How to restrict access to resources, such as tables and UDFs, to specific users - DataWorks

This topic explains how to restrict access to resources, such as tables and user-defined functions (UDFs), to specific users. This method is often used for data security and control, especially when a UDF involves data encryption or decryption.

Prerequisites

Install the MaxCompute client. For more information, see Install and configure the MaxCompute client.

Background information

Standard methods for configuring user access permissions include the following:

Using packages for fine-grained permission control

A package is used to share data and authorize access to resources across projects. However, granting a user the developer role with a package gives that user full permissions, which creates a security risk. For more information, see Access resources across projects by using packages.
- The following output shows the permissions of the DataWorks developer role:
```
odps@ xxx    desc role role_project_dev;

Authorization Type: Policy
A       projects/sz_mc: *
A       projects/sz_mc/instances/*: *
A       projects/sz_mc/jobs/*: *
A       projects/sz_mc/offlinemodels/*: *
A       projects/sz_mc/packages/*: *
A       projects/sz_mc/registration/functions/*: *
A       projects/sz_mc/resources/*: *
A       projects/sz_mc/tables/*: *
A       projects/sz_mc/volumes/*:
```
  The developer role has full permissions on packages, functions, resources, and tables in the workspace by default. This approach provides overly broad permissions.
- The following output shows the permissions granted to a RAM user after the user is assigned the developer role in DataWorks:
```
odps@ xxx> show grants for RAM$yxxx.pt@aliyun-test.com:ramtest;

[roles]
role_project_dev

Authorization Type: Policy
[role/role_project_dev]
A	projects/sz_mc: *
A	projects/sz_mc/instances/*: *
A	projects/sz_mc/jobs/*: *
A	projects/sz_mc/offlinemodels/*: *
A	projects/sz_mc/packages/*: *
A	projects/sz_mc/registration/functions/*: *
A	projects/sz_mc/resources/*: *
A	projects/sz_mc/tables/*: *
A	projects/sz_mc/volumes/*: *
```
Therefore, neither packaged authorization nor the default roles in DataWorks can meet the requirement for a specific user to access a specific UDF. For example, if you grant the developer role to the RAM user RAM$xxxxx.pt@aliyun-test.com:ramtest, the RAM user has all permissions on all objects in the current workspace by default. For more information, see User Authorization.
Creating a custom role in DataWorks to control permissions

On the MaxCompute Advanced Settings page of your DataWorks workspace configuration, you can manage permissions for custom user roles. However, on this page, you can grant permissions only on a specific table or project, not on individual resources or UDFs.

Note
For more information about MaxCompute properties in a DataWorks workspace, see Configure MaxCompute engine permissions.
Combining a role policy and a project policy to grant a specific user access to a specific UDF

Policies allow fine-grained control over user permissions on specific resources.

Note
For security, test policies in a test project before you apply them in a production environment.

Therefore, you can use policies to grant a specific user access to a specific UDF by following this pattern:

If you want to prevent other users from accessing specific resources in a workspace, you can first grant them the data developer permission in DataWorks, and then use a role policy in the MaxCompute client to explicitly deny their access.
If you need to grant a specific user access to a specific resource, first grant the user the data developer permission in DataWorks, and then use a project policy in the MaxCompute client to explicitly allow their access.

Steps

Create a role that denies access to the UDF by default.

On the MaxCompute client, run the following command to create a role named denyudfrole.
```
create role denyudfrole;
```

Create a policy file with the following content.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": ["odps:Read","odps:List"],
      "Resource": "acs:odps:*:projects/sz_mc/resources/getaddr.jar"
    },
    {
      "Effect": "Deny",
      "Action": ["odps:Read","odps:List"],
      "Resource": "acs:odps:*:projects/sz_mc/registration/functions/getregion"
    }
  ]
}

Set the role policy.
Run the following command to apply the policy from your policy file to the role.
```
put policy /Users/yangyi/Desktop/role_policy.json on role denyudfrole;
```

Run the following command to view the role policy.

get policy on role denyudfrole;

The following result is returned:

odps@        get policy on role denyudfrole;
{
    "Statement": [{
            "Action": ["odps:Read",
                    "odps:List"],
            "Effect": "Deny",
            "Resource": ["acs:odps:*:projects/sz_mc/resources/getaddr.jar"]},
        {
            "Action": ["odps:Read",
                    "odps:List"],
            "Effect": "Deny",
            "Resource": ["acs:odps:*:projects/sz_mc/registration/functions/getregion"]}],
    "Version": "1"}

Run the following command to add the RAM user to the denyudfrole role.
```
grant denyudfrole to RAM$xxxx.pt@aliyun-test.com:ramtest;
```

Verify that the UDF-denial role was created.

odps@ xxx>whoami;
Name: RAM$xxx pt@aliyun-test.com:ramtest
End_Point: http://service.odps.aliyun.com/api
Tunnel_End_Point: http://dt.cn-shanghai.maxcompute.aliyun.com
Project: xxx

Run show grants; to view the permissions of the current user.

odps@xxx    >show grants;

[roles]
role_project_dev, denyudfrole

Authorization Type: Policy
[role/denyudfrole]
D       projects/xxx/registration/functions/getregion: List | Read
D       projects/xxx/resources/getaddr.jar: List | Read
[role/role_project_dev]
A       projects/xxx: *
A       projects/xxx/instances/*: *
A       projects/xxx/jobs/*: *
A       projects/xxx/offlinemodels/*: *
A       projects/xxx/packages/*: *
A       projects/xxx/registration/functions/*: *
A       projects/xxx/resources/*: *
A       projects/xxx/tables/*: *
A       projects/xxx/volumes/*: *

The query result shows that the RAM user has two roles: role_project_dev (the default developer role in DataWorks) and denyudfrole (the custom role you created).

Verify the permissions of the custom UDF and its dependent packages.

odps@ xxx>desc function getregion;
FAILED: ODPS-0420095: Access Denied - Authorization Failed [4011], You have NO privilege 'odps:Read' on {acs:odps:*:projects/xxx/resources/xxx}. -->Tips: Pricipal:RAMS xxx.pl@aliyun-esl.com.ramlesl by policy
ID:38747231-386f-4018-b792-1da11700dc7e.
odps@ xxx>desc resource getaddr.jar;
FAILED: ODPS-0420095: Access Denied - Authorization Failed [4011], You have NO privilege 'odps:Read' on {acs:odps:*:pro
1-5788-49b1-82b8-1f4a95c2f9c5.  -->Tips: Pricipal:RAMS xxx.pt@aliyun-test.com [xxx]
[DEBUG]: com.aliyun.odps.OdpsException: ODPS-0420095: Access Denied - Authorization Failed [4011], You have NO privileg

The result shows that even though the RAM user has the developer role, the user does not have the read permission for the custom UDF getregion. You must configure a project policy to grant this user explicit access.

Configure the project policy.

Write the policy.

{
"Version": "1", "Statement":
[{
"Effect":"Allow",
"Principal":"RAM$yangyi.pt@aliyun-test.com:yangyitest",
"Action":["odps:Read","odps:List","odps:Select"],
"Resource":"acs:odps:*:projects/sz_mc/resources/getaddr.jar"
},
{
"Effect":"Allow",
 "Principal":"RAM$yangyi.pt@aliyun-test.com:yangyitest",
"Action":["odps:Read","odps:List","odps:Select"],
"Resource":"acs:odps:*:projects/sz_mc/registration/functions/getregion"
}] }

Apply the project policy.
Run the following command to apply the project policy from the specified file.
```
put policy /Users/yangyi/Desktop/project_policy.json;
```

Run the following command to view the project policy.

get policy;

The following result is returned:

odps@ xxx>get policy;
{
  "Statement": [{
    "Action": ["odps:Read",
      "odps:List",
      "odps:Select"],
    "Effect": "Allow",
    "Principal": ["RAM$xxxl.pt@aliyun-test.com:yangyitest"],
    "Resource": ["acs:odps:*:projects/sz_mc/resources/getaddr.jar"]},
    {
    "Action": ["odps:Read",
      "odps:List",
      "odps:Select"],
    "Effect": "Allow",
    "Principal": ["RAM$yangyi.pt@aliyun-test.com:yangyitest"],
    "Resource": ["acs:odps:*:projects/sz_mc/registrxxx"]
  "Version": "1"}

Verify by running whoami; and show grants;.

odps@ xxx    whoami;
Name: RAM$xxx.pt@aliyun-test.com:yangyitest
End_Point: http://service.odps.aliyun.com/api
Tunnel_End_Point: http://dt.cn-shanghai.maxcompute.aliyun.com
Project: sz_mc
odps@ xxx    show grants;

[roles]
role_project_dev

Authorization Type: Policy
[role/role_project_dev]
A       projects/sz_mc: *
A       projects/sz_mc/instances/*: *
A       projects/sz_mc/jobs/*: *
A       projects/sz_mc/offlinemodels/*: *
A       projects/sz_mc/packages/*: *
A       projects/sz_mc/registration/functions/*: *
A       projects/sz_mc/resources/*: *
A       projects/sz_mc/tables/*: *
A       projects/sz_mc/volumes/*: *
[user/RAM$yangyi.pt@aliyun-test.com:yangyitest]

Run a SQL task to verify that only the specified RAM user can access the UDF and its dependent package.

The specified RAM user can access the UDF:

odps@ xxx:select getregion('172.xxx.xxx.1');

ID = 2019011409xxx
Log view:
http://logview.odps.aliyun.com/logview/?h=http://service.odps.aliyun.com/api&p=sz_xxx
U00DA2MTU2Myx7IlN0YXR1xxx/hZCJdLCJFZmZlY3QiOiJBbGxvxxx
biI6IjEifQ==
Job Queueing.

         STAGES      STATUS      TOTAL  COMPLETED  RUNNING  PENDING  BACKU
M1_job_0 ..........  TERMINATED    1        1         0        0

STAGES: 01/01  [==============================>>] 100%  ELAPSED TIME: 24.34 s

Summary:
resource cost: cpu 0.27 Core * Min, memory 0.53 GB * Min
inputs:
outputs:
Job run time: 18.000
Job run mode: fuxi job
Job run engine: execution engine
M1:
        instance count: 1
        run time: 18.000
        instance time:
                min: 16.000

The user can access the dependent package:

odps# desc resource getaddr.jar;
Name                getaddr.jar
Owner               ALIYUNSxxx.pt@oliyun-test.com
Type                JAR
Comment             IDE RESOURCE UPDATE TO ODPS /home/admin/oxs-base-biz-phoenix/temp/4d3efccz0l9eiirin53o5n4/getaddr.jar
CreatedTime         2018-05-24 19:51:16
LastModifiedTime    2018-05-24 19:51:16
LastUpdator
Size                1353716
Md5sum              770497a9f605e09e198cb166cec7fa08