Tencent Cloud Notices > Notice Details
[TencentDB for MySQL] Announcement on Optimization of Resource Authorization Policies for Passing Read-Only Group IDs (cdbrg-) in APIs
2026-07-23 16:21:49
Dear Tencent Cloud user,
To enhance resource-level authorization capabilities on the Cloud Access Management (CAM) side for TencentDB for MySQL, Tencent Cloud plans to optimize the authorization logic for specific APIs when passing Read-Only Group IDs (cdbrg-) as input parameters. Details are as follows:
Effective Date
Starting July 24, 2026 (UTC+8).
Scope of Impact
Selected TencentDB for MySQL API interfaces (where input parameters support RoGroupId / Instance IDs in the format cdbrg-).
Scenarios involving resource-level authorization for sub-accounts or roles via CAM policies.
Policy Changes
Before: Resource-level authorization was not supported for cdbrg-.
After: When a cdbrg-* resource ID is passed as an input parameter, the system will automatically parse all Read-Only (RO) instances under that RO group. If all RO instances under the group are authorized in the CAM policy, access will be granted. If any RO instance under the group is not authorized, the overall authorization will fail, and the request will be denied.
Impact Details
Users with fine-grained instance-level authorization (using cdb- / RO Instance IDs): Calls may fail under the new logic if the policy does not explicitly cover the RO instances belonging to the cdbrg- group. You will need to supplement the corresponding RO instance permissions.
Users relying solely on root accounts / full-access policies (e.g., QcloudCDBFullAccess): No impact.
If you encounter any issues during usage, please submit a ticket to contact us. Thank you for your understanding and support.
