Grant, view, and revoke permissions on data catalogs, databases, and tables in Data Lake Formation (DLF).
Limitations
Only users with the DLF super_administrator or DLF admin role, or users who have the Grant permission on a resource, can grant permissions to other users or roles. To obtain the admin permission, contact a DLF super_administrator.
Catalog
Grant permissions
Log on to the DLF console
On the Catalogs page, click the name of a data catalog to open its details page.
Click the Permissions tab, and then click Grant Permissions.
In the Grant Permissions panel, configure the following parameters and click OK.
Parameter
Description
Principal
Select whether to grant permissions to a user or a role.
User to Assign, Roles
User: Currently, only RAM users are supported.
Role: System-defined and custom roles are supported. For more information, see Manage DLF users and roles.
Predefined Permission Type
Select one of the following permission types:
Custom (default): Define custom permissions.
Data Reader: Predefined template that grants read-only permissions on resources in the data catalog.
Data Editor: Predefined template that grants read and write permissions on resources in the data catalog.
Permissions
Select the permissions to grant on the data catalog and all resources within it.
View permissions
On the Catalogs page, click the name of a data catalog to open its details page.
Click the Permissions tab to view the existing permissions.
Revoke permissions
On the Catalogs page, click the name of a data catalog to open its details page.
On the Permissions tab, select the checkbox for the permission that you want to revoke, and then click Revoke Permissions.
Database
Grant permissions
Log on to the DLF console
On the Catalogs page, click the name of a data catalog to open its details page.
In the Database list, click the name of a database to open the tables page.
Click the Permissions tab, and then click Grant Permissions.
In the Grant Permissions panel, configure the following parameters.
Parameter
Description
Principal
Select whether to grant permissions to a user or a role.
User to Assign, Roles
User: Currently, only RAM users are supported.
Role: System-defined and custom roles are supported. For more information, see Manage DLF users and roles.
Predefined Permission Type
Select one of the following permission types:
Custom (default): Define custom permissions.
Data Reader: Predefined template that grants read-only permissions on the database and its resources.
Data Editor: Predefined template that grants read and write permissions on the database and its resources.
Permissions
Select the permissions to grant on the database and all resources within it.
View permissions
On the Database tab, click the name of a database to open the tables page.
Click the Permissions tab to view the existing permissions.
Revoke permissions
On the Database tab, click the name of a database to open the tables page.
On the Permissions tab, select the checkbox for the permission that you want to revoke.
Click Revoke Permissions.
Table
Grant permissions
Log on to the DLF console
On the Catalogs page, click the name of a data catalog to open its details page.
In the Database list, click the name of a database to open the tables page.
In the Tables list, click the name of a table to open the columns page.
Click the Permissions tab, and then click Grant Permissions.
In the Grant Permissions panel, configure the following parameters and click OK.
Parameter
Description
Principal
Select whether to grant permissions to a user or a role.
User to Assign, Roles
User: Currently, only RAM users are supported.
Role: System-defined and custom roles are supported. For more information, see Manage DLF users and roles.
Predefined Permission Type
Select one of the following permission types:
Custom (default): Define custom permissions.
Data Reader: Predefined template that grants read-only permissions on the table.
Data Editor: Predefined template that grants read and write permissions on the table.
Table
Select the permissions to grant on the table:
ALL: Grants all permissions.
Alter: Lets you modify the table schema.
Drop: Lets you drop the table.
Select: Lets you query data in the table.
Update: Lets you update data in the table.
Grant: Lets you grant permissions to other users.
Column
Configure column-level permission scope:
All Columns (default): The permissions apply to all columns in the table.
Selected Columns: Available only when the Select permission is granted. Defines fine-grained column-level access control:
Include Columns: The permission applies only to the specified columns.
Exclude Columns: The permission applies to all columns except the specified ones.
NoteVersion requirements: To use column-level permissions, the compute engine must be Paimon version 1.2 (1-ali-12.0) or later, such as Realtime Compute for Apache Flink VVR 11.1 or later.
If you need to upgrade other engines, join the DingTalk group (106575000021) and contact the DLF R&D team.
Scope: Column-level permissions are supported only for internal Paimon tables.
Permission intersection rule: If both a user and a role they assume have the Select permission on columns, the user's effective permissions are the intersection of the columns granted to the user and the role.
Row permissions
All Rows (default): The permissions apply to all rows in the table.
Row-level permission: This option supports complex expressions. For more information, see Row filter specifications.
View permissions
In the Database list, click the name of a database to open the tables page.
In the Tables list, click the name of a table to open the columns page.
Click the Permissions tab to view the existing permissions.
Revoke permissions
In the Database list, click the name of a database to open the tables page.
In the Tables list, click the name of a table to open the columns page.
On the Permissions tab, select the checkbox for the permission that you want to revoke.
Click Revoke Permissions.