When you use Data Lake Analytics (DLA), you can use multiple types of accounts, such as Alibaba Cloud account, RAM user, and DLA accounts. DLA accounts include the root account, sub-accounts, and service accounts. This topic provides an overview of these accounts.
|Account type||Description||Usage notes|
|Alibaba Cloud account||By default, this account has the permission to call all API operations and perform all the operations in the DLA console. You can use this account to manage all the services of DLA.||The Alibaba Cloud account is used to activate and manage the DLA service. For example, you can log on to the DLA console and create a virtual cluster (VC) with the Alibaba Cloud account.|
|RAM user||A RAM user is authorized by its Alibaba Cloud account. A RAM user can manage the DLA service within the scope of authorization.||You can also use a RAM user to manage the DLA service within the scope of the permissions granted by the Alibaba Cloud account to which the RAM user belongs. For example, you can authorize a RAM user to log on to the DLA console, submit DLA Spark jobs, or call the DLA metadata.
Note RAM users are created by Alibaba Cloud accounts. RAM users do not own resources. All resources belong to Alibaba Cloud accounts.
|DLA accounts (root account, sub-accounts, and service accounts)||A DLA account is used to perform operations on DLA databases. For example, you can create and delete a schema, create and delete a table, and run the Presto-based SQL engine of DLA. The permissions of DLA accounts are separated by region. Different DLA accounts are used for DLA services deployed in different regions. A DLA account is valid only in the region in which DLA resides.||DLA accounts are classified into the following types: