Manage users and roles - E-MapReduce - Alibaba Cloud Documentation Center

A workspace is the basic unit for multi-role collaboration. All development work happens within a specific workspace. To enable collaboration with RAM users or RAM roles, add them to the workspace and assign roles based on their responsibilities.

Background

The following table lists the roles and permissions for EMR Serverless Spark.

Permission category	Permission/role	Guest	DataScience	DataEngineering	Owner
View workflows	View workflow lists, statuses, versions, topologies, details, and configurations	✓	✓	✓	✓
View workflows	View the log, output, and SparkUI for workflow instance nodes	✓	✓	✓	✓
Manage workflows	Create workflows (including defining topologies, associating nodes with tasks, and publishing)	-	-	✓	✓
	Delete workflows	-	-	✓	✓
	Create workflow nodes	-	-	✓	✓
	Edit workflow instance configurations	-	-	✓	✓
	Enable workflow scheduling	-	-	✓	✓
	Disable workflow scheduling	-	-	✓	✓
	Trigger workflows	-	-	✓	✓
	Node operations (rerun, mark as successful, or stop)	-	-	✓	✓
Manage queues	View queues	✓	✓	✓	✓
	Add queues	-	-	-	✓
	Edit queues (adjust resources)	-	-	-	✓
	Delete queues	-	-	-	✓
	Submit jobs to a queue	-	✓ (Scope: dev_queue)	✓ (Scope: *)	✓ (Scope: *)
SQL sessions	View SQL sessions	✓	✓	✓	✓
	Create SQL sessions	-	-	✓	✓
	Edit SQL sessions	-	-	✓	✓
	Delete SQL sessions	-	-	✓	✓
Notebook sessions	View Notebook sessions	✓	✓	✓	✓
	Create Notebook sessions	-	-	✓	✓
	Edit Notebook sessions	-	-	✓	✓
	Delete Notebook sessions	-	-	✓	✓
Gateway	View gateways	✓	✓	✓	✓
	Create gateways	-	-	✓	✓
	Edit gateways	-	-	✓	✓
	Delete gateways	-	-	✓	✓
	Manage tokens: Create, delete, and update tokens for Livy Gateway	-	-	✓	✓
Manage ciphertexts	View ciphertexts	-	✓	✓	✓
	Create ciphertexts	-	-	✓	✓
	Delete ciphertexts	-	-	✓	✓

Prerequisites

You have created a workspace. For more information, see Manage workspaces.
You have created a RAM user and granted one of the following permissions: AliyunEmrServerlessSparkReadOnlyAccess, AliyunEMRServerlessSparkDeveloperAccess, or AliyunEMRServerlessSparkFullAccess. For more information, see Grant permissions to a RAM user.

Manage users

Add a user

Go to the Access Control page.
1. Log on to the E-MapReduce console.
2. In the left navigation pane, choose EMR Serverless > Spark.
3. On the Spark page, click the name of the desired workspace.
4. On the EMR Serverless Spark page, select Security > Access Control in the left navigation pane.
On the Access Control page, on the User tab, click Add User.
In the Add User dialog box, select existing RAM users and RAM roles, and click OK.

You can select one or more RAM users and RAM roles.

Remove a user

On the Access Control page, on the User tab, click Delete in the Actions column of the user you want to remove.
In the Remove User dialog box, click Remove.

Manage roles

If the built-in roles are insufficient for your requirements, you can create custom roles and assign the required permissions.

Create a role and grant permissions

On the Access Control page, on the Role tab, click Create Role.
In the dialog box that appears, enter a Role Name and a Display Name, and click OK.
Click the name of the newly created role.
Click Add Authorization.
Select the required permissions and click OK.

Add users to a role

On the Access Control page, on the Role tab, click Add User in the Actions column of the desired role.
In the Add User dialog box, select the desired users and click OK.

Remove users from a role

On the Access Control page, on the Role tab, click Remove User in the Actions column of the desired role.
In the Remove User dialog box, select the users to remove and click OK.