Authorization

MaxCompute supports authorization using the syntax similar to the GRANT and REVOKE commands defined by SQL92. It grants or revokes permissions to/from the existing project object through simple authorization statements. The authorization syntax is as follows:

    grant actions on object to subject
    revoke actions on object from subject
    actions ::= action_item1, action_item2, ...
    object ::= project project_name | table schema_name |
               instance inst_name | function func_name |
                resource res_name
    subject ::= user full_username | role role_name

Users familiar with GRANT and REVOKE commands defined by SQL92 or with Oracle database security management can identify that the ACL authorization syntax of MaxCompute does not support [WITH GRANT OPTION] authorization parameters. For example, when User A authorizes User B to access an object, User B cannot grant the permission to User C. In this scenario, all permissions can be granted by one of the following three roles:

• Project owner
• Project administrator
• Object creator

The project administrator bob performs the following authorization operations:

    use test_project_a;
    add user aliyun$alice@aliyun.com;
    add user ram$bob@aliyun.com:Allen; 
    create role worker;
    grant worker TO aliyun$alice@aliyun.com; 
    grant worker TO ram$bob@aliyun.com:Allen; 
    grant CreateInstance, CreateResource, CreateFunction, CreateTable, List ON PROJECT test_project_a TO ROLE worker; 

The project administrator performs the following authorization operations for test_project_b:

    use test_project_b; --Open the project
    add user aliyun$alice@aliyun.com; --Add the user
    add user ram$bob@aliyun.com:Allen; --Add th RAM sub-account
    create role prj_a_worker; --Create a role
    grant prj_a_worker TO aliyun$alice@aliyun.com; --Grant the role
    grant prj_a_worker TO ram$bob@aliyun.com:Alice; --Grant the role
    grant Describe , Select ON TABLE prj_b_test_table TO ROLE prj_a_worker; --Authorize the role
    grant Read ON Function prj_b_test_udf TO ROLE prj_a_worker; --Authorize the role
    grant Read ON Resource prj_b_test_udf_resource TO ROLE prj_a_worker; --Authorize the role
--After authorization, the two users query table and use udf in test_project_a as follows:
use test_project_a;
select test_project_b:prj_b_test_udf(arg0, arg1) as res from test_project_b.prj_b_test_table;