What is a system policy?
A policy defines a set of permissions that are described based on the policy structure and syntax. You can use policies to describe the authorized resource sets, authorized operation sets, and authorization conditions. Alibaba Cloud Resource Access Management (RAM) provides system policies and custom policies. All system policies are created and updated by Alibaba Cloud. You can use system policies, but you cannot modify them. You can manage and update custom policies based on your business requirements. You can create, update, and delete custom policies. During service iteration, DataWorks adds new permissions to system policies to support new features and capabilities. The update of a system policy affects all RAM identities to which the policy is attached, including RAM users, RAM user groups, and RAM roles. For more information about RAM policies, see Policy overview.
System policies are designed for new users to quickly get started with Alibaba Cloud products on the management console, though they also enable the use of more advanced methods like API operations or CLI commands. If you are familiar with the advanced methods, we recommend that you use custom policies to implement finer-grained control on who is permitted to call what API operations, thereby improving security.
System policies can be classified into service system policies, service role policies, and service-linked role policies. Some cloud services provide only one or two of the three types of policies. For more information, see the policy types that are described in the following section.
Service system policies
AliyunDataWorksAccessingAlikafkaPolicy
The AliyunDataWorksAccessingAlikafkaPolicy policy: Provides Alikafka access to DataWorks via Management Console. It can be attached to RAM identities.
AliyunDataWorksAccessingAlikafkaPolicy
AliyunDataWorksAccessingDLFReadOnlyPolicy
The AliyunDataWorksAccessingDLFReadOnlyPolicy policy: Dataworks access DLF authorization policy, including DLF read-only permission, suitable for cross account access to EMR-DLF when creating EMR-Hive data sources in data integration scenarios. It can be attached to RAM identities.
AliyunDataWorksAccessingDLFReadOnlyPolicy
AliyunDataWorksAccessingEMRReadOnlyPolicy
The AliyunDataWorksAccessingEMRReadOnlyPolicy policy: DataWorks access EMR authorization policy, including EMR read-only permission, suitable for cross account access EMR scenarios when creating EMR Hive data sources through data integration. It can be attached to RAM identities.
AliyunDataWorksAccessingEMRReadOnlyPolicy
AliyunDataWorksAccessingRdsOSSBinlogPolicy
The AliyunDataWorksAccessingRdsOSSBinlogPolicy policy: DataWorks read rds ossbinlog permission. It can be attached to RAM identities.
AliyunDataWorksAccessingRdsOSSBinlogPolicy
AliyunDataWorksAccessingRdsReadOnlyPolicy
The AliyunDataWorksAccessingRdsReadOnlyPolicy policy: Provides RDS read-only access to DataWorks via Management Console. It can be attached to RAM identities.
AliyunDataWorksAccessingRdsReadOnlyPolicy
AliyunDataWorksDIAccessDLF
The AliyunDataWorksDIAccessDLF policy: Permission policies required for data integration and synchronous read-write operations in DLF. It can be attached to RAM identities.
AliyunDataWorksExclusiveResourceGroupModify
The AliyunDataWorksExclusiveResourceGroupModify policy: The permissions of view and modify all the DataWorks exclusive resource groups. It can be attached to RAM identities.
AliyunDataWorksExclusiveResourceGroupModify
AliyunDataWorksFullAccess
The AliyunDataWorksFullAccess policy: Provides full access to DataWorks via Management Console. It can be attached to RAM identities.
AliyunDataWorksReadOnlyAccess
The AliyunDataWorksReadOnlyAccess policy: Read-only access to Ali Cloud DataWorks management console. It can be attached to RAM identities.
Service-linked role policies
AliyunServiceRolePolicyForDataWorks
DataWorks assumes the AliyunServiceRolePolicyForDataWorks service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForDataWorks policy is the dedicated authorization policy of the AliyunServiceRoleForDataWorks service-linked role. This policy is defined and used by DataWorks. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForDataWorks
AliyunServiceRolePolicyForDataWorksAccessDLF
DataWorks assumes the AliyunServiceRolePolicyForDataWorksAccessDLF service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForDataWorksAccessDLF policy is the dedicated authorization policy of the AliyunServiceRoleForDataWorksAccessDLF service-linked role. This policy is defined and used by DataWorks. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForDataWorksAccessDLF
AliyunServiceRolePolicyForDataWorksOpenPlatform
DataWorks assumes the AliyunServiceRolePolicyForDataWorksOpenPlatform service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForDataWorksOpenPlatform policy is the dedicated authorization policy of the AliyunServiceRoleForDataWorksOpenPlatform service-linked role. This policy is defined and used by DataWorks. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForDataWorksOpenPlatform
AliyunServiceRolePolicyForDataWorksScheduler
DataWorks assumes the AliyunServiceRolePolicyForDataWorksScheduler service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForDataWorksScheduler policy is the dedicated authorization policy of the AliyunServiceRoleForDataWorksScheduler service-linked role. This policy is defined and used by DataWorks. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForDataWorksScheduler
AliyunServiceRolePolicyForDatataworksAccessOpensearch
DataWorks assumes the AliyunServiceRolePolicyForDatataworksAccessOpensearch service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForDatataworksAccessOpensearch policy is the dedicated authorization policy of the AliyunServiceRoleForDatataworksAccessOpensearch service-linked role. This policy is defined and used by DataWorks. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForDatataworksAccessOpensearch
AliyunServiceRolePolicyForDataworksEngine
DataWorks assumes the AliyunServiceRolePolicyForDataworksEngine service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForDataworksEngine policy is the dedicated authorization policy of the AliyunServiceRoleForDataworksEngine service-linked role. This policy is defined and used by DataWorks. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
References
By default, RAM identities do not have any permissions. RAM identities can access cloud resources within an Alibaba Cloud account only after an account administrator grants the required permissions to the RAM identities. To ensure resource security, we recommend that you grant only the required permissions to the RAM identities based on the principle of least privilege. For more information, see the following topics: