Configure a workspace - Basic Operations| Alibaba Cloud Documentation Center

Go to the Workspace Management page

Log on to the DataWorks console.
In the left-side navigation pane, click Workspaces.
Go to the Workspace Management page of a workspace.
You can use one of the following methods to go to the Workspace Management page:
- On the Workspaces page, find the workspace that you want to configure and click Workspace Settings in the Actions column. In the Workspace Settings panel, click More. The Workspace Management page appears.
- On the Workspaces page, find the workspace that you want to configure and click Data Analytics in the Actions column. On the DataStudio page, click the Workspace Manage icon in the upper-right corner. The Workspace Management page appears.
On the Workspace Management page, configure Basic properties, Scheduling Properties, Security Settings, and Compute Engine Information for the workspace based on your business requirements.

Configure basic properties


Parameter	Description
Workspace ID	The ID of the workspace.
Workspace Name	The name of the workspace. The name is not case-sensitive, can contain letters and digits, and must start with a letter. The name uniquely identifies the workspace and cannot be changed after the workspace is created.
Status	The status of the workspace. Valid values: Normal, Deleted, Initializing, Initialization Failed, Manual Disable, Deleting, Deletion Failed, Suspended (Overdue), Updating, and Update Failed. Note If a workspace fails to be created, it enters the Initialization Failed state. In this case, you can create the workspace again. A workspace administrator can disable a workspace in the Normal state. After a workspace is disabled, all the features of the workspace become unavailable. However, the data of the workspace is retained, and the committed nodes can run normally. A workspace administrator can click Enable in the Actions column of a disabled workspace to recover the workspace to the Normal state.
Display Name	The display name of the workspace. The display name can contain letters and digits. You can change it based on your business requirements.
Creation Time	The time when the workspace is created. The value cannot be changed.
Mode	The mode of the workspace. Valid values: Simple Mode and Standard. Note The configurations of a DataWorks workspace vary based on the mode in which the DataWorks workspace runs. You must configure the parameters for both the production environment and the development environment for a DataWorks workspace in standard mode. For a DataWorks workspace in basic mode, you can log on to the DataWorks console by using an Alibaba Cloud account and upgrade the workspace from basic mode to standard mode. You can perform the upgrade operation only by using an Alibaba Cloud account. For more information, see Upgrade the workspace mode. In this example, a DataWorks workspace in standard mode is used.
Owner	The owner of the workspace, which cannot be changed after the workspace is created. The owner of a workspace has permissions to delete and disable the workspace.
Description	The description of the workspace. You can modify the description based on your business requirements. The description can be a maximum of 128 characters in length and can contain letters, special characters, and digits.

Configure scheduling properties

In the Scheduling Properties section, you can turn on or off the Periodic Scheduling switch for the workspace. You can also configure the Default Scheduling Resource Group, Default Data Integration Resource Group, Default Automatic Rerun Times Upon Error, and Default Automatic Rerun Interval Upon Error parameters for the workspace. Configure scheduling properties

If you do not turn on Periodic Scheduling, you can view auto triggered nodes on the Cycle Task page, but the system does not generate or run instances for the nodes. As a result, no auto triggered node instances are displayed on the Cycle Instance page.

Note

Only a workspace administrator has permissions to turn on or off Periodic Scheduling for a workspace.

Configure security settings


Parameter	Description
Download SELECT Query Result	Specifies whether the query results that are returned by SELECT statements in DataStudio can be downloaded. If you turn off this switch, the query results cannot be downloaded. Note Only a workspace administrator has permissions to turn on or off Download SELECT Query Result for a workspace.
Change Node Owner by RAM User	Specifies whether RAM users can be used to change the owners of their nodes.
Sandbox Whitelist (contains IP addresses and domain names that can be accessed by Shell nodes)	The IP addresses or domain names that can be accessed by a Shell node that runs on the shared resource group. Note You must specify public IP addresses or domain names that are accessible. For internal services in your enterprise, we recommend that you use exclusive resource groups to ensure network accessibility. For more information, see Exclusive resource group mode.

To add an IP address or domain name to the whitelist, perform the following steps:

In the Security Settings section, click Add.
In the Add dialog box, enter an IP address or a domain name in the Address field and a port number in the Port field.
Click Confirm.

Associate a MaxCompute compute engine instance with a workspace

In the Compute Engine Information section, click the MaxCompute tab. On this tab, you can view the information about all MaxCompute compute engine instances that are associated with the workspace.
Click Add Instance.

In the Add a MaxCompute instance dialog box, configure the parameters.


Parameter	Description
Method	Specifies whether to create a MaxCompute project or use an existing MaxCompute project. Valid values: Create Project and Associate Existing Project.
Instance Display Name	The display name of the MaxCompute compute engine instance. The display name must be 3 to 28 characters in length and can contain letters, underscores (_), and digits. The display name must start with a letter.
Region	The region of the workspace.
Payment mode	The billing method of the MaxCompute compute engine instance. Valid values: The pay-as-you-go billing method, Monthly package, and Developer version. Note A MaxCompute compute engine instance of the developer version cannot be associated with a workspace in standard mode.
Quota group	The quotas of computing resources and disk space for the MaxCompute compute engine instance.
MaxCompute data type	The data type edition of the MaxCompute compute engine instance. Valid values: 2.0 data type (recommended), 1.0 data types (for users who already use 1.0 data type), and Hive compatible types (for Hive migration users). For more information, see Data type editions.
Whether to encrypt	Specifies whether to encrypt the MaxCompute compute engine instance.
Production Environment	Configure the MaxCompute Project Name and Access Identity parameters for the production environment. MaxCompute Project Name: the name of the MaxCompute project that you want to associate with the workspace as the compute engine instance in the production environment. Access Identity: the identity that is used to access the MaxCompute project. Valid values: Alibaba Cloud primary account, Alibaba Cloud sub-account, and Alibaba Cloud RAM role.
Development Environment	Configure the MaxCompute Project Name and Access Identity parameters for the development environment. MaxCompute Project Name: the name of the MaxCompute project that you want to associate with the workspace as the compute engine instance in the development environment. Note This MaxCompute project provides computing and storage resources. Access Identity: The default value is Task owner and cannot be changed.

Click Confirm.
After the MaxCompute compute engine instance is added, you can specify it as the default compute engine instance. You can also click Unbind in the upper-right corner of the MaxCompute tab to disassociate the compute engine instance from the workspace.
Note
Only a workspace administrator has permissions to disassociate a MaxCompute compute engine instance from a workspace.
The disassociation of a MaxCompute compute engine instance from a workspace has the following impacts:

Nodes: The nodes that are scheduled based on the MaxCompute compute engine instance fail to run. We recommend that you go to the DataStudio page and click Migrated to an available compute engine instance to change the MaxCompute compute engine instance for the nodes. Then, you can commit and deploy the nodes to rerun them.

Data Integration: The synchronization nodes that are run based on the MaxCompute compute engine instance fail to run. We recommend that you change the MaxCompute compute engine instance for the synchronization nodes on the DataStudio page.

DataService Studio: The APIs that are related to the MaxCompute compute engine instance fail to be called. We recommend that you change the MaxCompute compute engine instance for the APIs.

DataAnalysis: You cannot query the data that is related to the MaxCompute compute engine instance. We recommend that you change the MaxCompute compute engine instance in DataAnalysis.

The information about the MaxCompute compute engine instance is not displayed in the Data Map, Resource Optimization, Comprehensive Data Governance, and Security Center modules.

Associate an EMR compute engine instance with a workspace

Notice EMR nodes can run only on exclusive resource groups for scheduling.

In the Compute Engine Information section, click the E-MapReduce tab. On this tab, you can view the information about all EMR compute engine instances that are associated with the workspace.
Click Add Instance.

In the New EMR cluster dialog box, configure the parameters.

DataWorks provides two modes for you to associate an EMR compute engine instance with a workspace: shortcut mode and security mode. The two modes can meet the security requirements of various enterprises. If you associate an EMR compute engine instance with a workspace by using the shortcut mode, you can create and run EMR nodes to generate data. If you associate an EMR compute engine instance with a workspace by using the security mode, you can create and run EMR nodes to generate data and manage permissions on the data to ensure higher security.


Parameter	Description
Instance Display Name	The display name of the EMR compute engine instance.
Region	The region of the workspace.
Access Mode	In shortcut mode, if you run or schedule EMR nodes in DataWorks by using an Alibaba Cloud account or a RAM user, the code of the nodes is committed to the EMR compute engine instance and run by a Hadoop user in the EMR compute engine instance. In security mode, if you run or schedule EMR nodes in DataWorks by using an Alibaba Cloud account or a RAM user, the code of the nodes is committed to the EMR compute engine instance and run by a user that has the same name as the Alibaba Cloud account or RAM user in the EMR compute engine instance. You can use EMR Ranger to manage the permissions of each user in the EMR compute engine instance. This ensures that Alibaba Cloud accounts, node owners, or RAM users have different data permissions when they run EMR nodes in DataWorks. This way, higher data security is implemented.
Scheduling access identity	If you set the Access Mode parameter to Shortcut mode, you can commit the code of an EMR node to the EMR compute engine instance by using an Alibaba Cloud account or a RAM user after the node is committed and deployed to the scheduling system of DataWorks. If you set the Access Mode parameter to Security mode, you can commit the code of an EMR node to the EMR compute engine instance by using an Alibaba Cloud account or a RAM user or as a node owner after the node is committed and deployed to the production environment. A Hadoop user that corresponds to the identity in the EMR compute engine instance is used to run the code. Note This parameter is available only for the production environment. Before you associate an EMR compute engine instance with a workspace, you must attach the AliyunEMRDevelopAccess policy to workspace roles such as developers and administrators. This way, the roles can be used to create and run EMR nodes in DataStudio. The AliyunEMRDevelopAccess policy is attached to Alibaba Cloud accounts by default. If you want to use a RAM user to run EMR nodes, you must attach the AliyunEMRDevelopAccess policy to the RAM user. For more information, see Grant permissions to RAM users.
Access identity	The identity that is used to commit the code of an EMR node in the development environment to the EMR compute engine instance. Default value: Task owner. Note This parameter is available only for the development environment of a workspace in standard mode. Task owner can be an Alibaba Cloud account or a RAM user. Before you associate an EMR compute engine instance with a workspace, you must attach the AliyunEMRDevelopAccess policy to workspace roles such as developers and administrators. This way, the roles can be used to create and run EMR nodes in DataStudio. The AliyunEMRDevelopAccess policy is attached to Alibaba Cloud accounts by default. If you want to use a RAM user to run EMR nodes, you must attach the AliyunEMRDevelopAccess policy to the RAM user.
Cluster ID	The ID of the EMR cluster that you want to associate with the workspace as the compute engine instance. Select an ID from the drop-down list. The EMR cluster is used as the runtime environment of EMR nodes.
Project ID	The ID of the EMR project that you want to associate with the workspace. Select an ID from the drop-down list. The EMR project is used as the runtime environment of EMR nodes. Note If you set Access Mode to Security mode, no EMR project IDs are displayed and can be selected.
YARN resource queue	The name of the resource queue in the EMR cluster. Unless otherwise specified, set this parameter to default.
Endpoint	The endpoint of the EMR cluster. The value of this parameter cannot be changed.
Resource Group	Select an exclusive resource group for scheduling that connects to the DataWorks workspace. If no exclusive resource group for scheduling is available, create one. For more information about how to create an exclusive resource group for scheduling and configure network connectivity, see Create and use an exclusive resource group for scheduling. After you select an exclusive resource group for scheduling, click Test Connectivity to test the connectivity between the exclusive resource group for scheduling and the EMR cluster.

Click Confirm.
After the EMR compute engine instance is added, you can specify it as the default compute engine instance and modify the configuration of the compute engine instance based on your business requirements.

Associate a Realtime Compute for Apache Flink compute engine instance with a workspace

In the Compute Engine Information section, click the Real-time Computing tab. On this tab, you can view the information about all Realtime Compute for Apache Flink compute engine instances that are associated with the workspace.
Click Add Instance.

In the Add a real-time computing instance dialog box, configure the parameters.


Parameter	Description
Instance Display Name	The display name of the Realtime Compute for Apache Flink compute engine instance.
Region	The region of the workspace.
Select Project	The Realtime Compute for Apache Flink project that you want to associate with the workspace as the compute engine instance. Select a project from the drop-down list. If you want to create a project, click Real-time calculation control platform.

Click Confirm.
After the Realtime Compute for Apache Flink compute engine instance is added, you can specify it as the default compute engine instance and modify the configuration of the compute engine instance based on your business requirements.

Associate a Hologres compute engine instance with a workspace

In the Compute Engine Information section, click the Hologres tab. On this tab, you can view the information about all Hologres compute engine instances that are associated with the workspace.
Click Bind Hologres Database.

In the Bind Hologres Database dialog box, configure the parameters.


Parameter	Description
Instance Display Name	The display name of the Hologres compute engine instance.
Access identity	The identity that is used to run the code of committed Hologres nodes. Valid values: Alibaba Cloud primary account and Alibaba Cloud sub-account. Note This parameter is available only for the production environment. The default value of this parameter for the development environment is Task owner.
Hologres instance name	The name of the Hologres instance that you want to associate with the workspace as the compute engine instance.
Database name	The name of the database that is created in SQL Console, such as testdb.

Click Test Connectivity.
After the connectivity test is passed, click Confirm.

Associate a Graph Compute compute engine instance with a workspace

In the Compute Engine Information section, click the GraphCompute tab.
Click Bind Graph Compute Instance.

Notice A Graph Compute instance can be associated with only one DataWorks workspace. After a Graph Compute instance is associated with a DataWorks workspace, the instance cannot be associated with other DataWorks workspaces.

In the Bind Graph Compute Instance dialog box, configure the parameters.


Parameter	Description
Instance Display Name	The display name of the Graph Compute compute engine instance. The display name must be 3 to 27 characters in length and can contain letters, underscores (_), and digits. The display name must start with a letter.
Graph Compute Instance Name	The name of the Graph Compute instance that you want to associate with the workspace as the compute engine instance. If you do not have a Graph Compute instance, click Create an instance to purchase a Graph Compute instance. Notice By default, each Alibaba Cloud account can purchase only one Graph Compute instance.

Click Bind.

Associate an AnalyticDB for PostgreSQL compute engine instance with a workspace

Notice

You can use the AnalyticDB for PostgreSQL compute engine only in DataWorks Standard Edition or a more advanced edition. Therefore, the AnalyticDB for PostgreSQL tab is displayed only in DataWorks Standard Edition or a more advanced edition.
AnalyticDB for PostgreSQL nodes can run only on exclusive resource groups for scheduling.

In the Compute Engine Information section, click the AnalyticDB for PostgreSQL tab.
Click Add Instance.
For a workspace in standard mode, the development environment is isolated from the production environment. If you are using a workspace in standard mode, you must add compute engine instances to both the development environment and the production environment.

In the Add AnalyticDB for PostgreSQL Instance dialog box, configure the parameters. In this example, the workspace is in standard mode.


Parameter	Description
Instance Display Name	The display name of the AnalyticDB for PostgreSQL compute engine instance. The display name must be unique.
InstanceName	The name of the AnalyticDB for PostgreSQL instance that you want to associate with the workspace as the compute engine instance.
DatabaseName	The name of the AnalyticDB for PostgreSQL database that you want to associate with the workspace.
Username	The username that you can use to connect to the database. You can obtain the information from the Account Management page in the AnalyticDB for PostgreSQL console. For more information, see Create a database account.
Password	The password that you can use to connect to the database.You can obtain the information from the Account Management page in the AnalyticDB for PostgreSQL console. For more information, see Create a database account.
Connectivity Test	AnalyticDB for PostgreSQL nodes must be run on exclusive resource groups for scheduling. Therefore, you must select an exclusive resource group for scheduling. For more information, see Exclusive resource group mode. Click Test Connectivity to test the connectivity between the specified exclusive resource group for scheduling and AnalyticDB for PostgreSQL instance. If no exclusive resource group for scheduling is available, click Create Exclusive Resource Group to create one.

After the connectivity test is passed, click Confirm.

Associate an AnalyticDB for MySQL compute engine instance with a workspace

Notice

You can use the AnalyticDB for MySQL compute engine only in DataWorks Standard Edition or a more advanced edition. Therefore, the AnalyticDB for MySQL tab is displayed only in DataWorks Standard Edition or a more advanced edition.
AnalyticDB for MySQL nodes can run only on exclusive resource groups for scheduling.
If you want to use a RAM user to associate an AnalyticDB for MySQL compute engine instance with a workspace, you must make sure that the RAM user is granted the DescribeDBClusters permission. For more information about how to grant permissions to a RAM user, see RAM users and permissions.

In the Compute Engine Information section, click the AnalyticDB for MySQL tab.
Click Add Instance.
For a workspace in standard mode, the development environment is isolated from the production environment. If you are using a workspace in standard mode, you must add compute engine instances to both the development environment and the production environment.

In the Add an AnalyticDB for MySQL instance dialog box, configure the parameters. In this example, the workspace is in standard mode.


Parameter	Description
Instance Display Name	The display name of the AnalyticDB for MySQL compute engine instance. The display name must be unique.
InstanceName	The name of the AnalyticDB for MySQL cluster that you want to associate with the workspace as the compute engine instance.
DatabaseName	The name of the AnalyticDB for MySQL database that you want to associate with the workspace.
Username	The username that you can use to connect to the database. You can obtain the information from the Accounts page in the AnalyticDB for MySQL console. For more information, see Database accounts and permissions.
Password	The password that you can use to connect to the database.You can obtain the information from the Accounts page in the AnalyticDB for MySQL console. For more information, see Database accounts and permissions.
Connectivity Test	AnalyticDB for MySQL nodes must be run on exclusive resource groups for scheduling. Therefore, you must select an exclusive resource group for scheduling. For more information, see Exclusive resource group mode. Click Test Connectivity to test the connectivity between the specified exclusive resource group for scheduling and AnalyticDB for MySQL cluster. If no exclusive resource group for scheduling is available, click Create Exclusive Resource Group to create one.

After the connectivity test is passed, click Confirm.

Associate a CDH compute engine instance with a workspace

In the Compute Engine Information section, click the CDH tab.
Click Add Instance.
For a workspace in standard mode, the development environment is isolated from the production environment. If you are using a workspace in standard mode, you must add compute engine instances to both the development environment and the production environment.

In the Add CDH Compute Engine dialog box, configure the parameters.

You can set the Access Mode parameter to Shortcut mode or Security mode. If Security mode is selected, the permissions on the data of the nodes that are run by using different Alibaba Cloud accounts or RAM users can be isolated. The following figure shows the Add CDH Compute Engine dialog box.


Parameter	Description
Instance Display Name	The display name of the CDH compute engine instance. The display name must be unique.
Access Mode	If Shortcut mode is used, multiple Alibaba Cloud accounts or RAM users map to the same CDH cluster account. These Alibaba Cloud accounts or RAM users can access data in the same CDH cluster account. In this case, data permissions are not isolated. If Security mode is used, you can configure mappings between Alibaba Cloud accounts or RAM users and CDH cluster accounts to isolate the permissions on the data of the nodes that are run by using the Alibaba Cloud accounts or RAM users.
Select Cluster	If Shortcut mode is selected for Access Mode, you must select a CDH cluster whose Authentication Type is not set to Kerberos Account Authentication. If you do not have a CDH cluster, create one. For more information, see Add the configurations of a CDH cluster to DataWorks. If Security mode is selected for Access Mode, you must select a CDH cluster whose Authentication Type is set to Kerberos Account Authentication. You can check whether Kerberos Account Authentication is enabled for the CDH cluster in the DataWorks console. On the Workspace Management page, click Hadoop Config in the left navigation pane and find the cluster of which you want to view the configuration. Then, click Modify to view the setting of the Authentication Type parameter in the Mapping Configuration section. If you do not have a CDH cluster, create one.
Access Identity	Shortcut mode: The Authentication Type parameter is set to No Authentication by default. You can use only the admin or hadoop account. These accounts are used only to commit nodes. Security mode: You can set Account for Scheduling Nodes based on your business requirements. For a CDH cluster in the production environment, this identity is used to automatically schedule and run a node after the node is committed. You must configure mappings between Alibaba Cloud accounts or RAM users and CDH cluster accounts. For more information about how to configure the mappings, see Configure mappings between Alibaba Cloud accounts or RAM users and Kerberos accounts. Valid values: Task Owner, Alibaba Cloud primary account, and Alibaba Cloud sub-account. Note This parameter is available only for the production environment. On the DataStudio page, the identity used to run nodes is the CDH cluster account that is mapped to the Alibaba Cloud account or RAM user used to log on to the console. Therefore, you must configure the identity mappings not only for scheduling access identities but also for workspace developers to prevent nodes from failing to run. The default value of this parameter for the development environment is Task owner.
Exclusive Resource Group for Scheduling	Select an exclusive resource group for scheduling that connects to the DataWorks workspace. If no exclusive resource group for scheduling is available, create one. For more information about how to create an exclusive resource group for scheduling and configure network connectivity, see Create and use an exclusive resource group for scheduling. After you select an exclusive resource group for scheduling, click Test Connectivity to test the connectivity between the exclusive resource group for scheduling and the CDH cluster.

After the connectivity test is passed, click Confirm.

Associate a ClickHouse compute engine instance with a workspace

Before you associate a ClickHouse compute engine instance with a workspace, make sure that the following prerequisites are met:

A ClickHouse cluster is created. You can use one of the following methods to create a ClickHouse cluster:
- Create a ClickHouse cluster in the EMR console.
- Create a ClickHouse cluster in the ApsaraDB for ClickHouse console. For more information, see Create a cluster.
DataWorks is activated, and the workspace that you want to use to associate with the ClickHouse cluster is created. The workspace that is used to associate with the ClickHouse cluster does not need to be associated with other types of compute engine instances. Therefore, when you create the workspace, you do not need to select a compute engine. For more information about how to create a workspace, see Create a workspace.
An exclusive resource group for scheduling is created and is associated with the DataWorks workspace. For more information, see Create and use an exclusive resource group for scheduling.

Note We recommend that you associate the exclusive resource group for scheduling with the virtual private cloud (VPC) to which the ClickHouse cluster belongs. If you want to associate the exclusive resource group for scheduling with a different VPC in the same region as the ClickHouse cluster or with a VPC in another region, you must perform complex network connectivity tests. For more information, see Select network connectivity solution .

In the Compute Engine Information section, click the ClickHouse tab.
Click Add Instance.
For a workspace in standard mode, the development environment is isolated from the production environment. If you are using a workspace in standard mode, you must add compute engine instances to both the development environment and the production environment.

In the Add EMR ClickHouse Cluster dialog box, configure the parameters.


Parameter	Description
Instance Display Name	The display name of the ClickHouse compute engine instance. The display name must be unique.
Cluster Type	The mode in which you want to associate a ClickHouse cluster with the workspace as the compute engine instance. Valid values: Connection String Mode and EMR Cluster Mode.
Access Mode	The access mode of the ClickHouse cluster. Valid value: Shortcut mode. In shortcut mode, when an Alibaba Cloud account or RAM user is used to run code or auto triggered nodes, code is committed only to the ClickHouse cluster. The user that you specified in the AccessKey ID section is actually used to run nodes in DataWorks.
Cluster information	If you set the Cluster Type parameter to Connection String Mode, you must specify the Java Database Connectivity (JDBC) connection string that is used to connect to the ClickHouse cluster for the JDBC URL parameter. If you set the Cluster Type parameter to EMR Cluster Mode, you must set the Select EMR ClickHouse Cluster parameter to the ID of the EMR ClickHouse cluster that you want to associate with the workspace. Note If you log on to the DataWorks console by using a RAM user, you must attach the AliyunEMRDevelopAccess policy to the RAM user in the RAM console before you select a cluster. For more information about attach the AliyunEMRDevelopAccess policy to the RAM user, see Grant permissions to RAM users.
Username	The username that you use to connect to the ClickHouse cluster. To view the username of an EMR ClickHouse cluster, log on to the EMR console, click the Cluster Management tab, find the ClickHouse cluster, and then click Details in the Actions column. Then, go to the ClickHouse service page to view the username.
Password	The password that you use to connect to the ClickHouse cluster. To view the password of an EMR ClickHouse cluster, log on to the EMR console, click the Cluster Management tab, find the ClickHouse cluster, and then click Details in the Actions column. Then, go to the ClickHouse service page to view the password.
Exclusive Resource Group for Scheduling	Select an exclusive resource group for scheduling that connects to the DataWorks workspace. If no exclusive resource group for scheduling is available, create one. For more information about how to create an exclusive resource group for scheduling and configure network connectivity, see Create and use an exclusive resource group for scheduling.

The following figure shows how to view the username and password of a ClickHouse cluster in the EMR console. View cluster information

After the connectivity test is passed, click Confirm.