DataWorks:Control access to Hologres data

Prerequisites

• A Hologres instance is created. For more information, see Purchase a Hologres instance.

• A Hologres data source is added. For more information, see Hologres data source.

• Metadata has been collected for Hologres. For more information, see Metadata collection.

• The Permission Policy for the database containing the Hologres tables must be the Standard Postgresql Authorization Model. For more information, see Switch permission models.

Request permissions

To request permissions on the data access control page, you must configure the Application Content and Application information sections.

1. Log on to the DataWorks console. Switch to the target region and click Data Governance > Security Center in the left-side navigation pane. On the page that appears, click Go to Security Center.

2. In the left-side navigation pane of Security Center, go to the Data Platform Security > Data Access Control page.

3. On the Data Access Control page, click the permission request tab to request permissions on MaxCompute tables, resources, or functions.

   Request table permissions

   When you request table permissions, after adding the target tables, you can request Table-level permissions or Selected Columns permissions as needed.

   Configuration item		Description
   Application Content	Data Source Type	Select the MaxCompute type.
   	Application Type	Table
   	Workspace	Select the workspace where the target table resides.
   	MaxCompute Project	The MaxCompute project associated with the workspace where the table resides.
   	Schema	The schema where the table resides.
   Tables to Be Added	Request table-level permissions	You can request the Select, Update, Download, Describe, Alter, and Drop permissions at the table level.
   	Request column-level permissions	You can request the Select, Update, and Download permissions at the column level.

   Note

   • If labelsecurity is not enabled for the MaxCompute project, and you successfully request table-level Select and Update permissions, newly added columns in the table automatically inherit the Select and Update permissions.

   • If labelsecurity is enabled for the MaxCompute project, request column-level permissions instead of table-level permissions, because newly added columns do not automatically inherit table-level permissions.

   Request resource permissions

   Configuration item		Description
   Application Content	Data Source Type	Select the MaxCompute type.
   	Application Type	Resource
   	Workspace	Select the workspace where the target resource resides.
   	Project	The MaxCompute project associated with the workspace where the resource resides.
   	Resource Name	The resource for which you want to request permissions.

   Request function permissions

   Configuration item		Description
   Application Content	Data Source Type	Select the MaxCompute type.
   	Application Type	Function
   	Workspace	Select the workspace where the target function resides.
   	Project	The MaxCompute project associated with the workspace where the function resides.
   	Function Name	The name of the function for which you want to request permissions.

4. Configure Application information.

   Configuration item		Description
   Application information	User	Select the account for which you want to request permissions on the target resource. Current login account: Request permissions on the target table for the Alibaba Cloud account that is currently logged on to the DataWorks workspace. Account Used for Scheduling: Request permissions on the target table for the RAM user that is configured as the scheduling access identity. Apply on Behalf of Others: The Alibaba Cloud account that is currently logged on to the DataWorks workspace requests permissions on the target table for another Alibaba Cloud account. If you select this option, you must configure the Username parameter.
   	Application duration	You can customize the validity period of the permissions. The permissions are automatically revoked after they expire. Note Before you use this feature, make sure that Policy-based authorization is enabled for the MaxCompute project where the table resides. For more information, see Data access control details for MaxCompute. For more information about MaxCompute Policy, see MaxCompute Policy.
   	Reason for Application	Briefly describe the reason for the permission request so that the approver can understand your request.

5. Click Apply for Permissions to submit the request.

   You can view the approval details and approval records for the current request on the Permission Application Records tab.

Step 2: Configure an authorized identity

DataWorks uses a specified user, known as the authorized identity, to access a Hologres instance. To configure the authorized identity, you must use an Alibaba Cloud account or a RAM user that has the AdministratorAccess policy.

1. On the Data Access Control page, in the Application Content section, set Hologres as the data source type. If an authorized identity is not configured for the current instance, the following message appears. Click Determine.

   The message title is Configure authorized identity. The message reads: "The administrator has not configured an authorized identity for the current instance. This identity is used to issue authorization commands to the Hologres instance. Contact the Alibaba Cloud account owner or a RAM user with the AdministratorAccess policy to configure it on this page first."

2. Click Authorized Identity and then click Configure Authorization Identity.

3. In the Hologres instance authorization identity configuration window, specify an authorized identity for each Hologres instance. The window lists all Hologres instances associated with the current workspace. Each instance has a drop-down list for selecting an authorized identity. Select an Alibaba Cloud account or a RAM user to execute authorization commands for each instance, and then click OK to save the configuration.

   Note

   If the authorized identity is a RAM user, ensure that the RAM user has the AliyunHologresReadOnlyAccess policy and is assigned the SuperUser role on the Hologres instance.

Request permissions

1. Go to the Permission Application tab.

2. Select the tables for which you want to request permissions.

   1. Set Data Source Type to Hologres, and then specify the Hologres Instance and Database.

   2. In the Tables to Be Added section on the left, select the tables for which you want to request permissions.

   3. In the table, select the permissions you want to request. The following table-level permissions are supported: Select, Insert, Update, Delete, Truncate, and ALL.

      • If you select the select-all check box in the first row of the table, the corresponding permission is requested for all tables.

      • To cancel a permission for a specific table, clear the check box for the corresponding permission of that table.

3. Configure Application information.

   Parameters	Description
   User	Select the account for which you want to request permissions. Current login account: Request permissions on the target tables for the Alibaba Cloud account that is currently logged on to the DataWorks workspace. Apply on Behalf of Others: Request permissions on the target tables for another Alibaba Cloud account on behalf of the currently logged-on account. If you select this option, you must configure the Other identity parameter.
   Reason for Application	Enter the reason for requesting permissions on the target tables.

   Table-level permissions for Hologres are permanent and do not support setting an expiration time.

4. Click Apply for Permissions to submit the request.

   You can view the approval details and approval records for the current request on the Permission Application Records page.

Approve permission requests

1. View pending approval requests.

   In the left-side navigation pane, choose Application & Approval > My Approval Tasks, and click the Data Access Control tab. Set Data Source Type to Hologres, and use the filter conditions to view the pending approval requests under the currently logged-on Alibaba Cloud account.

   Note

   If a single permission request contains multiple tables, the request is automatically split into multiple requests based on the different table owners.

2. View approval details.

   Click Approval in the Operation column of the target request. In the Approval details dialog, you can view detailed information such as Application Details and Approval record.

3. Approve or reject the request.

   Based on the request details and your current requirements, determine whether to approve the request. Enter Approval Comments, and click Agree or Reject.

   You can also select all requests on the My Approval Tasks page, click Batch Agree or Batch Reject, enter Approval Comments, and process the requests in a batch.

View permission request and approval records

• View permission request records: In the left-side navigation pane, choose Application & Approval > My Applications, and click the Data Access Control tab. You can filter by conditions such as Approval status, Application Time, and Hologres Instance to view the request records under the currently logged-on Alibaba Cloud account.

  You can also click View details in the Operation column of a target request to view detailed information. For requests with an Approval status of Approving, you can perform the Withdrawal operation.

• View approval records: In the left-side navigation pane, choose Application & Approval > My Approval Tasks, and click the Data Access Control tab. Set the task status to All. You can filter by conditions such as Application account number, Approval Results, and Hologres Instance to view the approval records under the currently logged-on Alibaba Cloud account.