Syntax reference for RAM policy actions and resources - DataWorks - Alibaba Cloud - DataWorks

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by DataWorks for RAM permission policies. The RAM code (RamCode) for DataWorks is dataworks , and the supported authorization granularity is OPERATION .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by DataWorks. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
dataworks:*	ApprovePermissionApplyOrder		All Resource ``	None	None
dataworks:*	UpdateIDEEventResult	get	All Resource ``	None	None
dataworks:AddRecognizeRule	AddRecognizeRule	create	All Resource ``	None	None
dataworks:DsgStopSensIdentify	DsgStopSensIdentify	none	All Resource ``	None	None
dataworks:*	GetNodeChildren	get	All Resource ``	None	None
dataworks:CreateProject	CreateProject	create	Project `acs:dataworks:{#regionId}:{#accountId}:workspace/`	None	None
dataworks:*	GetNodeParents	get	All Resource ``	None	None
dataworks:*	ListDIAlarmRules	list	All Resource ``	None	None
dataworks:GetProjectDetail	GetProjectDetail	get	Project `acs:dataworks:{#regionId}:{#accountId}:workspace/{#ProjectIdentifier}`	None	None
dataworks:ListProjectIds	ListProjectIds	get	All Resource ``	None	None
dataworks:*	GetMetaTableLineage	get	All Resource ``	None	None
dataworks:*	DeleteFile	delete	All Resource ``	None	None
dataworks:DsgUserGroupDelete	DsgUserGroupDelete	list	All Resource ``	None	None
dataworks:DsgDesensPlanDelete	DsgDesensPlanDelete	delete	All Resource ``	None	None
dataworks:*	RunSmokeTest	get	All Resource ``	None	None
dataworks:ListProjects	ListProjects	get	Project `acs:dataworks:{#regionId}:{#accountId}:workspace/`	None	None
dataworks:*	CreateResourceFile	create	All Resource ``	None	None
dataworks:*	GetFileTypeStatistic	get	All Resource ``	None	None
dataworks:QuerySensNodeInfo	QuerySensNodeInfo	list	All Resource ``	None	None
dataworks:*	OfflineNode	get	All Resource ``	None	None
dataworks:ListResourceGroups	ListResourceGroups	get	TenantResourceGroup `acs:dataworks:{#regionId}:{#accountId}:exclusive_resource_group/*`	None	None
dataworks:*	DeployFile	update	All Resource ``	None	None
dataworks:*	GetMigrationProcess	none	All Resource ``	None	None
dataworks:DsgUserGroupQueryList	DsgUserGroupQueryList	get	All Resource ``	None	None
dataworks:*	CreateImportMigration	update	All Resource ``	None	None
dataworks:*	ListBusiness	get	All Resource ``	None	None
dataworks:*	ListFolders	get	All Resource ``	None	None
dataworks:ChangeResourceManagerResourceGroup	ChangeResourceManagerResourceGroup		All Resource ``	None	None
dataworks:*	UpdateNodeRunMode	update	All Resource ``	None	None
dataworks:*	CreateFolder	create	All Resource ``	None	None
dataworks:*	GetMetaDBTableList	get	All Resource ``	None	None
dataworks:*	GetFile	get	All Resource ``	None	None
dataworks:*	ListFileVersions	get	All Resource ``	None	None
dataworks:DsgUpdateDesensStatusList	DsgUpdateDesensStatusList	list	All Resource ``	None	None
dataworks:*	ListMigrations	none	All Resource ``	None	None
dataworks:*	GetMetaTableBasicInfo	get	All Resource ``	None	None
dataworks:*	GetDIJob	get	All Resource ``	None	None
dataworks:*	CallbackExtension	none	All Resource ``	None	None
dataworks:DsgUserGroupGetOdpsRoleGroups	DsgUserGroupGetOdpsRoleGroups	get	All Resource ``	None	None
dataworks:*	RunCycleDagNodes	get	All Resource ``	None	None
dataworks:*	RunManualDagNodes	update	All Resource ``	None	None
dataworks:*	ListDIJobs	list	All Resource ``	None	None
dataworks:*	RestartInstance	get	All Resource ``	None	None
dataworks:*	GetFolder	get	All Resource ``	None	None
dataworks:QueryDefaultTemplates	DsgQueryDefaultTemplates	list	All Resource ``	None	None
dataworks:*	GetDeployment	get	All Resource ``	None	None
dataworks:*	CreateDISyncTask	get	All Resource ``	None	None
dataworks:*	GetMetaTableColumn	get	All Resource ``	None	None
dataworks:*	GetMetaCategory	get	All Resource ``	None	None
dataworks:*	ListNodes	list	All Resource ``	None	None
dataworks:ListMeasureData	ListMeasureData	list	All Resource ``	None	None
dataworks:*	UpdateDISyncTask	get	All Resource ``	None	None
dataworks:*	UpdateFile	update	All Resource ``	None	None
dataworks:*	UpdateMetaTable	update	All Resource ``	None	None
dataworks:*	GetPermissionApplyOrderDetail	get	All Resource ``	None	None
dataworks:DeleteRecognizeRule	DeleteRecognizeRule	delete	All Resource ``	None	None
dataworks:*	CreateBusiness	create	All Resource ``	None	None
dataworks:*	GetMetaTableIntroWiki	get	All Resource ``	None	None
dataworks:DsgSceneQuerySceneListByName	DsgSceneQuerySceneListByName	list	All Resource ``	None	None
dataworks:*	ListQualityRules	get	All Resource ``	None	None
dataworks:*	ListTableTheme	get	All Resource ``	None	None
dataworks:*	GetQualityRule	get	All Resource ``	None	None
dataworks:*	GetMetaColumnLineage	get	All Resource ``	None	None
dataworks:DsgQueryDesensStatusList	DsgQueryDesensStatusList	list	All Resource ``	None	None
dataworks:*	ListLineage	list	All Resource ``	None	None
dataworks:*	GetQualityEntity	get	All Resource ``	None	None
dataworks:*	GetMetaTableThemeLevel	get	All Resource ``	None	None
dataworks:*	SearchMetaTables	get	All Resource ``	None	None
dataworks:DsgUserGroupQueryUserList	DsgUserGroupQueryUserList	list	All Resource ``	None	None
dataworks:DsgPlatformQueryProjectsAndSchemaFromMeta	DsgPlatformQueryProjectsAndSchemaFromMeta	list	All Resource ``	None	None
dataworks:DsgUserGroupAddOrUpdate	DsgUserGroupAddOrUpdate	list	All Resource ``	None	None
dataworks:DsgQuerySensResult	DsgQuerySensResult	list	All Resource ``	None	None
dataworks:*	GetInstanceStatusStatistic	get	All Resource ``	None	None
dataworks:*	ListNodesByOutput	get	All Resource ``	None	None
dataworks:*	ListDIProjectConfig	get	All Resource ``	None	None
dataworks:*	ListNodeInputOrOutput	get	All Resource ``	None	None
dataworks:QuerySensClassification	QuerySensClassification	get	All Resource ``	None	None
dataworks:*	GetDag	get	All Resource ``	None	None
dataworks:*	GetMetaTableOutput	get	All Resource ``	None	None
dataworks:*	ListMetaCollections	list	All Resource ``	None	None
dataworks:*	GetMigrationSummary	none	All Resource ``	None	None
dataworks:*	GetMetaTableListByCategory	get	All Resource ``	None	None
dataworks:*	CreateFile	create	All Resource ``	None	None
dataworks:*	ListDataSources	list	All Resource ``	None	None
dataworks:AddProjectMemberToRole	AddProjectMemberToRole	create	All Resource ``	None	None
dataworks:DsgDesensPlanAddOrUpdate	DsgDesensPlanAddOrUpdate	list	All Resource ``	None	None
dataworks:DsgWhiteListAddOrUpdate	DsgWhiteListAddOrUpdate	list	All Resource ``	None	None
dataworks:*	SubmitFile	update	All Resource ``	None	None
dataworks:*	ListCalcEngines	get	All Resource ``	None	None
dataworks:QueryRecognizeRuleDetail	QueryRecognizeRuleDetail	get	All Resource ``	None	None
dataworks:*	GetIDEEventDetail	get	All Resource ``	None	None
dataworks:QueryDefaultTemplate	QueryDefaultTemplate	get	All Resource ``	None	None
dataworks:*	ListInstances	list	All Resource ``	None	None
dataworks:ListProjectRoles	ListProjectRoles	get	All Resource ``	None	None
dataworks:DeleteProjectMember	DeleteProjectMember	delete	All Resource ``	None	None
dataworks:*	GetDISyncTask	get	All Resource ``	None	None
dataworks:DsgDesensPlanUpdateStatus	DsgDesensPlanUpdateStatus	update	All Resource ``	None	None
dataworks:*	ListManualDagInstances	list	All Resource ``	None	None
dataworks:CreateProjectMember	CreateProjectMember	create	All Resource ``	None	None
dataworks:*	GetMetaCollectionDetail	get	All Resource ``	None	None
dataworks:*	GetMetaDBInfo	get	All Resource ``	None	None
dataworks:*	StartDISyncInstance	get	All Resource ``	None	None
dataworks:GetProject	GetProject	get	Project `acs:dataworks:{#regionId}:{#accountId}:workspace/{#ProjectIdentifier}`	None	None
dataworks:DsgSceneAddOrUpdateScene	DsgSceneAddOrUpdateScene	list	All Resource ``	None	None
dataworks:QuerySensLevel	QuerySensLevel	get	All Resource ``	None	None
dataworks:*	GetNodeCode	get	All Resource ``	None	None
dataworks:DsgScenedDeleteScene	DsgScenedDeleteScene	list	All Resource ``	None	None
dataworks:*	GetDataSourceMeta	get	All Resource ``	None	None
dataworks:*	ListMetaDB	get	All Resource ``	None	None
dataworks:*	ListFiles	get	All Resource ``	None	None
dataworks:*	CreateExportMigration	none	All Resource ``	None	None
dataworks:*	StartDIJob	update	All Resource ``	None	None
dataworks:DsgWhiteListQueryList	DsgWhiteListQueryList	list	All Resource ``	None	None
dataworks:*	ListMetaCollectionEntities	list	All Resource ``	None	None
dataworks:*	TestNetworkConnection	get	All Resource ``	None	None
dataworks:*	GetDISyncInstanceInfo	get	All Resource ``	None	None
dataworks:DsgWhiteListDeleteList	DsgWhiteListDeleteList	list	All Resource ``	None	None
dataworks:*	CheckMetaTable	get	All Resource ``	None	None
dataworks:*	GetMetaTableChangeLog	get	All Resource ``	None	None
dataworks:EditRecognizeRule	EditRecognizeRule	update	All Resource ``	None	None
dataworks:QueryRecognizeRulesType	QueryRecognizeRulesType	get	All Resource ``	None	None
dataworks:*	CreatePermissionApplyOrder	create	All Resource ``	None	None
dataworks:RunIdentifyOpenapi	DsgRunSensIdentify	none	All Resource ``	None	None
dataworks:*	GetInstanceLog	get	All Resource ``	None	None
dataworks:*	StartMigration	update	All Resource ``	None	None
dataworks:*	GetQualityFollower	get	All Resource ``	None	None
dataworks:RemoveProjectMemberFromRole	RemoveProjectMemberFromRole		All Resource ``	None	None
dataworks:*	GetMetaTablePartition	get	All Resource ``	None	None
dataworks:*	GetInstance	get	All Resource ``	None	None
dataworks:DsgDesensPlanQueryList	DsgDesensPlanQueryList	list	All Resource ``	None	None
dataworks:*	GetNode	get	All Resource ``	None	None
dataworks:QueryRecognizeDataByRuleType	QueryRecognizeDataByRuleType	get	All Resource ``	None	None
dataworks:ListProjectMembers	ListProjectMembers	get	All Resource ``	None	None

Resource

The following table lists the resources defined by DataWorks. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
Instance	acs:dataworks:::* acs:dataworks:{#regionId}:: acs:dataworks:{#regionId}:{#accountId}:instance/*
Node	acs:dataworks:{#regionId}:{#accountId}:node/* acs:dataworks:::* acs:dataworks:{#regionId}::
BaselineConfig	acs:dataworks:{#regionId}:{#accountId}:baselineconfig/* acs:dataworks:::*
Project	acs:dataworks:{#regionId}:{#accountId}:workspace/* acs:dataworks:{#regionId}:{#accountId}:workspace/{#ProjectIdentifier} acs:dataworks:{#regionId}:{#accountId}:project/* acs:dataworks:::*
Table	acs:dataworks:::* acs:dataworks:{#regionId}:{#accountId}:table/*
Topic	acs:dataworks:{#regionId}:{#accountId}:topic/* acs:dataworks:{#regionId}::
TableLineage	acs:dataworks:{#regionId}:{#accountId}:tablelineage/*
Remind	acs:dataworks:{#regionId}:{#accountId}:remind/* acs:dataworks:{#regionId}:{#accountId}:remind/{#RemindId}
DataServiceApiAuthority	acs:dataworks:{#regionId}:{#accountId}:dataserviceapiauthority/*
File	acs:dataworks:{#regionId}:{#accountId}:file/* acs:dataworks:{#regionId}:: acs:dataworks:::*
DataServiceApi	acs:dataworks:{#regionId}:{#accountId}:dataserviceapi/* acs:dataworks:{#regionId}:: acs:dataworks:::*
QualityRule	acs:dataworks:{#regionId}:{#accountId}:qualityrule/*
CheckerInstance	acs:dataworks:*:{#accountId}:checkerinstance/{#CheckerInstanceId}
ResourceFile	:dataworks:{#regionId}::resourcefile/*
TenantResourceGroup	acs:dataworks:{#regionId}:{#accountId}:exclusive_resource_group/* acs:dataworks:{#regionId}:{#accountId}:exclusive_resource_group/{#Identifier}
Connection	acs:dataworks:{#regionId}:{#accountId}:connection/* acs:dataworks:::*
Business	acs:dataworks:{#regionId}:{#accountId}:business/*
Folder	acs:dataworks:{#regionId}:{#accountId}:folder/*
AlertMessage	acs:dataworks:{#regionId}:{#accountId}:* acs:dataworks:{#regionId}:{#accountId}:alertmessage/*
FileVersion	acs:dataworks:{#regionId}:{#accountId}:fileversion/*
DataServiceApplication	acs:dataworks:{#regionId}:{#accountId}:dataserviceapplication/*
DataServiceGroup	acs:dataworks:{#regionId}:{#accountId}:dataservicegroup/* acs:dataworks:{#regionId}::
DataServiceFolder	acs:dataworks:::* acs:dataworks:{#regionId}:: acs:dataworks:{#regionId}:{#accountId}:dataservicefolder/*
Deployment	acs:dataworks:{#regionId}:{#accountId}:deployment/*
UdfFile	acs:dataworks:{#regionId}:{#accountId}:udffile/*
Column	acs:dataworks:{#regionId}:{#accountId}:column/* acs:dataworks:::*
MetaCategory	acs:dataworks:{#regionId}:{#accountId}:metacategory/* acs:dataworks:::*
TableLevel	acs:dataworks:::* acs:dataworks:{#regionId}:{#accountId}:tablelevel/*
TableTheme	acs:dataworks:{#regionId}:{#accountId}:tabletheme/* acs:dataworks:{#regionId}:{#accountId}:tabletheme/{#TableThemeId}
ColumnLineage	acs:dataworks:{#regionId}:{#accountId}:columnlineage/*
QualityRelativeNode	acs:dataworks:{#regionId}:{#accountId}:qualityrelativenode/* acs:dataworks:::*
QualityFollower	acs:dataworks:{#regionId}:{#accountId}:qualityfollower/*
QualityEntity	acs:dataworks:{#regionId}:{#accountId}:qualityentity/*
BaselineStatus	acs:dataworks:{#regionId}:{#accountId}:baselinestatus/*
DataServicePublishedApi	acs:dataworks:{#regionId}:{#accountId}:dataservicepublishedapi/*
NodeIO	acs:dataworks:{#regionId}:{#accountId}:nodeio/*
NodeOnBaseline	acs:dataworks:{#regionId}:{#accountId}:nodeonbaseline/*
ModelCategory	acs:dataworks:{#regionId}:{#accountId}:modelcategory/*
ProjectMember	acs:dataworks::{#accountId}:projectmember/{#ProjectMemberId} acs:dataworks:{#regionId}:{#accountId}:workspace/
QualityCheckResult	acs:dataworks:{#regionId}:{#accountId}:qualitycheckresult/*
CalcEngine	acs:dataworks:{#regionId}:{#accountId}:calcengine/*
ProjectRole	acs:dataworks:{#regionId}:{#accountId}:workspace/*
DataServiceAuthorizedApi	acs:dataworks:{#regionId}:{#accountId}:dataserviceauthorizedapi/*

Condition

DataWorks does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: