Sharing your Alibaba Cloud account for team collaboration creates significant security risks. Instead, add RAM users as workspace members and assign them roles. This practice provides fine-grained access control to secure data and standardize development workflows.
How it works
DataWorks member management is based on Alibaba Cloud's RAM (Resource Access Management) and role-based access control (RBAC) models. The core mechanisms are as follows:
-
Member identity: Workspace members are essentially RAM users under your Alibaba Cloud account. DataWorks does not create or store user identities.
-
Role assignment: You grant permissions to members by assigning them roles, such as Workspace Manager, Development, or O&M.
-
Permission mapping: DataWorks role permissions are mapped to the permissions of the underlying compute engine. For example, when you grant a member the Development role in DataWorks, the system automatically grants corresponding read and write permissions to that member in the bound MaxCompute project. Understanding this mapping is key to configuring permissions correctly.
For more information about the DataWorks permission system, see DataWorks Permission Model.
Prerequisites
You must have the Workspace Administrator role for the workspace.
By default, the Alibaba Cloud account that creates a workspace is granted the Workspace Manager role for that workspace.
Add members and manage roles
-
Go to the DataWorks Management Center, select the target workspace, and click Go to Management Center.
-
In the left-side navigation pane, go to the Workspace Members and Roles tab and click Add Members in the upper-right corner. The Add Members dialog box appears.
-
(Optional) If you need to create a new RAM user, click RAM console in the prompt at the top of the dialog box to go to the RAM console and create a RAM user.
-
Select the accounts that you want to add, move them to the Selected Accounts list, and select Set Roles to grant permissions.
Important-
RAM users assigned different workspace roles have different permissions for DataWorks features. For details about predefined workspace roles, see Workspace-level access control.
-
The Workspace Manager role grants a RAM user all permissions in the workspace.
-
-
After adding members, you can view and manage their information in the Workspace Members list. You can change a member's role in the Role column and remove a member in the Operation column. The project owner cannot be removed.
Production recommendations
-
Principle of least privilege: Do not assign the Workspace Administrator role to regular developers or O&M engineers. Instead, assign specific roles such as Development, O&M, or Deploy based on job responsibilities.
-
Regular reviews: The project owner should regularly review the Workspace Members list to remove inactive members and clean up unnecessary permissions.
-
Administrator privilege risks: The Workspace Administrator role has full permissions to manage members, modify workspace configurations, and more. An operator error or a compromised account can severely impact the entire project. This role should be strictly limited to one or two core project leads.
Next steps
After adding members and assigning them roles, you can explore the following resources to learn the basics of using DataWorks.
-
For a quick start tutorial, see Comprehensive tutorial: Analyze website user profiles.
-
For more tutorials, see Tutorials.
FAQ
-
Q: Why can't I find a specific RAM user when trying to add a member?
A: First, ensure the RAM user has been created in the Alibaba Cloud RAM console. Second, in the Add Members dialog box in DataWorks, click the Refresh button to load the latest list of RAM users. -
Q: Why can't I remove a workspace member?
A: You cannot remove the Workspace Owner of a workspace. The project owner is typically the Alibaba Cloud account that created the workspace and holds all permissions for that workspace.