You can customize approval processes for MaxCompute tables, resources, and functions.
You can specify the data range to which an approval process applies based on a MaxCompute project or data classification in Data Security Guard. For more information, see the Specify the data range section.
- Only workspace administrators and the RAM users with the AliyunDataWorksFullAccess permission can create and manage approval policies.
- Only Enterprise Edition and Ultimate Edition of DataWorks allow you to configure approval policies for MaxCompute data.
Create an approval policy
- Log on to the DataWorks console.
- In the left-side navigation pane, click Workspaces.
- After you select the region in which the workspace that you want to manage resides, find the workspace and click Data Analytics in the Actions column.
- On the DataStudio page, click the icon in the upper-left corner and choose .
- In the left-side navigation pane of the page that appears, choose . On the page that appears, you can view a list of created approval policies and edit and delete approval policies.
- Click Create Policy in the upper-right corner. Complete the Create Policy wizard.
Enter the basic information
Specify the data range
You must specify the data range to which this approval policy applies based on the actual scenario. After this approval policy is created, the applications for the permissions on the data in this data range must be processed based on this approval policy.
If a MaxCompute compute engine is used, you can specify the data range of an approval policy in a workspace based on a MaxCompute project or data classification in Data Security Guard.When you specify the data range, take note of the following items:
- Specify the data range based on a MaxCompute project
- You must select an appropriate MaxCompute project from the MaxCompute Project drop-down list. This way, when applications are submitted to apply for the permissions on the tables in this MaxCompute project, this approval policy is used to process the applications.
- A MaxCompute project can be associated with only one MaxCompute project-based approval policy. Otherwise, a policy conflict error is reported.
- You can select a MaxCompute project in which the current account assumes the administrator
or super administrator role. If no MaxCompute project is displayed in the drop-down
list, the current account may not have the required permissions. In this case, you
must use an account that is assigned the Admin or Super_Administrator role.
Note A DataWorks administrator is assigned the role_project_admin role in DataWorks workspaces, but not the Admin or Super_Administrator role in MaxCompute projects.
To check the role of the current account, run the
whoamicommand on the DataStudio page in DataWorks to obtain the account information. Then, run the
show grants for Your current accountcommand to check whether the current account is assigned the Admin or Super_Administrator role in a MaxCompute project.
- Specify the data range based on data classification in Data Security Guard
- You must select a data security level from the Select Data Security Level drop-down list. This way, when applications are submitted to apply for the permissions on the tables at this data security level, this approval policy is used to process the applications.
- A data security level can be associated with only one data classification-based approval policy. Otherwise, a policy conflict error is reported.
- You can specify the data range by using an Alibaba Cloud account or as a RAM user.
If you specify the data range as a RAM user, the following conditions must be met:
- The AdministratorAccess policy is attached to the RAM user.
- The RAM user is granted the AliyunDataWorksFullAccess permission and assigned the Project Owner or Super_Administrator role of all MaxCompute projects.
Configure the notification methods
- To ensure that the approvers can receive approval notifications by using text messages or emails, you must add the approvers as alert contacts of DataWorks. For more information, see Configure and view alert contacts.
- To ensure that the approvers can receive notifications by using a DingTalk chatbot,
select Custom Keywords when you set the Security Settings parameter in the Add Robot dialog box. Then, enter DataWorks in the Custom Keywords field. Make sure that the other check boxes are cleared when you set the Security Settings parameter.
If you do not add DataWorks as a custom keyword or you select other check boxes when you set the Security Settings parameter, the approvers cannot receive notifications by using the DingTalk chatbot.
Configure the approval nodes
- The approval nodes are sequentially connected. After you configure the approval policy, the approval process specified in the approval policy sequentially flows from node to node. After an approver on an approval node gives approval, the approvers on the next approval node receive a notification and then start approval.
- You can specify different roles as approvers on different approval nodes. The following
roles are supported: DataWorks workspace roles, DataWorks workspace member, table
owner, Alibaba Cloud account, and MaxCompute roles.
- When an application is submitted for approval, DataWorks sends notifications to the approvers on the approval nodes based on the notification methods configured in the preceding step. You must add the approvers as alert contacts of DataWorks. For more information, see Configure and view alert contacts.
- If multiple users that assume the same role are specified as approvers on an approval node, notifications are sent to all the approvers. In this case, if one of the approvers on an approval node gives approval, the application is forwarded to the next approval node.