MaxCompute resource access and permissions in different workspace modes

DataWorks workspaces run in either basic mode or standard mode. The mode determines how many MaxCompute environments are available, which accounts run tasks, and whether the Develop role can access production data. Understanding these differences helps you manage data security and configure the correct permission structure for your team.

Prerequisites

Before you begin, ensure that you have:

Familiarity with differences between basic mode and standard mode
Familiarity with permission management for MaxCompute

Workspace modes at a glance

	Basic mode	Standard mode
Environments	Production only	Development + production (isolated)
Develop role maps to	`Role_Project_Dev` in production	`Role_Project_Dev` in development only
Develop role access to production data	Full read/write	None (by default)
DataStudio runs tasks as	Scheduling engine account	Current logon user
Operation Center runs tasks as	Scheduling engine account	Scheduling engine account
Default table namespace in DataStudio	`projectname.tablename`	`projectname_dev.tablename`
Production data changes require approval	No	Yes

Permission management by mode

Basic mode

In basic mode, the Develop role is mapped to the Role_Project_Dev role of the associated MaxCompute compute engine in the production environment. This mapping grants the following permissions:

Read all data in the MaxCompute compute engine.
Read and write all tables, including the ability to create, modify, and delete tables.
Commit nodes to the scheduling system and modify production data without going through an approval process.

Because basic mode provides only the production environment, all operations directly affect production data.

Warning

In basic mode, the Develop role has full management permissions on production data. Do not specify an Alibaba Cloud account as the scheduling engine account — Alibaba Cloud accounts have full permissions on all resources, which creates a significant security risk.

Standard mode

In standard mode, the Develop role is mapped to Role_Project_Dev only in the development MaxCompute compute engine (projectname_dev). The Develop role:

Can read all data in the development MaxCompute compute engine.
Has no access to the production MaxCompute compute engine by default.
Must go through a code review and approval process to deploy nodes to production.

This separation ensures that production data remains stable and protected.

Note

RAM users who are not designated as scheduling engine accounts do not have default access to production data. To grant a RAM user access to production tables, request the permissions in Security Center.

Data access behaviors

How tasks run and which resources they access depends on the workspace mode and where the task originates.

Standard mode

In DataStudio (development environment):

Tasks run under the current logon user's account. The default resource namespace is the development project:

-- Accesses projectname_dev.tablename in the development environment
select col1 from tablename

To access production data from DataStudio, specify the fully qualified project name:

-- Accesses projectname.tablename in the production environment
-- Requires the current user to have explicit permissions on the production table
select col1 from projectname.tablename

In Operation Center (scheduling environment):

Tasks run under the account or role designated for the scheduling engine. Resources are accessed in the production environment:

-- Accesses projectname.tablename in the production environment
select col1 from tablename

The permissions required are those granted to the scheduling engine account or role.

Basic mode

Both DataStudio and Operation Center run tasks under the account or role designated for the scheduling engine. All resources are accessed in the production environment:

-- Accesses projectname.tablename in the production environment
select col1 from tablename

Note

If an Alibaba Cloud account is designated as the scheduling engine account, that account is used for all task runs, regardless of who is currently logged in.

Table naming formats

The workspace mode determines the naming format of tables in MaxCompute.

Environment	Naming format	Example
Development (standard mode only)	`projectname_dev.tablename`	`projectA_dev.user_info`
Production (both modes)	`projectname.tablename`	`projectA.user_info`

In basic mode, only the production environment exists. All tables use the projectname.tablename format.

When accessing production tables from DataStudio in standard mode, always use the fully qualified projectname.tablename format to avoid ambiguity and prevent accidental writes to production.