Configure RAM Policies to Secure DataWorks Console Access - DataWorks - Alibaba Cloud - DataWorks

In DataWorks, you can control service-level Permissions and Permissions for Console Entities with Alibaba Cloud Resource Access Management (RAM) policies. To grant permissions, attach a policy to a RAM user or RAM role. This article describes the available permissions and shows how an Alibaba Cloud account can grant DataWorks management policies to users.

Service-level permissions: system and custom policies

By default, only an Alibaba Cloud account has service-level management permissions for DataWorks. To delegate these responsibilities, you can grant the following system policies to a RAM user. This grants the RAM user the same operational permissions as the Alibaba Cloud account.

Permission type	Scope	Policy name	Description	References
Allowed actions (system policies)	Manage DataWorks services	AliyunDataWorksFullAccess	Grants a RAM user permissions to manage internal DataWorks features. This policy does not grant permissions to purchase resources.	For instructions, see Grant permissions to a RAM user.
Allowed actions (system policies)	Purchase resources	AliyunBSSOrderAccess	Allows a RAM user to view, pay for, and cancel orders in Billing Management. After this policy is granted, the RAM user can purchase resources and renew services from the DataWorks console.	For instructions, see Grant permissions to a RAM user.
Denied actions (custom policies)	Deny operations in DataWorks (fine-grained)	Custom	Denies a user access to the management console, entry into DataWorks modules, or the ability to call OpenAPI.	First, define a policy by referring to Service-level permission policies. Then, attach the custom policy to a RAM user. For instructions, see Create a custom policy (optional).
	Deny OpenAPI calls (fine-grained)		By default, a user who has permissions on a DataWorks module can call the OpenAPI operations of that module. To deny a user the ability to call all OpenAPI operations, grant them this permission.
	Deny access to DataWorks module pages (fine-grained)		By default, all RAM users under an Alibaba Cloud account are tenant members of DataWorks, which allows them to access global modules and workspace modules of workspaces they have joined. You can deny a specific user access to all DataWorks module pages as needed.

Console entity permissions: custom policies

DataWorks supports fine-grained permission control on the following console entities:

Entity	Supported actions	References
Workspace	Create a workspace Modify a workspace Delete a workspace Disable a workspace Enable a workspace	To grant fine-grained console permissions, first define a custom policy by referring to Console entity permission policies. Then, attach the custom policy to a RAM user. For instructions, see Grant permissions to a RAM user.
Resource group	List exclusive resource groups View resource group details by name Create an exclusive resource group Modify an exclusive resource group
Alert information	List contacts Modify contact information List alert resources Set the maximum number of alerts

Grant permissions to a RAM user

In the left-side navigation pane, choose Identities > User.
In the Add Permissions panel, add permissions to the RAM user.
You can grant system policies and custom policies. To grant a custom policy, you must first create a custom policy before you can grant it to a RAM user here. For the available system and custom policies, see Service-level permissions: System and custom policies.
Note
For details about how to configure the parameters, see Grant permissions to a RAM user.

Create a custom policy (optional)

If you want to use fine-grained RAM policies for permission control, you must create a custom policy based on your needs. If you use built-in system policies for broad permissions, skip this step.

You can use the Alibaba Cloud account to create a custom policy in Access Control. For detailed instructions, see Create a custom policy.

To create a custom service-level permission policy, define the policy content by referring to Service-level permission policies.

To create a custom console entity permission policy, follow these instructions: In the left-side navigation pane of the RAM console, choose Permission Management > Policies, click Create Policy, and then select the Script Editor tab. The JSON format of the policy is {"Version":"1","Statement":[{"Effect":"Allow","Action":"dataworks:action_name","Resource":"acs:dataworks:$regionid:$accountid:resource_type/*"}]}. The values of Action and Resource correspond to the Action and Resource columns in the permission policy table.

Policy field	Description
Action	Set the Action in the custom policy based on the Action column for the corresponding item in Console entity permission policies.
Resource	Set the Resource in the custom policy based on the Resource column for the corresponding item in Console entity permission policies. Note Notes about Resource: The Resource column values in the permission policy table (in the format `acs:dataworks:$regionid:$accountid:resource_type/`) contain two types of content that you must replace with actual values: Placeholders starting with* `$`: Replace them with actual ID values. For example, replace `$regionid` with the actual region ID, and replace `$accountid` with the UID of the Alibaba Cloud account. Wildcard ``: Matches all resources at that level. You can replace it with a specific value to narrow the scope of the policy. For example, replace `workspace/` with `workspace/specific_workspace_ID` (for example, `workspace/12345`) to make the policy apply only to the specified workspace.