Grant permissions to tenant-level roles

This topic describes how to grant permissions to tenant-level roles, use related commands, and manage these roles to control access to tenant-level objects like quotas and NetworkLinks.

Background

In MaxCompute, permissions for objects like projects, tables, functions, resources, and instances are typically managed at the project level, which requires adding a user to a project before granting permissions. In contrast, you can use a policy to grant a tenant-level role permissions for actions on quota and NetworkLink objects.

Prerequisites

Only an Alibaba Cloud account or a RAM user with the tenant-level Super_Administrator or Admin role can manage tenant-level permissions.
Tenant-level permissions can be controlled only through tenant-level roles.
You can grant permissions to a tenant-level role only by using a policy.

Workflow for tenant-level role authorization

Create a tenant-level role named t_role1.
Grant permissions to the t_role1 role by using a policy.
Add a user as a tenant member.
Assign the t_role1 role to the user.

Commands

-- Run the following commands in a project within the tenant.

-- Add or remove a user from a tenant.
    ADD tenant USER <user_name>;
    REMOVE tenant USER <user_name>;
    
-- View users and roles in a tenant.
    List tenant users;
    List tenant roles;
    
-- Create or drop a tenant-level role.
    CREATE tenant role <role_name>;
    DROP tenant role <role_name>;
-- Grant a tenant-level role to a user or revoke it from a user.
    GRANT tenant role <rolename> TO USER <user_name>;
    REVOKE tenant role <rolename> FROM USER <user_name>;

-- Add a tenant-level role to a project or remove it from a project.
    ADD tenant role <rolename> TO project <projectname>;
    REMOVE tenant role <rolename> FROM project <projectname>;

-- View the permissions of a tenant-level role or user.
    SHOW grants FOR tenant role <role_name>;
    SHOW grants FOR tenant USER <user_name>;
    SHOW principals FOR tenant [role] <role_name>;

Manage permissions in the console

Create a tenant role

Log in to the MaxCompute console and select a region in the upper-left corner.
In the left-side navigation pane, choose Manage Configurations > Tenants .
On the Tenants page, click the Roles tab.

On the Roles tab, click Add Role. In the Add Role dialog box, enter a custom Role Name, provide the Policy Content, and then click OK.

Parameter

Description

Role Name

A unique name for the tenant-level role that meets the following requirements:

Starts with a letter.
Contains only letters, underscores (_), and digits.
Is 6 to 64 characters in length.

Policy Content

Permission policies for roles.Edit policy code based on policy templates in the interface.

policycontent example,The following example shows:

Fornetworklinkobjects, allow this role for all network links to haveCreateNetworkLink,ListandExecuteoperation permissions.
ForQuotaobjects, allow this role for all Region in all Quota to haveUsagepermissions.

{
    "Statement":[
        {
            "Action":[
                "odps:CreateNetworkLink",
                "odps:List",
                "odps:Execute"
            ],
            "Effect":"Allow",
            "Resource":[
                "acs:odps:*:networklinks/*"
            ]
        },
        {
            "Action":[
                "odps:Usage"
            ],
            "Effect":"Allow",
            "Resource":[
                "acs:odps:*:regions/*/quotas/*"
            ]
        }
    ],
    "Version":"1"
}

On the Tenants page, click the Users tab.
On this tab, you can manage tenant-level users. This includes adding new users from the current Alibaba Cloud account and granting them tenant-level roles.

Manage tenant roles

Log in to the MaxCompute console and select a region in the upper-left corner.
In the left-side navigation pane, choose Manage Configurations > Tenants .
On the Tenants page, click the Roles tab.
In the Actions column of the role list, you can view, delete, or modify a role.

Manage tenant users

Log in to the MaxCompute console and select a region in the upper-left corner.
In the left-side navigation pane, choose Manage Configurations > Tenants .
On the Tenants page, click the Users tab.
On this tab, you can manage tenant-level users. This includes adding new users from the current Alibaba Cloud account and granting them tenant-level roles.