DLF uses a two-layer permission model. To give a RAM user or role access to DLF, you must configure both layers:
RAM layer — Grant a RAM API access policy to the Resource Access Management (RAM) user or RAM role.
DLF layer — Grant metadata permissions to the corresponding DLF user or DLF role. This controls which data lake resources the user can access.
Manage DLF users
Sync users
Run a manual sync to make all RAM users and RAM roles under your Alibaba Cloud account available in DLF.
Log on to the DLF console.
In the left menu, click System & Security.
On the Access Control tab, click the Users subtab, then click Sync Users.
Deleting a RAM user or RAM role also deletes it from DLF.
Manage DLF roles
A DLF role is a collection of permissions. Assign a role to multiple users to grant them the same permissions at once, without configuring each user individually.
System roles
DLF includes two built-in system roles that cannot be deleted:
| Role | Description | Permissions |
|---|---|---|
admin | Data lake administrator | Full data access permissions; can grant permissions in DLF; can create custom roles and catalogs. |
super_administrator | Super administrator | All permissions of admin; can also modify users assigned to the admin role. Automatically assigned to the RAM user who activates DLF for the current region. |
Custom roles
For granular data access control, create custom roles and grant permissions to them. Users added to a custom role inherit its permissions automatically, which eliminates repetitive per-user authorization.
Create a role
Log on to the DLF console.
In the left menu, click System & Security.
On the Access Control tab, click the Roles tab.
Click Create Role.
In the Create Role panel, enter a role name and click OK. (Optional) Click Add to select existing users and assign this role to them immediately.
Assign a role to users
Assigning a DLF role to a user grants that user all permissions associated with the role.
On the Roles page, find the target role and click Modify in the Actions column.
In the Modify Role panel, click Add and select the users to assign.
Click OK.
Delete a role
The system rolesadminandsuper_administratorcannot be deleted.
On the Roles page, find the target role and click Delete in the Actions column.
In the dialog, click OK.