Data Management (DMS) provides four types of resource roles: database administrators (DBAs) of database instances, owners of database instances, database owners, and table owners. The following table describes these resource roles and their permissions.

Role Description Permission
DBA of a database instance
  • Each database instance has only one DBA.
  • DBAs and DMS administrators can manage the DBAs of database instances.
  • The DBA of a database instance can view user permissions on each database of the database instance, and grant or revoke permissions on the databases and tables in the database instance.
  • The DBA of a database instance can query all data, except sensitive fields, in the databases of the database instance. The DBA can also submit tickets to perform operations on the data and schemas of the database instance without the need to apply for permissions.
  • DMS automatically identifies and assigns DBAs of database instances to DBA nodes in approval processes.
Owner of a database instance
  • Each database instance has up to three owners.
  • For an ApsaraDB instance, the default owner is the Alibaba Cloud account that is used to create the ApsaraDB instance.
  • For a database instance that is not an ApsaraDB instance, the default instance owner is the Alibaba Cloud account or RAM user that is used to add the database instance to DMS.
  • DMS administrators or owners of a database instance can transfer the ownership of the database instance to another account.
  • The owner of a database instance can manage the permissions on the database instance. For example, the owner of a database instance can grant or revoke permissions on the database instance.
  • The owner of a database instance can query all data, except sensitive fields, in the databases of the database instance. The owner can also submit tickets to perform operations on the data and schemas of the database instance without the need to apply for permissions.
Database owner
  • Each database has up to three owners. When the data dictionary of a database is synchronized for the first time, the DBA of the database instance to which the database belongs automatically becomes an owner of the database.
  • DBAs, DMS administrators, and owners of a database can add or remove an owner of the database, or transfer the ownership of the database from an existing owner to another user.
  • A DMS user can submit a ticket to apply to be a database owner.
  • The owner of a database can manage permissions on the database. For example, the owner can grant or revoke permissions on the database or the tables in the database.
  • The owner of a database can query all data, except sensitive fields, in the database. The owner can also submit tickets to perform operations on the data and schemas in the database without the need to apply for permissions.
  • DMS automatically identifies and assigns database owners to owner nodes in approval processes.
Table owner
  • Each table has up to three owners. By default, the owners of a table are the owners of the database to which the table belongs.
  • DBAs, DMS administrators, and owners of a table can add or remove an owner of the table, or transfer the ownership of the table from an existing owner to another user.
  • A DMS user can submit a ticket to apply to be a table owner.
  • The owner of a table can manage permissions on the table. For example, the owner can grant or revoke permissions on the table.
  • The owner of a table can query all data, except sensitive fields, in the table.
Note For more information about how to apply for and manage resource roles, see Permission management.