Configure IAM

Access to FPT Database Engine is granted through IAM in two steps: a role bundles a set of permissions, and a user group ties users to roles. Define the roles first, then the groups that carry them, since granting access by group rather than user by user cuts the administrative work and keeps permissions consistent.

How access is modelled

IAM decides who may perform which action on which resource. Everything is scoped to a Tenant and the VPCs inside it, which is what keeps duties separated and makes access reviewable later.

Component	What it is
Role	A set of permissions defining which operations its holders may perform on FPT Database Engine resources.
Permission	A single right to carry out one action, such as viewing, creating, editing, or deleting a resource.
User Group	A set of users sharing the same roles and the same access scope, at Tenant or VPC level.
IAM User	An individual identity added to the Tenant, which receives permissions through groups and roles.

Grant the least privilege that works

Give a role only what its work requires. Someone who reads logs does not also need permission to change configuration or delete resources.

Create a role

1. Log in to FPT Cloud Portal.

2. From the main menu, select IAM → Roles. The Role Management page lists the roles that already exist, with options to create, edit, or delete.

3. Click Create role.

   

4. Enter the role name and description, then add the permissions the role needs. Configuring a permission is covered below.

5. Click Create role.

The new role appears in the management list with Active status, ready to be granted.

Role fields

Field	What to enter
Role name	Required. The name that identifies the role in IAM, up to 100 characters, using letters, digits, underscores (_), hyphens (-), spaces, and dots (.).
Description	The purpose of the role, its permission scope, or the group of people it applies to. Filling this in makes later administration and auditing much easier.
Permissions	The permissions granted by the role. Each one already added shows as an entry with a See more link to its details. Click + Permission to add another.

Configure a permission

Click See more on a permission to open its settings.

Each permission is defined by three things.

Service Type selects which family of operations the permission covers. FPT Database Engine uses two:

Service type	What it covers
ManageDatabase	Standard database management: viewing information, provisioning, operating databases, and managing add-on services.
FDE	Sensitive database operations, such as viewing or managing the password of the database administrator account.

Choosing a service type populates the Action list with the operations available for it, and updates the permission name to match.

Action defines what the role may do. Click See more to pick the actions to grant. Anything you leave unselected is blocked.

Resource defines what the role may act on. Click See more to choose, then pick one of two options:

• All grants access to every resource, which is the default when this option is selected.
• Specific grants access only to the resources you select from the list.

note

The action FDE:hide_admin_password works the other way around from the rest. Under Specific, the databases you select in Select resource are the ones where password viewing is blocked. Any database you do not select still allows it.

Edit or delete a role

Both actions start from the Role Management page, on the row of the role you want to change.

• Edit role: Select Edit role, change the name, description, or permissions, then click Save.
• Delete role: Select Delete, then confirm in the warning dialog.

warning

Deleting a role revokes its permissions immediately from every user and user group holding it, which can interrupt database management and operations. Confirm the role is no longer assigned to any user or user group first.

Create a user group

1. Log in to FPT Cloud Portal.

2. From the main menu, select IAM → User groups. The User Group Management page lists the groups that already exist, with options to create, edit, or delete.

3. Click Create user group.

   

4. Fill in the fields described below.

5. Click Create user group.

The new group appears in the management list with Active status, and its members can immediately use whatever the assigned roles permit.

User group fields

Field	What to enter
Name	The name that identifies the group in IAM, up to 100 characters. Make it reflect the group's purpose or scope of responsibility.
Description	Extra context such as the scope of use or the services the group manages. This is what makes administration and auditing clearer later.
Roles	One or more roles to assign. Together they define the permissions that apply to every user in the group.
Users	The users to add. Each inherits every permission of the group's roles, and any later change to those roles applies to all members at once.

Edit or delete a user group

Both actions start from the User Group Management page, on the row of the group you want to change.

• Edit user group: Select Edit user group, update the details or change the assigned roles, then click Edit user group.
• Delete user group: Select Delete, then confirm in the warning dialog.

warning

Deleting a group immediately strips every role-based permission its members inherited through it. They may lose the ability to reach database resources and other cloud services.

Before deleting a group, confirm that:

• It is no longer used for database operational or administrative tasks.
• Its users have been moved to another group, or granted an alternative role, if they still need access.
• No database operational processes, automations, or workflows depend on its permissions.

Permission reference

Every operation on FPT Database Engine is gated by a permission. If a role does not carry the permission for an action, that action is unavailable to everyone holding the role, so build roles from this list rather than granting broadly and trimming later.

Permission	Group	Action type	What it allows
manageDatabase:ProvisionBackend	Service	Create	Activate FPT Database Engine in a VPC.
manageDatabase:DeactiveBackend	Service	Delete	Deactivate FPT Database Engine in a VPC.
manageDatabase:List	Database	View	View the database list.
manageDatabase:Create	Database	Create	Create a database.
manageDatabase:View	Database	View	View the details of a database cluster.
manageDatabase:Management	Database	Edit	Start, stop, and restart a database.
manageDatabase:UpdateResource	Database	Edit	Update cluster resources such as CPU, RAM, and storage.
manageDatabase:Configuration	Database	Edit	Change database configuration, including parameters and scaling settings.
FDE:hide_admin_password	Database	View	Block viewing of the cluster's administrator password.
manageDatabase:Delete	Database	Delete	Delete a database.
manageDatabase:ListBackup	Backup & Restore	View	View backup information for a database.
manageDatabase:EnableBackup	Backup & Restore	Create	Enable the backup service on a cluster.
manageDatabase:DeleteBackup	Backup & Restore	Edit	Disable the backup service on a cluster.
manageDatabase:CreateJobBackup	Backup & Restore	Create	Create a backup job for a cluster.
manageDatabase:ViewJobBackup	Backup & Restore	View	View the details of a backup job.
manageDatabase:RunNowJobBackup	Backup & Restore	Create	Take a manual backup snapshot of a cluster.
manageDatabase:EditJobBackup	Backup & Restore	Edit	Edit a backup job.
manageDatabase:DeleteJobBackup	Backup & Restore	Delete	Delete a backup job.
manageDatabase:ListRestore	Backup & Restore	View	View the backups available to restore from.
manageDatabase:Restore	Backup & Restore	Create	Restore a database from a backup or to a point in time.
manageDatabase:ListProxy	DB Proxy	View	View the DB Proxy list for a database.
manageDatabase:CreateProxy	DB Proxy	Create	Create a DB Proxy for a cluster.
manageDatabase:DeleteProxy	DB Proxy	Delete	Delete a DB Proxy from a cluster.
manageDatabase:ListNotification	Notification	View	View the notification settings of a cluster.
manageDatabase:CreateNotification	Notification	Create	Enable system notifications for a cluster.
manageDatabase:DeleteNotification	Notification	Delete	Disable system notifications for a cluster.
manageDatabase:Monitor	Monitoring	View	Monitor database performance and status.
manageDatabase:ReportConfig	Reporting	Edit	Configure the schedule for database activity reports.

note

FDE:hide_admin_password is the one entry that restricts rather than grants. See Configure a permission for how its Specific resource selection inverts.

Next steps

• Activate FPT Database Engine service, which needs a high-privilege role of its own
• Create your first database once your team has the access it needs