Manage users

add user username;

add user ALIYUN$odps_test_user@aliyun.com;
add user RAM$ram_test_user;

list users;
-- The following output indicates that the Alibaba Cloud account odps_test_user@aliyun.com and the RAM user ram_test_user of Alice have been added to the project. 
RAM$alice@aliyun.com:ram_test_user
ALIYUN$odps_test_user@aliyun.com

• Use DataWorks. For more information, see Prepare a RAM user.
• Run the following command on the MaxCompute client:

  add accountprovider ram;
  OK

  After the project is added, the project owner can run the following command to view the account system supported by the project and confirm whether the RAM user is added:

  list accountproviders;

  Note

  • MaxCompute allows only an Alibaba Cloud account to add its RAM users to the project. Therefore, when you run the add user command, you do not need to specify the Alibaba Cloud account of the RAM user. By default, the account that is used to run this command is the Alibaba Cloud account of the RAM user.
  • MaxCompute projects recognize only the RAM account system but not the RAM permission system. After RAM users of your Alibaba Cloud account are added to a MaxCompute project, MaxCompute authenticates these RAM users but does not consider the permission definitions in RAM.

1. Create a RAM role. For more information, see Create a RAM role for a trusted Alibaba Cloud account, Create a RAM role for a trusted IdP, or Create a RAM role for a trusted Alibaba Cloud service.

   For example, the name of the created RAM role is vuser1.

2. Define the policy attached to the RAM role. For more information, see Edit the trust policy of a RAM role.
   Some operations may need to be performed in DataWorks. Therefore, you must assign the RAM role to DataWorks so that you can submit periodic scheduling jobs to MaxCompute in DataWorks. Sample statements of a trust policy:

   {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Principal": {
                   "Service": [
                       "dataworks.aliyuncs.com"
                   ]
               }
           }
       ],
       "Version": "1"
   }

3. Add the RAM role to a MaxCompute project. You can use one of the following methods:
   • Method 1: Use the MaxCompute client (odpscmd) or log on to the MaxCompute console (query editor) and run the following command in the MaxCompute project:

     add user `RAM$<Alibaba Cloud account>:role/RAM role name`;

     For example, if you want to authorize RAM user abc@example.com to use the RAM role vuser1, run the following command: RAM$abc@example.com:role/vuser1.

     You can run the list users; command to check whether the RAM role has been added to the MaxCompute project.

   • Method 2: Log on to the MaxCompute console. On the Project management tab, find your project and click Member management in the Actions column to go to the Member management page. Add the RAM role to the project. For more information about how to add members on the Member management page, see Add workspace members.

• Scenario 1: Jack is the administrator of the prj1 project. A new user Alice with the Alibaba Cloud account alice@aliyun.com applies for joining prj1 and requires the permissions to view tables, submit jobs, and create tables.
  Users with the Admin role in the project or the project owner can run the following command on the MaxCompute client:

  -- Enter prj1. 
  use prj1; 
  -- Add Alice to the project.  
  add user aliyun$alice@aliyun.com; 
  -- Grant permissions to Alice. 
  grant List, CreateTable, CreateInstance on project prj1 to user aliyun$alice@aliyun.com; 

• Scenario 2: The Alibaba Cloud account bob@aliyun.com is added to the $user_project_name project. The user needs to be granted the permissions to create tables, obtain table information, and execute functions.
  Users with the Admin role in the project or the project owner can run the following command on the MaxCompute client:

  -- Grant bob@aliyun.com the CREATE TABLE permission on the $user_project_name project. 
  grant CreateTable on PROJECT $user_project_name to USER ALIYUN$bob@aliyun.com;
  -- Grant bob@aliyun.com the DESCRIBE permission on the $user_table_name table.   
  grant Describe on Table $user_table_name to USER ALIYUN$bob@aliyun.com;
  -- Grant bob@aliyun.com the EXECUTE permission to execute the $user_function_name function.  
  grant Execute on Function $user_function_name to USER ALIYUN$bob@aliyun.com;  

1. View the account system supported by the project.

   list accountproviders;
   -- The following result is returned: 
   ALIYUN, RAM

   The output shows that the RAM account system is supported by the project, which means that you can add RAM users to this project. If RAM users are not supported, run the add accountprovider ram; command to add the RAM account system.

2. Add a RAM user to the project and grant the DESCRIBE permission on the src table to the RAM user:

   add user ram$bob@aliyun.com:Alice;
   -- The following result is returned: 
   OK: DisplayName=RAM$bob@aliyun.com:Alice
   -- Grant the DESCRIBE permission to the RAM user. 
   grant Describe on table src to user ram$bob@aliyun.com:Alice;
   -- The following result is returned: 
   OK

remove user;

-- Remove users. 
remove user ALIYUN$odps_test_user@aliyun.com;
remove user RAM$ram_test_user;
-- Run the following command to check whether the users have been removed: If these two users are not included in the returned results, they have been removed from the project.  
list users;