Users and roles

This topic describes the permissions of Alibaba Cloud accounts and RAM users in MaxCompute and DataWorks.

After you create a project, you are the owner of the project, and you have all permissions on the tables, instances, resources, and UDFs in the project. Objects in a project can only be accessed by the owner and users authorized by the owner. Project is the foundation of the MaxCompute multi-tenant system, the basic unit of data management and computing, and the billing entity.

• If you add and authorize users by using DataWorks, see Add workspace members.
• If you add, delete, or authorize users (RAM users included) by using MaxCompute security management commands, see Manage users.
• If you add, delete, or authorize roles by using MaxCompute security management commands, see Manage roles.
• For more information about authorization and permission check, see Authorize users and Check permissions.
  Note For RAM users that have roles in a MaxCompute or DataWorks project, revoke the roles of the RAM users in the project and remove the users from the project before you delete them. Otherwise, the RAM user is displayed as "p4_xxxxxxxxxxxxxxxxxxxx" and cannot be removed from the project. This issue does not affect the use of the project. Example:

  -- The RAM user is displayed in a project as follows:
  odps@ MaxCompute>list users;
  p4_2652900xxxxxxxxxx
  -- The RAM user cannot be removed from the project.
  odps@ MaxCompute_DOC>remove user p4_2652900xxxxxxxxxx;
  Confirm to "remove user p4_2652900xxxxxxxxxx
  ;" (yes/no)? yes
  FAILED: lack of account provider
  -- You can still see the RAM user on the Members page of DataWorks. If you want to delete this RAM user, you must revoke all roles from the user.
  odps@ MaxCompute>revoke role_project_security, role_project_admin, role_project_dev, role_project_pe, role_project_deploy, role_project_guest from RAM$MainCount:hanmeimei;
  OK
  -- Run the following command to remove the RAM user so that it can be deleted:
  odps@ MaxCompute>remove user RAM$MainCount:hanmeimei;