Service access permissions

To ensure security, compliance, and separation of duties in a cloud environment, FPT Cloud uses an Identity and Access Management (IAM) module to control who can do what, and on which resources. IAM enables centralized permission management across users, groups, and DBaaS components in the FPT Cloud Portal, enforcing the principle of least privilege by assigning roles to users through groups within a Tenant and VPC scope. **Least privilege principle**: assign only the minimum necessary rights to perform tasks. For instance, grant viewing access only if no configuration or delete actions are required. To perform database provisioning, operation, and management tasks, users must be granted the appropriate IAM permissions. Each action within the FPT Database Engine service is governed by specific permissions. If a user is not assigned a required permission, the corresponding operation will not be available to that user. Permissions are organized into functional domains: service management, database management, backup & restore, notification, monitoring, and reporting. To configure roles and define user groups, refer to the sub-sections below.

📄️ Role management

A role is a core component of the IAM module on the FPT Cloud Portal. Role management enables system administrators to define and assign roles with specific permissions to users when accessing the FPT Database Engine service.

📄️ User group management

The User group management function helps organize multiple users under a shared access control configuration by assigning roles to the group as a whole. The feature is part of IAM on the FPT Cloud Portal. It helps organize users by roles, reduces administrative overhead, and ensures consistent application of access rights across the DBaaS environment.