Grant permissions for AIRec to access MaxCompute data - Artificial Intelligence Recommendation - Alibaba Cloud - Artificial Intelligence Recommendation

Before Artificial Intelligence Recommendation (AIRec) can read from or write to your MaxCompute project, you must grant the ALIYUN$openias service account the required permissions on your MaxCompute project and tables.

When you need to grant permissions

Grant permissions before either of the following tasks:

Task	Permissions required
Starting an AIRec instance with historical data (configuring data sources)	Read
Starting an AIRec instance with historical data (configuring offline data sources)	Read and write
Customizing recall links and sorting models (configuring feature, behavior, or sample data)	Read

For details on starting an instance with historical data, see Use historical data to start an instance.

Required permissions

The following table lists the permissions required on your MaxCompute project and tables.

Object	Action	Description	Required for
Project	Read	View project information, such as creation time. Does not include objects within the project.	Read and write
Project	List	Query all object types in a project.	Read and write
Project	CreateInstance	Create an instance in a project.	Write only
Project	CreateTable	Create a table in a project.	Write only
Table	Describe	Read table metadata.	Read and write
Table	Select	Read data from a table.	Read and write
Table	Alter	Modify table metadata, or create and delete partitions.	Write only
Table	Update	Overwrite or insert data in a table.	Write only

For more information, see MaxCompute permissions.

Grant permissions on MaxCompute to AIRec

Choose one of the following methods to run the authorization statements.

Note: If your DataWorks workspace is in standard mode, it is associated with both a development environment project and a production environment project. To grant permissions on the production environment project, add the following statement before the authorization statements and run them together:

use [project]; -- Specify the production environment project name.

Grant permissions by using the MaxCompute console

Open an ODPS SQL window in the MaxCompute console.

Add the ALIYUN$openias service account:

-- Add the openias account.
add user `ALIYUN$openias`;
-- Verify that the account was added.
list users;

Grant read permissions:

-- Replace [project] with your MaxCompute project name.
-- Replace [table] with your table name.
grant Read ON PROJECT [project] to user `ALIYUN$openias`;
grant List ON PROJECT [project] to user `ALIYUN$openias`;
grant Describe ON TABLE [table] to user `ALIYUN$openias`;
grant Select ON TABLE [table] to user `ALIYUN$openias`;

If you are configuring offline data sources, grant write permissions as well:

-- Replace [project] with your MaxCompute project name.
grant Read ON PROJECT [project] to user `ALIYUN$openias`;
grant List ON PROJECT [project] to user `ALIYUN$openias`;
grant CreateTable ON PROJECT [project] to user `ALIYUN$openias`;
grant CreateInstance ON PROJECT [project] to user `ALIYUN$openias`;

Grant permissions by using the MaxCompute client

Download and configure the MaxCompute client.
Run the following command to access the MaxCompute environment:
```
./bin/odpscmd
```