This topic describes how to grant permissions on catalogs, databases, and tables in Data Lake Formation (DLF).
Limitations
Only DLF users with super_administrator, admin roles, or explicit Grant permission on a resource can assign data permissions to DLF users or roles. To obtain admin permission, contact a super_administrator.
Catalog
Grant permissions
Log on to the DLF console.
In the left navigation menu, select Catalogs, and click your catalog name.
Select the Permissions tab, and click Grant Permissions.
In the Grant Permissions panel, configure the following parameters and click OK.
Parameter
Description
Principal
Select DLF User or DLF Role.
Select DLF User or Select DLF Role
Select DLF User: Select a RAM identity from the dropdown list.
Select DLF Role: Select a system or custom role from the dropdown list. For more information, see Manage DLF users and roles.
Predefined Permission Type
Select one of the following permission types:
Custom (default): Defines custom permissions.
Data Reader: Predefines read-only access to catalog resources.
Data Editor: Predefines read/write access to catalog resources.
Permissions
Select the permissions to grant.
Query permissions
In the left navigation menu, select Catalogs, and click your catalog name.
Select the Permissions tab to view principal permissions.
Revoke permissions
In the left navigation menu, select Catalogs, and click your catalog name.
On the Permissions tab, select the permissions to revoke, and click Revoke Permissions.
Databases
Grant permissions
Log on to the DLF console.
In the left navigation menu, select Catalogs, and click your catalog name.
In the Database section, click your database name.
Select the Permissions tab, and click Grant Permissions.
In the Grant Permissions panel, enter the following information:
Parameter
Description
Principal
Select DLF User or DLF Role.
Select DLF User or Select DLF Role
Select DLF User: Select a RAM identity from the dropdown list.
Select DLF Role: Select a system or custom role from the dropdown list. For more information, see Manage DLF users and roles.
Predefined Permission Type
Select one of the following permission types:
Custom (default): Defines custom permissions.
Data Reader: Predefines read-only access to database resources.
Data Editor: Predefines read/write access to database resources.
Permissions
Select the permissions to grant.
Query permissions
In the Database section, click your database name.
Select the Permissions tab to view principal permissions.
Revoke permissions
In the Database section, click your database name.
On the Permissions tab, select the permissions to revoke, and click Revoke Permissions.
Tables
Grant permissions
Log on to the DLF console.
In the left navigation menu, select Catalogs, and click your catalog name.
In the Database section, click your database name.
On the Tables subtab, click a table name to open the table details page.
Select the Permissions tab, and click Grant Permissions.
In the Grant Permissions panel, enter the following information and click OK.
Parameter
Description
Principal
Select whether to grant permissions to a user or a role.
Select DLF User or Select DLF Role
Select DLF User: Select a RAM identity from the dropdown list.
Select DLF Role: Select a system or custom role from the dropdown list. For more information, see Manage DLF users and roles.
Predefined Permission Type
Select one of the following permission types:
Custom (default): Defines custom permissions.
Data Reader: Predefines read-only access to table resources.
Data Editor: Predefines read/write access to table resources.
Table
Select the table permissions to grant. Valid options:
ALL: Grant all permissions.
Alter: Modify the table schema.
Drop: Delete the table.
Select: Query data in the table.
Update: Update data in the table.
Grant: Grant permissions to other users.
Column
Valid options:
All Columns (default): Permission configurations apply to all columns in the table.
Selected Columns: Permissions apply to specific columns. This option is only available if
Selectis the only table permission granted. Available options:Include Selected Columns: Permissions are applied to these specific columns. Users can only access columns for which they have explicit permissions.
Exclude Selected Columns: Permissions are not applied to these specific columns. Users can access all other columns, but not the excluded ones.
NoteVersion requirements: For column-level permissions to enforce, your compute engine must have integrated Paimon 1.2 (1-ali-12.0) or later, such as Realtime Compute for Apache Flink Ververica Runtime (VVR) 11.1+.
For assistance with other versions, join our DingTalk group (ID: 106575000021).
Scope: Column-level permission management is restricted to internal Paimon tables.
Permission intersection rule: If a user and their associated role both have column-level
Selectpermission, DLF grants access to the intersection of their granted column sets.
Query permissions
In the Database section, click your database name.
On the Tables subtab, click a table name to open the table details page.
Select the Permissions tab to view principal permissions.
Revoke permissions
In the Database section, click your database name.
On the Tables subtab, click a table name to open the table details page.
On the Permissions tab, select the permissions to revoke, and click Revoke Permissions.