This topic describes how to configure custom approval policies for MaxCompute and Hologres, and how to view the permission approval policies for DLF 1.0.
Limitations
-
Only workspace administrators and RAM users with the
AliyunDataWorksFullAccesspolicy can create and manage approval policies. -
Compute engine approval policies are available only in DataWorks Enterprise Edition.
Create a policy
Log on to the DataWorks console. In the target region, click in the left-side navigation pane. Select a workspace from the drop-down list and click Go to Data Development.
-
In the left-side navigation pane, choose Requests & Approvals > Approval Policies. Use the Approval Type drop-down list at the top of the page to filter by MaxCompute or Hologres to open the compute engine approval policy management page.
On the compute engine approval policy management page, you can view existing policies and edit, delete, or reorder them.
-
Click Create Policy in the upper-right corner to configure the approval policy on the Create Approval Policy page.
NoteThe approval type filter on the list page shows up to 8 types. However, the Approval Type drop-down in the Create Policy wizard supports only 4 types: MaxCompute, Hologres, Data Service, and Extension. The other 4 types (DLF-Legacy, DLF, Lindorm, and Data Asset Governance) are system-built; their Create button is disabled and they cannot be manually created.
Enter basic information
Enter a Policy Name and Purpose based on the business scenario this policy covers.
Specify the data range
You must define the data range that this approval policy covers. After the policy is created, permission requests for data within this range are routed through the approval chain defined in this policy.
The scope configuration differs between MaxCompute and Hologres: MaxCompute supports scoping by project or by data category and sensitivity level; Hologres supports scoping by Hologres instance only. Refer to the corresponding subsection based on your approval type.
MaxCompute scope
When configuring the scope for MaxCompute compute engine, note the following:
-
Select the applicable project from the MaxCompute Project drop-down list. All subsequent permission requests for tables in the selected project will follow the approval chain defined in this policy.
-
Each MaxCompute project can be associated with only one MaxCompute approval policy. Associating a second policy causes a conflict error.
-
The drop-down list shows only MaxCompute projects where your current account holds the Admin or Super_Administrator role. If you cannot find the desired project, switch to an account with the appropriate role.
NoteA DataWorks workspace administrator is assigned the role_project_admin role, not the MaxCompute Admin or Super_Administrator role.
To check your role, run
whoamion the DataStudio page to get your account information, then runshow grants for <your_account>to confirm whether you have the Admin or Super_Administrator role.
Hologres scope
For the Hologres compute engine, scope is configured in one way only: by Hologres instance.
-
In the Hologres Instance configuration item, select the applicable instances from the drop-down list (multiple selection supported, up to 50). All subsequent permission requests for tables in the selected instances will follow the approval chain defined in this policy.
-
Each Hologres instance can belong to only one Hologres approval policy. Instances already occupied by another policy are grayed out and not selectable. Hover over a grayed-out instance to view the conflicting policy name.
-
If you cannot find the desired instance in the drop-down list, verify that: (1) the instance belongs to the tenant of the current DataWorks workspace; (2) your current account has visibility permission for that instance.
Hologres approval policies do not support scoping by Data Security Guard category and sensitivity level. This capability is currently available for MaxCompute only.
Configure notification methods
DataWorks supports text message, email, DingTalk chatbot, and webhook notification methods. After you configure the notification methods, approvers will be notified through the selected channels when a permission request is submitted.
This step only defines the notification methods. The actual approvers are assigned in the next step (Configure the approval chain).
-
To ensure approvers can receive text message and email notifications, you must add them as DataWorks alert contacts. For details, see View and configure alert contacts.
-
To ensure approvers can receive DingTalk notifications, go to the DingTalk chatbot management settings, set Security Settings to Custom Keywords, add the keyword DataWorks, and do not select any other security settings.
If you do not add the DataWorks keyword or select other security settings, approvers will not receive DingTalk notifications.
Configure the approval chain
In the Configure Processing Links section, define the approver and role for each approval node. Note the following:
-
Approval flow: After configuration, the approval flow progresses sequentially from top to bottom. The next approver is notified only after the current approver grants approval.
-
Approver types: Each node supports different approver types. MaxCompute approver types include: DataWorks Workspace Role, DataWorks Workspace Member, Table Owner, Alibaba Cloud Account, and MaxCompute Role. Hologres approver types include: Table Owner, Alibaba Cloud Account, and RAM User.
Note-
When an approval task is pending, DataWorks notifies all approvers using the notification methods configured in the previous step. To ensure approvers can receive text message and email notifications, you must add them as DataWorks alert contacts. For details, see View and configure alert contacts.
-
When multiple users share the same approver role on a node, all of them receive the notification. Approval from any one of them is sufficient to advance the request to the next node.
-
Set policy priorities
If both a MaxCompute project-based policy and a Data Security Guard-based policy exist, a single data range may be covered by both. In this case, you can set priorities on the compute engine approval policy management page.
On the list page, drag a row to adjust the matching order within the current approval type. The backend checks policies in ascending order and stops at the first match (lower number = higher priority). The Matching Order column displays the sequence number (1, 2, 3...) within the current type, not the internal priority value.
The Extension approval type does not display the Matching Order column and does not support drag-and-drop reordering on this page. Its priority must be configured on the Security Center > Security Policies > Risk Identification Rules page.
Configure auto-pass
For MaxCompute non-system policies, you can enable the Auto-Pass toggle in the upper-right corner of the Create/Edit page to configure data ranges that bypass the approval chain and are automatically approved.
The auto-pass configuration section is visible only when the approval type is MaxCompute and the policy is not a system policy. Other approval types (Hologres, Data Service, Extension) and MaxCompute system policies do not render this module.
The toggle in the upper-right corner of the auto-pass configuration card controls whether this section is active. Turning off the toggle clears all configured data ranges and sensitivity levels. You must reconfigure them if you turn it on again.
Auto-pass supports the following two modes (single selection; defaults to Specify data range):
-
Specify data range: Select one MaxCompute project (single selection), then select one or more data tables (multiple selection).
-
Specify data sensitivity level: Select one or more security levels (multiple selection).
Permission requests that match the auto-pass scope bypass the approval chain defined in this policy and are automatically approved. The final determination is based on the backend logic.