | View DB & Server Access Control proxy details. |
| View | View/getServerList | Server:ServiceInstance | Server | View the DB & Server Access Control target server list. | |
| View | View/getServerDetail | View/getServerList | Server:ServiceInstance | Server | Select the DB & Server Access Control target server list. |
| View | View/getCDBList | - | Cloud DB for Redis:service Cloud DB PostgreSQL:service Cloud DB for MySQL:service Cloud DB for MSSQL:service Cloud DB for MongoDB:service |
DB & Server Access Control | View the DB & Server Access Control target CDB list. |
| View | View/getCDBDetail | View/getCDBList | Cloud DB for Redis:service Cloud DB PostgreSQL:service Cloud DB for MySQL:service Cloud DB for MSSQL:service Cloud DB for MongoDB:service |
DB & Server Access Control | Select the DB & Server Access Control target CDB list. |
| View | View/getAccessTargetDetail | View/getAccessTargetList | AccessTarget | DB & Server Access Control | View DB & Server Access Control target details. |
| View | View/getAccessTargetMaskingDetail | View/getAccessTargetMaskingList | - | DB & Server Access Control | View DB & Server Access Control target masking rule details. |
| View | View/getDashboard | - | - | DB & Server Access Control | View the DB & Server Access Control dashboard. |
| View | View/getAccessTargetList | - | - | DB & Server Access Control | View the DB & Server Access Control target list (servers and databases). |
| View | View/getAccessTargetMaskingList | - | - | DB & Server Access Control | View the DB & Server Access Control target masking rule list. |
| Change | Change/subscribeService | - | - | DB & Server Access Control | Subscribe to and manage your DB & Server Access Control. |
| Change | Change/createDSACProxy | - | - | DB & Server Access Control | Create a DB & Server Access Control proxy server. |
| Change | Change/rebootDSACProxy | View/getDSACProxyDetail | - | DB & Server Access Control | Restart the DB & Server Access Control proxy server. |
| Change | Change/updateDSACProxy | View/getDSACProxyList View/getDSACProxyDetail |
- | DB & Server Access Control | Change DB & Server Access Control proxy specifications. |
| Change | Change/createAccessTargetServer | View/getServerList View/getServerDetail View/getAccessTargetList |
- | DB & Server Access Control | Create a DB & Server Access Control server target. |
| Change | Change/createTargetDB | View/getServerList View/getCDBList View/getServerDetail View/getCDBDetail View/getAccessTargetList |
- | DB & Server Access Control | Create a DB & Server Access Control database target (DB or DBMS Server). |
| Change | Change/createAccessTargetMasking | - | - | DB & Server Access Control | Create a DB & Server Access Control target masking rule. |
| Change | Change/updateAccessTargetDetail | View/getAccessTargetList View/getAccessTargetDetail |
AccessTarget | DB & Server Access Control | Change DB & Server Access Control target details. |
| Change | Change/deleteAccessTarget | View/getAccessTargetList View/getAccessTargetDetail |
AccessTarget | DB & Server Access Control | Delete the DB & Server Access Control target list. |
| Change | Change/deleteAccessTargetMasking | View/getAccessTargetMaskingList View/getAccessTargetMaskingDetail |
UserCustomMaskingPolicy | DB & Server Access Control | Delete a DB & Server Access Control target masking rule. |
| Change | Change/updateAccessTargetMasking | View/getAccessTargetMaskingList View/getAccessTargetMaskingDetail |
UserCustomMaskingPolicy | DB & Server Access Control | Edit a DB & Server Access Control target masking rule. |
| Change | Change/updateTargetServerRange | - | - | DB & Server Access Control | Change the server target usage range in DB & Server Access Control. |
| Change | Change/createDashboardPolicy | - | - | DB & Server Access Control | Configure the DB & Server Access Control dashboard view. |
| Change | Change/permitAccessTarget | - | AccessTarget | DB & Server Access Control | Designate targets to which users are allowed access. |
If you grant someone access to a specific action but not to the required related actions, they won't be able to complete their tasks. Sub Account automatically includes these related permissions to prevent this issue. However, if you manually uncheck these auto-selected related actions, the system assumes this was intentional and won't override your selection.
Configuration precautions
Consider the following when using Sub Account to set DB & Server Access Control access permissions for sub accounts:
- Avoid using the main account: We recommend that you avoid using your main account to access DB & Server Access Control. If you use an account with NAVER Cloud Platform administrator permissions, all of its permissions could be compromised and misused in a security breach.
- Create sub accounts by role: To distinguish users of DB & Server Access Control, create sub accounts for each role and grant the necessary permissions.