Data domains let you group assets by department, business unit, or data characteristics—making it easier to manage sensitive data at scale. After creating a data domain, you can add assets to it and view sensitive data identification results scoped to that domain. You can also restrict a Resource Access Management (RAM) user to managing only the assets within specific domains.
Use cases
Departmental asset separation: When many assets belong to different departments, assign each department its own data domain so each team manages only its own assets.
Delegated administration: Assign specific data domains to designated data administrators, limiting each administrator's management scope to only the assets they're responsible for.
Prerequisites
Before you begin, ensure that you have:
DSC authorized to access your assets. See Asset authorization.
(If using a RAM user) The AliyunYundunSDDPFullAccess policy attached to that RAM user. See Authorize a RAM user to access DSC.
Background
DSC includes a default data domain that contains all authorized assets. By default, an Alibaba Cloud account or a RAM user with the AliyunYundunSDDPFullAccess policy can manage all domains and assets.
To organize assets and delegate management, create custom data domains:
Group assets into custom domains and view sensitive data identification results by domain. See View sensitive data identification results.
Grant a RAM user the AliyunYundunSDDPDataManager policy to limit that user to managing only the domains you specify.
Limitations
Each asset belongs to exactly one data domain at a time.
Assets not assigned to a custom domain remain in the default data domain.
Domain hierarchies support up to three levels.
Workflow overview
| Step | Task | Required |
|---|---|---|
| 1 | Create custom data domains | Yes |
| 2 | Add assets to the domain — single domain or batch | Yes |
| 3 | Authorize a RAM user to manage specific domains | Optional |
For steps 1 and 2, choose based on the number of domains and assets you need to configure:
A small number of domains: Use the console to create domains and add assets individually.
Many domains or assets: Download the template file, edit it offline, and upload it in bulk.
Create a custom data domain
Plan the names and hierarchy of your domains before you begin. You can organize them into up to three levels based on business units or org structures.
Step 1: Create a data domain
Log on to the DSC console.
In the left-side navigation pane, choose System Settings > Data Management.
Next to Custom Data Domain, click Add.
In the Add Data Domain dialog box, enter a name and description, then click OK.
To build a hierarchy, create additional domains using either of these methods:
Repeat the steps above to create more domains, then drag them to reorder and set parent-child relationships.
Hover over the asset count next to an existing domain, click the
icon, then select Add Child Node (creates a subdomain under the current domain) or Add Sibling Node (creates a domain at the same level).
Step 2: Add assets to the data domain
You can only add assets that are currently in the default data domain.
Add assets from the default data domain
In the left-side domain list, click the domain you want to add assets to.
Click Add Asset.
In the Add data assets panel, select the assets and click OK.
Move assets from another custom domain
In the left-side domain list, click the domain containing the assets you want to move.
In the asset list, find the asset and click Move in the Actions column. To move multiple assets at once, select them and click Batch Move below the list.
In the dialog box, select the destination domain from the drop-down list and click OK.
The asset count shown next to a domain includes assets in all its child domains.
Modify or delete a data domain
In the left-side navigation pane, choose System Settings > Data Management.
On the Data Domain Configuration page, hover over the asset count next to the domain, click the
icon, then:Click Modify Data Domain to update the domain's name or description.
Click Delete to delete the domain. To delete a domain that has child domains, delete the child domains first. After deletion, all assets in the domain are automatically moved back to the default data domain.
Batch manage data domains and assets
Use this approach when you need to configure many domains or assets at once. Download the DSC Data Domain Template.xlsx template, edit it offline, and upload it.
How the template file is parsed
DSC parses the file from top to bottom. Entries lower in the file override entries higher up.
| Scenario | Result |
|---|---|
| An asset appears in multiple rows assigned to different domains | The asset is added to the domain in the last row where it appears |
| An asset does not appear in the file | The asset stays in its current domain |
| Different assets are listed in the same domain | All are added to that domain |
Examples:
If row 1 assigns asset A to a custom domain and row 5 reassigns asset A to the default domain, asset A ends up in the default domain.
If you remove a custom domain from the file but do not reassign its assets elsewhere, the domain and its assets are unchanged—nothing is deleted.
Upload the template file
Log on to the DSC console.
In the left-side navigation pane, choose System Settings > Data Management.
In the upper-right corner, click Batch Manage.
In the Batch Manage dialog box, click DSC Data Domain Template.xlsx to download the template. The template contains these columns: First Data Domain, Second Data Domain, Third Data Domain, Instance Name, Instance Type, and Instance Region. If custom domains already exist, they appear at the top of the file; the default data domain is at the bottom. Domains with no assets are not included.
Edit the template based on the parsing rules above:
Create a domain: Find the asset row and change First Data Domain to a custom name. Optionally fill in Second Data Domain and Third Data Domain for a hierarchy.
Delete a first-level domain: Change the First Data Domain value to Default Data Domain. If the domain has child domains, also clear the Second Data Domain and Third Data Domain columns.
Click Import Local Files, select the modified file, and click OK.
After the import completes, the asset count next to each domain reflects the total number of assets in that domain and all its child domains.
Authorize a RAM user to manage specific data domains
By default, RAM users with AliyunYundunSDDPFullAccess can manage all domains. To restrict a RAM user to specific domains, use the AliyunYundunSDDPDataManager policy.
The following table summarizes the three DSC policies related to data domains:
| Policy | Permissions |
|---|---|
| AliyunYundunSDDPFullAccess | Full access to DSC, including all data domain operations. |
| AliyunYundunSDDPReadOnlyAccess | Read-only access. The user can view all domains but cannot modify, delete, or move assets. |
| AliyunYundunSDDPDataManager | Scoped management. After you synchronize the RAM user to DSC and set a domain scope, the user can view and manage only the assigned domains and their assets (add assets, modify domains, move assets within scope). |
The AliyunYundunSDDPDataManager policy only scopes access to data domains. RAM users with AliyunYundunSDDPFullAccess can still view all assets when using other DSC features such as data insights, data auditing, and data masking. You cannot grant a RAM user read-only access to specific domains only—the AliyunYundunSDDPReadOnlyAccess policy always grants visibility to all domains.
Step 1: Synchronize RAM user information
The RAM user you want to synchronize must have the AliyunYundunSDDPFullAccess policy attached. After synchronization, the user can only manage the custom domains you assign—they cannot access assets outside their scope on the Asset Center > Data Management page.
On the Data Management page, click the Data Administrator tab.
If no suitable RAM user exists, click Create User to create one:
In the Create User panel, click RAM Console.
On the Create User page in the RAM console, enter the user information and click OK. See Create a RAM user for details.
Return to the DSC console and click Created in the Create User panel.
Grant the RAM user the required permissions:
On the Users page of the RAM console, find the RAM user and click Add Permissions in the Actions column.
In the Grant Permission panel, attach the AliyunYundunSDDPDataManager policy. If AliyunYundunSDDPFullAccess is not already attached, add it as well. See Grant permissions to a RAM user for details.
Return to the Data Administrator tab and click Synchronize User. DSC adds all RAM users with the AliyunYundunSDDPDataManager policy to the data administrator list.
Step 2: Assign data domains to the RAM user
On the Data Management tab, find the RAM user and click Edit Manageable Data Domain in the Actions column.
In the Modify Manageable Data Domain panel, select the domains the user can manage and click OK.
What's next
View sensitive data identification results scoped to a specific domain: View sensitive data identification results
Limit identification task scans to specific domains: Identification tasks
Manage RAM users and permissions: Create a RAM user and grant permissions