Data Lake Formation:Configure permissions

Prerequisites

Before you begin, make sure that you have:

• An Alibaba Cloud account or RAM administrator privileges to grant RAM policies

• The super_administrator or admin role in DLF to grant data permissions

The Alibaba Cloud account holder is a super_administrator in all regions by default. A RAM user who activates DLF in a region automatically inherits super_administrator privileges for all resources in that region.

Step 1: Grant API permissions

A RAM administrator or the Alibaba Cloud account holder must attach a RAM policy to the user before the user can call any DLF API.

To grant a policy to a user, perform the following steps:

1. Go to the RAM console.

2. In the left-side navigation pane, choose Identities > Users.

3. In the Actions column of the target RAM user, choose Attach Policy.

   DLF provides two predefined policies:

   Policy	Access level
   AliyunDLFFullAccess	Full API access
   AliyunDLFReadOnlyAccess	Read-only API access

For a complete list of DLF API operations and the RAM actions required for each, see Manage API permissions.

Step 2: Grant data permissions

After API permissions are in place, grant data permissions so the user can access specific DLF resources. Only a super_administrator or admin can perform this step.

Use one of the following methods to grant data permissions to a user:

• Assign a DLF role: Add a DLF role to the user. The user inherits all data permissions associated with that role. See Manage DLF users and roles for details.

• Grant resource-specific permissions: Grant the user permissions on a specific resource directly. See Manage data permissions for details.