This topic describes how to grant permissions on catalogs, databases, and tables in Data Lake Formation (DLF).
Limitations
Only principals with the DLF super_administrator or DLF admin role, or with the Grant permission on a resource, can grant permissions to other principals. To be assigned the admin role, contact a DLF super_administrator.
Catalogs
Grant permissions
Log on to the Data Lake Formation console.
On the Catalogs page, click a catalog name to open its details page.
Click the Permissions tab, and then click Grant Permissions.
In the Grant Permissions panel, configure the following parameters and click OK.
Parameter
Description
Principal
Specifies whether to grant permissions to a user or a role.
Select User, Select Role
User: Select a RAM user or RAM role.
Role: Select a system role or custom role. For more information, see User and role management.
Predefined permission type
Select one of the following permission types:
Custom (default): Lets you select specific permissions.
Data Reader: A predefined template that grants read-only permission on all resources in the catalog.
Data Editor: A predefined template that grants read and write permissions on all resources in the catalog.
Permissions
Select the permissions to grant on the catalog or on all resources within the catalog.
View permissions
On the Catalogs page, click a catalog name to open its details page.
Click the Permissions tab to view the existing permissions.
Revoke permissions
On the Catalogs page, click a catalog name to open its details page.
On the Permissions tab, select the checkbox for each permission you want to revoke, and then click Revoke Permissions.
Databases
Grant permissions
Log on to the Data Lake Formation console.
On the Catalogs page, click the name of a catalog.
On the Databases tab, click a database name to go to the table list page.
Click the Permissions tab, and then click Grant Permissions.
In the Grant Permissions panel, configure the following parameters.
Parameter
Description
Principal
Specifies whether to grant permissions to a user or a role.
Select User, Select Role
User: Select a RAM user or RAM role.
Role: Select a system role or custom role. For more information, see User and role management.
Predefined permission type
Select one of the following permission types:
Custom (default): Lets you select specific permissions.
Data Reader: A predefined template that grants read-only permission on the database and its resources.
Data Editor: A predefined template that grants read and write permissions on the database and its resources.
Permissions
Select the permissions to grant on the database or on all resources within the database.
View permissions
On the Databases tab, click a database name to go to the table list page.
Click the Permissions tab to view the existing permissions.
Revoke permissions
On the Databases tab, click a database name to go to the table list page.
On the Permissions tab, select the checkbox for each permission you want to revoke.
Then, click Revoke Permissions.
Tables
Grant permissions
Log on to the Data Lake Formation console.
On the Catalogs page, click the name of a catalog.
On the Databases tab, click the name of a database to go to the table list page.
In the table list, click a table name to open its details page.
Click the Permissions tab, and then click Grant Permissions.
In the Grant Permissions panel, configure the following parameters and click OK.
Parameter
Description
Principal
Specifies whether to grant permissions to a user or a role.
Select User, Select Role
User: Select a RAM user or RAM role.
Role: Select a system role or custom role. For more information, see User and role management.
Predefined permission type
Select one of the following permission types:
Custom (default): Lets you select specific permissions.
Data Reader: A predefined template that grants read-only permission on the table.
Data Editor: A predefined template that grants read and write permissions on the table.
Table permissions
Select the permissions to grant on the table. Options include:
ALL: Grants all permissions on the table.
Alter: Lets the principal modify the table schema.
Drop: Lets the principal delete the table.
Select: Lets the principal query data from the table.
Update: Lets the principal update data in the table.
Grant: Lets the principal grant their permissions on the table to other principals.
Column permissions
Configure column-level permission with the following options:
All columns (default): The permissions apply to all columns in the table.
Column-level permission: This option is available only if the Select permission is granted. It lets you define fine-grained access control for specific columns:
Include columns: The Select permission applies only to the specified columns. Principals can access only these columns.
Exclude columns: The Select permission applies to all columns except the specified ones. Principals cannot access the excluded columns.
NoteVersion requirements: To use column-level permissions, the compute engine must use Paimon version 1.2 (1-ali-12.0) or later, such as Realtime Compute for Apache Flink VVR 11.1 or later.
If you need to use other compute engine versions, contact the DLF development team by joining the DingTalk group (ID: 106575000021).
Scope: Column-level permission management applies only to internal Paimon tables.
Permission intersection rule: If a RAM user and a role to which the user belongs are both granted the column-level Select permission, the user can access the intersection of columns from both permission sets.
Row permissions
All rows (default): The permissions apply to all rows in the table.
Row-level permission: Lets you define a filter expression to restrict access to specific rows. For details, see row filter specification.
View permissions
On the Databases tab, click the name of a database to go to the table list page.
In the table list, click a table name to open its details page.
Click the Permissions tab to view the existing permissions.
Revoke permissions
On the Databases tab, click the name of a database to go to the table list page.
In the table list, click a table name to open its details page.
On the Permissions tab, select the checkbox for each permission you want to revoke.
Then, click Revoke Permissions.