Community

Blog Events Webinars Tutorials Forum
  1. Blog
  2. Events
  3. Webinars
  4. Tutorials
  5. Forum
Create Account
×
Community Blog MaxCompute and DataWorks Security Management Guide: Basics (2)

MaxCompute and DataWorks Security Management Guide: Basics (2)

This guide is aimed at facilitating project owners to understand the basics of security management for using MaxCompute with DataWorks.

Join us at the Alibaba Cloud ACtivate Online Conference on March 5-6 to challenge assumptions, exchange ideas, and explore what is possible through digital transformation.

In this guide, we will share the basics of security management for MaxCompute and DataWorks. This guide is aimed at facilitating and assisting the project owner or security administrator of MaxCompute in the daily security operations of projects to ensure data security.

User and Permission Management

User Management

1

Role Management

2

For more information about the action and subject types, refer to the official document.

Authorization Management of ACL (Object Actions)

3

For more information about the action and subject types, refer to the official document.

Role Authorization Management

4

Package Authorization Management

5

For more information about the action and subject types, refer to the official document.

Label Authorization Management

6

Enable the Security Feature

Set ProjectProtection (Data Outflow Protection Mechanism)

Project data protection is mainly to disallow users to transfer data from the project.

7

Turn on Label Security (Column and Security Control)

Label-based security (LabelSecurity) is a mandatory access control (MAC) policy at the project level. It allows project administrators to control the user access to column-level sensitive data with improved flexibility.

8

Configure the Field Label Properly

9

Set a Whitelist of IPs That Are Allowed to Access a Project

10

Disallow the Results of "Select" in DataWorks to Be Downloaded to a Local Path

11

Improving Security Management with RAM

Since other cloud services may be used together with MaxCompute, we should consider how to improve security management in MaxCompute by using other cloud services. A Resource Access Management (RAM) user is required when a project member is added if MaxCompute is used with DataWorks. This section mainly describes how to improve security management on a RAM user.

For MaxCompute user authentication, the preceding "MaxCompute security model" section mentions "two account systems, cloud accounts and RAM accounts, are supported. For RAM accounts, any RAM user of the primary account can be added to a certain project of MaxCompute only by identifying the account system but not the RAM permission system. However, MaxCompute does not consider the permission definition in RAM when verifying the permission of the RAM user." Therefore, we can implement security control simply by using the RAM user login verification.

RAM User Password Strength Settings

If you allow a RAM user to change his or her logon password, you should require the user to create a strong logon password and encourage frequent password rotation.

You can create password policies, such as the minimum length, whether non-letter characters are required, and the rotation cycle, for RAM users on the RAM console.

12

RAM User Login Mask Settings

Set a netmask to determine which IP addresses will be influenced by the login console. Sub-users can only log on from the specified IP.

13

Revoke Permissions That Are No Longer Needed

If the employee owner of a RAM user no longer requires original permissions due to change in duties and responsibilities, the original permissions granted to the RAM user should be revoked in a timely manner.

MaxCompute Big Data Data security DataWorks Resource Access Management
0 0 0
Share on

Read previous post:

MaxCompute and DataWorks Security Management Guide: Basics (1)

Read next post:

MaxCompute and DataWorks Security Management Guide: Examples

Alibaba Cloud MaxCompute

135 posts | 18 followers

You may also like

Comments

Alibaba Cloud MaxCompute

135 posts | 18 followers

Related Products

More Posts by Alibaba Cloud MaxCompute

See All