DataHub:Access control

Access control

DataHub uses Resource Access Management (RAM) for access control. An Alibaba Cloud account has full permissions on its resources. RAM users have no DataHub permissions by default — attach a policy to grant access. For more information about how to create a RAM user and attach policies to the user, see Bind an MFA device to an Alibaba Cloud account.

Grant permissions to RAM users

Supported resource types

RAM authentication covers projects, topics, and subscriptions, but not shard-level data. A subscription binds an application to read and process records from topics in a project.

Resource type	Description
Project	acs:dhs:$region:$accountid:projects/$projectName
Topic	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
Subscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId

API operations and RAM actions

Project

Operation	Action	Resource
CreateProject	dhs:CreateProject	acs:dhs:$region:$accountid:projects/*
ListProject	dhs:ListProject	acs:dhs:$region:$accountid:projects/*
DeleteProject	dhs:DeleteProject	acs:dhs:$region:$accountid:projects/$projectName
GetProject	dhs:GetProject	acs:dhs:$region:$accountid:projects/$projectName

Topic

Operation	Action	Resource
CreateTopic	dhs:CreateTopic	acs:dhs:$region:$accountid:projects/$projectName/topics/*
ListTopic	dhs:ListTopic	acs:dhs:$region:$accountid:projects/$projectName/topics/*
DeleteTopic	dhs:DeleteTopic	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
GetTopic	dhs:GetTopic	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
UpdateTopic	dhs:UpdateTopic	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

Subscription

Operation	Action	Resource
CreateSubscription	dhs:CreateSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/*
DeleteSubscription	dhs:DeleteSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId
GetSubscription	dhs:GetSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId
UpdateSubscription	dhs:UpdateSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId
ListSubscription	dhs:ListSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/*
CommitOffset	dhs:GetSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId
GetOffset	dhs:GetSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId

Connector

Operation	Action	Resource
CreateConnector	dhs:CreateConnector	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*
DeleteConnector	dhs:DeleteConnector	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*
GetConnector	dhs:GetConnector	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*
UpdateConnector	dhs:UpdateConnector	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*
ListConnector	dhs:ListConnector	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*

Shard

Operation	Action	Resource
ListShard	dhs:ListShard	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
MergeShard	dhs:UpdateShard	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
SplitShard	dhs:UpdateShard	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

PubSub

Operation	Action	Resource
PutRecords	dhs:PutRecords	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
GetRecords	dhs:GetRecords	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
GetCursor	dhs:GetRecords	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

Policy conditions

Condition	Feature	Valid value
acs:SourceIp	Source IP address or CIDR block.	Standard IP address. Wildcard (*) supported.
acs:SecureTransport	Whether the request uses HTTPS.	true/false
acs:MFAPresent	Whether MFA is enabled at logon.	true/false
acs:CurrentTime	Time-based access restriction.	ISO 8601 format.

System policies

DataHub provides the following built-in system policies.

AliyunDataHubFullAccess

Grants full access to all DataHub resources.

AliyunDataHubReadOnlyAccess

Grants read-only access to all DataHub resources, including querying projects and reading data. Does not permit create, update, or write operations.

AliyunDataHubSubscribeAccess

Grants data subscription permissions. Allows only read-related operations: GetTopic, ListShard, GetRecords, and all subscription and offset operations.

AliyunDataHubPublishAccess

Grants data publishing permissions. Allows only write-related operations: GetTopic, ListShard, and PutRecords.

Custom policies

If system policies do not meet your needs, create custom policies in the RAM console at Permissions > Policies. Examples:

View accessible projects

// To allow a RAM user to view the projects that the RAM user has the permissions to access in the DataHub console, add the following configurations to the statement block.
// To display the accessible projects in the DataHub console, the permissions to call the ListProject and GetProject operations are required.
{
  "Action": ["dhs:ListProject","dhs:GetProject"], 
  "Resource": "acs:dhs:*:*:projects/*",
  "Effect": "Allow"
}

Create a topic

// To display the topics of a project in the DataHub console, the permissions to call the ListTopic and GetTopic operations are required.
// To grant a RAM user the permissions to create a topic in the project named "test" in the DataHub console, use the following configurations.
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:ListProject", "dhs:GetProject"],
      "Resource": "acs:dhs:*:*:projects/*",
      "Effect": "Allow"
    },
    {
      "Action": ["dhs:ListTopic", "dhs:GetTopic", "dhs:CreateTopic"],
      "Resource": "acs:dhs:*:*:projects/test/topics/*",
      "Effect": "Allow"
    }
  ]
}

Other custom policies

// Sample custom policy that grants a RAM user the permissions to query the information about topics in a specified project.
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:ListTopic", "dhs:GetTopic"],
      "Resource": "acs:dhs:cn-hangzhou:12121312:projects/foo/topics/*",
      "Effect": "Allow"
    }
  ]
}
// Sample custom policy that grants a RAM user all the permissions on subscriptions to topics in the project named "foo".
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:*Subscription"],
      "Resource": "acs:dhs:cn-hangzhou:*:projects/foo/topics/*/subscriptions/*",
      "Effect": "Allow"
    }
  ]
}
// Sample custom policy that grants a RAM user the permissions to query the information about subscriptions to topics in the project named "foo".
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:ListSubscription"],
      "Resource": "acs:dhs:cn-hangzhou:*:projects/foo/topics/*/subscriptions/*",
      "Effect": "Allow"
    }
  ]
}
// Sample custom policy that grants a RAM user the permissions to commit offsets for the subscription with the ID "14985645198374IoCK" to topic t1 in the project named "foo".
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:GetSubscription"],
      "Resource": "acs:dhs:cn-hangzhou:*:projects/foo/topics/t1/subscriptions/14985645198374IoCK",
      "Effect": "Allow"
    }
  ]
}
// Sample custom policy that grants a RAM user the permissions to split or merge shards for a specified topic. The available operations are ListShard, SplitShard, and MergeShard.
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:*Shard"],
      "Resource": "acs:dhs:cn-hangzhou:12121312:projects/foo/topics/bar",
      "Effect": "Allow"
    }
  ]
}