Permission management for data in compute engine instances - DataWorks

Before members in a workspace can use various compute engine instances in the workspace, the members must be granted the permissions that are required to access the data in the compute engine instances. The methods that are used to obtain the permissions vary based on the compute engine type. This topic describes how to manage permissions on data in compute engine instances in DataWorks.

Prerequisites

You are familiar with the physical attributes of workspaces. For more information, see Differences between workspaces in basic mode and workspaces in standard mode.
You are familiar with the environment types of compute engine instances that are used in different DataWorks services. For more information, see the Appendix: Compute engines that correspond to different DataWorks service modules in workspaces in basic and standard modes section in Differences between workspaces in basic mode and workspaces in standard mode.

Permissions required to access data in different types of compute engine instances

The following table describes the permissions that are required to access data in different types of compute engine instances and the methods that can be used to grant the permissions to the members in a workspace.


Compute engine type	Permission description	References
MaxCompute	Built-in role The built-in workspace-level roles of DataWorks are mapped to the roles of a MaxCompute compute engine instance. If you assign a built-in workspace-level role to a RAM user, the RAM user is automatically granted the permissions of the mapped role of the MaxCompute compute engine instance in the development environment. MaxCompute compute engine instance in the development environment: By default, built-in workspace-level roles have specific permissions on a MaxCompute compute engine instance in the development environment. Users that are assigned built-in workspace-level roles can access MaxCompute tables in the development environment. MaxCompute compute engine instance in the production environment: Built-in workspace-level roles do not have permissions on a MaxCompute compute engine instance in the production environment. To access MaxCompute tables in the production environment, you must request the permissions in Security Center. For more information about Security Center, see Overview. Custom workspace-level role If you create a custom workspace-level role and map the role to a role of a MaxCompute compute engine instance, the custom workspace-level role has the permissions of the mapped role of the MaxCompute compute engine instance.	Mappings between the built-in workspace-level roles of DataWorks and the roles of MaxCompute Request permissions on a MaxCompute compute engine instance Role planning
E-MapReduce (EMR)	You can configure mappings between the members in a workspace and the accounts of the EMR compute engine instance that is associated with the workspace. This way, the members in the workspace are granted the permissions of the accounts of the EMR compute engine instance.	Associate an EMR compute engine with a workspace Permission management for running EMR nodes in DataWorks
Cloudera's Distribution including Apache Hadoop (CDH)	When you associate a CDH compute engine with a workspace as a compute engine instance, you can configure mappings between the members in the workspace and Linux or Kerberos accounts of the CDH compute engine instance. This way, the members in the workspace are granted the permissions on the CDH compute engine instance.	Associate a CDH compute engine with a workspace
Hologres	You can grant the permissions on a Hologres compute engine instance to the members in a workspace by using policies supported by Hologres. If you want to grant the permissions on a Hologres compute engine instance associated with a workspace to the members in the workspace, you must perform the authorization based on the authorization-related topic in Hologres.	Permission management overview
Other types of compute engines	The permissions on the compute engine instances are determined by the scheduling access identities that are specified for different environments when you associate the compute engines with a workspace. Note When you associate a compute engine other than the preceding types of compute engines with a workspace, you must specify scheduling access identities of the compute engine in the development environment and production environment. For example, you must specify the username and password for database access in each environment when you associate an AnalyticDB for PostgreSQL compute engine with a workspace. Users that are assigned built-in or custom workspace-level roles use the specified scheduling access identity to run nodes on a compute engine instance. Permissions on a compute engine instance other than a MaxCompute compute engine instance are not directly granted to workspace-level roles. The permissions are determined based on the scheduling access identity that you specify when you associate the compute engine with your workspace.	-