All Products
Search

This Product

    Data Security Center:Authorize a RAM user to access DSC

    Document Center

    Data Security Center:Authorize a RAM user to access DSC

    Last Updated:Jun 20, 2026

    Before a RAM user can access or manage the Data Security Center (DSC) console, you must grant the required permissions to the user.

    Prerequisites

    A RAM user must already exist. For more information, see Create a RAM user.

    Grant permissions

    1. Log on to the RAM console by using an Alibaba Cloud account (root account) or a RAM user with administrative permissions.

    2. In the left-side navigation pane, choose Identities > Users.

    3. On the Users page, find the target RAM user and click Add Permissions in the Actions column.

    4. In the Add Permissions panel, grant permissions to the RAM user.

      1. Select the authorization scope.

        • Account: The permission applies to the entire Alibaba Cloud account.

        • Resource Group: The permission applies only to the specified resource group.

          Note

          You can grant permissions for a specific resource group only if the cloud service supports them. For more information, see Services that work with Resource Group.

      2. Specify the principal.

        The principal is the RAM user that you want to authorize.

      3. Select a policy and click OK.

        Select a policy based on the permissions the RAM user needs.

        Policy

        Description

        AliyunYundunSDDPFullAccess

        Grants full administrative permissions for Data Security Center, allowing you to modify and delete configurations.

        AliyunYundunSDDPReadOnlyAccess

        Grants read-only access to Data Security Center.

        AliyunYundunSDDPDataManager

        Grants permission to manage data domains in Data Security Center.

        After you grant this permission and the user's information synchronizes to the DSC console, you can configure the data domains that the RAM user is allowed to manage. The RAM user can then manage data assets only within their permitted scope.

        If system policies do not meet your requirements, you can create a custom policy. For more information, see Create custom policies.

    Log on to the DSC console

    1. In the left-side navigation pane of the RAM console, click Overview.

    2. On the Overview page, find the RAM user logon URL in the Basic Information section.

    3. Click the logon URL and log on with the RAM user's username and password.

    4. Go to the Data Security Center console.

    Related topics