Log in to DataWorks using a RAM role - DataWorks - Alibaba Cloud Documentation Center

A RAM user can assume a RAM role to log in to DataWorks and perform development tasks. This topic walks you through role-based SSO login for DataWorks.

Background information

DataWorks supports the following login methods:

Log in by using an Alibaba Cloud account

Log in to the Alibaba Cloud Management Console with an Alibaba Cloud account or a RAM user and then access DataWorks. The logged-in account becomes a workspace member with the necessary permissions.
Log in by using a role

For stricter security and compliance, some organizations use role-based SSO to access DataWorks. A Resource Access Management (RAM) role is added as a member to a DataWorks workspace, and any user who assumes that role receives permissions equivalent to an Alibaba Cloud account member. For more information, see RAM role overview and Overview of SAML-based role SSO.

Precautions

Only the MaxCompute and Hologres data sources support operations using a RAM role in DataWorks.
To perform the following authorization operations with a RAM user or role, attach the AliyunRAMFullAccess policy to the RAM user or role. For more information, see Grant permissions to a RAM user.

Step 1: Create a RAM role

Log on to the RAM console.
In the left-side navigation pane, choose Identities > Roles.
Create a role.
On the Role page, click Create Role.
- To assume the role by switching your identity in the Alibaba Cloud Management Console, select Alibaba Cloud Account as the role type. For more information, see Create a RAM role for a trusted Alibaba Cloud account.
- To assume the role by logging in to Alibaba Cloud by using an account from your identity provider (IdP), select Identity Provider as the role type. For more information, see Create a RAM role for a trusted IdP.

Step 2: Configure the trust policy

On the Identity Management > Role page, click the role name. On the Trust Policy tab, configure the trust policy so that both your intended users (RAM users or IdP users) and the DataWorks service can assume the role. Select the policy that matches your scenario.

Note

In the following policies, replace UID with the UID of your Alibaba Cloud account and replace IDP with the name of your identity provider (IdP).

Scenario 1: RAM user assumes role

To allow a RAM user to assume a RAM role to access DataWorks, modify the trust policy of the RAM role as follows:

Note

This policy grants two principals — a specified RAM user and the DataWorks service — temporary credentials to assume the role. For more information about AssumeRole, see AssumeRole - Obtains temporary security credentials for a RAM role.

{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "RAM": [
                    "acs:ram::UID:root"
                ]
            }
        },
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "dataworks.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}

Scenario 2: IdP user assumes role

To allow a user from an IdP to assume a RAM role for DataWorks access, modify the trust policy of the RAM role as follows:

{
   "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "saml:recipient": "https://signin.alibabacloud.com/saml-role/sso"
                }
            },
            "Effect": "Allow",
            "Principal": {
                "Federated": [
                    "acs:ram::UID:saml-provider/IDP"
                ]
            }
        },
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "dataworks.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}

Step 3: Attach the AliyunSTSAssumeRoleAccess policy

If a RAM user (not an IdP user) assumes the RAM role, attach the AliyunSTSAssumeRoleAccess policy to that RAM user. This policy allows the user to call the Security Token Service (STS) AssumeRole operation and obtain the role's temporary credentials. For more information, see Grant permissions to a RAM user.

Note

If an IdP user assumes the RAM role, skip this step.

Step 4: Log in as the RAM role

A RAM user can assume a RAM role to log in to DataWorks. For more information about role-based SSO, see Overview of SAML-based role SSO.

Log in to the DataWorks console as a RAM user.
Switch your identity.

In the DataWorks console, hover over your profile picture in the upper-right corner and click Switch Identity to log in as the RAM role.

Next steps

After you create a workspace, you can:

Add the RAM role to a DataWorks workspace for data development

A workspace administrator can add the RAM role as a workspace member. For more information, see Add workspace members and manage their roles and permissions.
Use the RAM role as the production scheduling identity in MaxCompute

When you bind a MaxCompute compute engine, set this RAM role as the production scheduling identity. After configuration, do not use the role for other purposes. Ensure that all tasks run on an exclusive scheduling resource group.