Console authorization - Realtime Compute for Apache Flink

To enable multiple users to collaborate on jobs within a namespace in the Realtime Compute for Apache Flink Development Console, add them as members and assign them roles. This topic describes common authorization scenarios, role types, and the authorization procedure.

Authorization scenarios

Scenario	UI message	Description
Cannot access the current namespace	The page displays a permission denied message, indicating that the current user cannot access this namespace.	This indicates that you do not have permission to access the namespace. Contact a member with the owner role or a user with member management permissions to assign you the viewer role or a role with higher privileges. For more information, see Procedure. Once authorized, re-enter the namespace or refresh the page to gain access.
Cannot use a specific feature or perform an action	For example, on the Deployments page, when you click an action button such as Stop or Deploy, a message appears indicating that your account lacks the necessary permissions and that you should contact a role administrator.	This indicates that your account lacks the required permissions for the action. Contact a member with the owner role or a user with role management permissions to add the necessary permissions to your custom role.

Role types

A role is a collection of permissions. The Development Console provides two types of roles: system roles and custom roles. The following table describes the differences between them.

Role type	Description	Notes
system role	Realtime Compute for Apache Flink provides three built-in system roles: owner, editor, and viewer. For a list of permissions included in each system role, see Granular permission list.	You cannot modify permissions for or delete system roles. To grant permissions that are not in the list of granular permissions, such as metadata management or UDF management in SQL development, you must assign the editor or owner role to the member.
custom role	If system roles do not meet your needs for granular permissions, you can create a custom role. You can extend the viewer or editor role by adding the permissions you require.	A custom role must include all permissions of the viewer role, plus additional permissions. Only members with the owner role or users with role management permissions can create, edit, or delete custom roles. You can create a maximum of 10 custom roles in a namespace. When you create a custom role, consider permission dependencies to ensure the configuration is valid and complete.

Prerequisites

You have read the Authorization Notice.

Procedure

Step 1. (Optional) Create a custom role

If the default system roles meet your requirements, skip this step.

Log on to the Realtime Compute for Apache Flink Development Console as a member with the owner role or as a user with role management permissions.
At the top of the page, select the target namespace.
In the left-side navigation pane, click Security > Permissions, and then click the Role Management tab.

Click Add Role and configure the parameters.

Parameter	Description
Role name	The name of the custom role. The name must start with a letter, contain only letters, digits, and hyphens (-), and be up to 64 characters long.
Description	A description of the role to help administrators and other members understand its purpose and permission scope. The description can be up to 256 characters long.
Role permissions	To ensure permission integrity, some permissions have dependencies on others. The system automatically selects these required dependencies. For more information about the dependencies, see Granular permission list.

Click OK. You can then view, edit, or delete the custom role that you created.
- View Permissions: View the permissions included in the role.
- View Members: View the members who are assigned this role.
- Edit: Members with the appropriate permissions can add or remove permissions from the role.
- Delete: To mitigate security risks, you must first unassign the role from all members or reassign them to a different role. Once the role is unassigned from all members, a user with role deletion permissions can delete it.

Note

To remove a default permission dependency, create a custom role based on the viewer system role. In the permission selection shuttle, add the target permission and its dependencies to the right panel, and then remove the unwanted dependencies from the right panel.

Step 2. Assign a role to a member

Assign a role to a member to grant them the necessary permissions.

Log on to the Realtime Compute for Apache Flink Development Console as a member with permissions to create members, such as a user with the owner role.
At the top of the page, select the target namespace.
In the left-side navigation pane, click Security > Permissions, and then click the Members tab.

Click Add Member, specify the member details, and select a Role.

Parameter	Description
Select RAM account	Displays the RAM users and RAM roles under the Alibaba Cloud account associated with the namespace. You can select multiple accounts to authorize in bulk.
Add account manually	Enter the ID of another Alibaba Cloud account, a RAM user, or a RAM role to authorize. To find an ID: Alibaba Cloud account ID: Click your profile picture in the upper-right corner of the console. On the Account Center page, go to the Security Settings page to find your Account ID. RAM user ID (UID): For more information, see Manage RAM user information. RAM role ID: For more information, see View the information of a RAM role. To find the ID, go to the RAM access control console. In the left-side navigation pane, click Roles. Click the name of the target role, such as flinktest, to open its details page. You can find the Role ID in the Basic Information section.
Role	Select a system role or a custom role. To review a role's permissions beforehand, go to the Role Management tab and click Actions > View Permissions for that role.

Click OK.

Step 3. Log on after authorization

Once authorized, the new member can log on to the Realtime Compute for Apache Flink Development Console and use the granted features.

If the member is already logged on, they must refresh the page to access the target namespace.
If the member is not logged on, they can access the namespace by using its URL.

Granular permissions