All Products
Search

This Product

    E-MapReduce:Grant permissions to RAM users

    Document Center

    E-MapReduce:Grant permissions to RAM users

    Last Updated:Jun 18, 2026

    If you want to allow a RAM user to use the E-MapReduce (EMR) console, you must grant the required permissions to the RAM user by using your Alibaba Cloud account in the RAM console.

    Background information

    Resource Access Management (RAM) is an Alibaba Cloud service that helps you control access to your resources. For more information, see What is RAM?. In EMR, you can use RAM in the following scenarios:

    • Users: You can create RAM users for different roles, such as developers and O&M engineers, and grant them different permissions to access specific resources.

    • User groups: You can group RAM users with the same responsibilities and attach policies to the user group. This allows you to efficiently grant the same permissions to multiple users.

    Policies

    EMR uses the following policies.

    Policy name

    Description

    Permissions

    AliyunEMRFullAccess

    Administrative permissions for EMR.

    All permissions for EMR on ECS and EMR on ACK.

    AliyunEMRReadOnlyAccess

    Read-only permissions for EMR.

    All read permissions for EMR on ECS and EMR on ACK.

    AliyunEMRDlsFullAccess

    Administrative permissions for EMR OSS-HDFS.

    All data management permissions for EMR OSS-HDFS.

    AliyunEMRDevelopAccess (Not recommended)

    Developer permissions for EMR.

    All permissions for EMR, except for administrative tasks like creating and releasing clusters.

    Note

    The legacy Data Development feature is scheduled to be phased out by region, starting from December 30, 2024.

    AliyunEMRFlowAdmin (Not recommended)

    Administrative permissions for Data Development in EMR.

    Administrative permissions for Data Development in EMR, including creating projects and managing jobs, but not adding project members or managing clusters.

    Note

    The legacy Data Development feature is scheduled to be phased out by region, starting from December 30, 2024.

    Procedure

    To grant EMR permissions to a RAM user, follow these steps in the RAM console.

    1. Log on to the RAM console with your Alibaba Cloud account or as a RAM administrator.

    2. In the left-side navigation pane, choose Identities > User.

    3. On the Users page, find the desired RAM user and click Grant Permission in the Actions column. Alternatively, you can select multiple RAM users and click Grant Permission at the bottom of the user list to grant them permissions in bulk.

    4. In the Add Permission panel, configure the following parameters.

      Parameter

      Description

      Resource Scope

      • Account: The permissions take effect within the current Alibaba Cloud account.

      • ResourceGroup: The permissions take effect within the specified resource group.

      Principal

      The RAM user that receives the permissions.

      Policies

      Under All Policy Types, select System Policy. In the search box, enter EMR to search for EMR-related policies, and then click the policy that you want to grant to the RAM user. For more information about the policies, see Policies.

    5. Click Grant Permission.

      After the permissions are granted, they take effect immediately. The RAM user can then log on to the to perform the authorized operations.

      Note

      If the RAM user no longer needs the permissions, you can revoke them. For more information, see Revoke permissions from a RAM user.