Hologres integrates with the Alibaba Cloud account system for authentication and access control. Understanding the account types and identifier formats lets you grant permissions correctly and connect to Hologres instances from client applications.
Account types
Hologres supports three account types. Alibaba Cloud accounts and RAM users are cloud-level identities managed outside Hologres. Custom accounts are database-level identities that exist only within a Hologres instance.
| Account type | When to use |
|---|---|
| Alibaba Cloud account | Use this account to create and manage Hologres instances. Typical operations include logging on to the Hologres console, managing databases, switching the billing method from pay-as-you-go to subscription, and granting permissions to other users. |
| RAM user | Use a RAM user to grant team members or applications scoped access to Hologres instances without sharing the root Alibaba Cloud account. With relevant permissions, a RAM user can create and manage Hologres instances. Resources remain owned by the Alibaba Cloud account, not the RAM user. |
| Custom account | Use a custom account for database-level operations within a single Hologres instance, such as creating or deleting databases, tables, and views, or connecting to a database. Custom accounts have the following limitations: passwords are encrypted with MD5, and access to MaxCompute tables is not available by default. To access MaxCompute tables, map the custom account to a RAM user that has the required permissions. For more information, see Manage users. |
Login accounts
When granting permissions to an Alibaba Cloud account or a RAM user, use the login account as part of the permission statement. Get the login account from the Security Settings page of the Account Center.
Alibaba Cloud account formats
| Format | Example |
|---|---|
ALIYUN$<Login Account>@aliyun.com | ALIYUN$company***@aliyun.com |
<Login Account>@aliyun.com | company***@aliyun.com |
RAM user formats
The following formats all identify the same RAM user. <subUserName> is the RAM user name, <Login Account> is the login account of the parent Alibaba Cloud account, and <Account ID> is the numeric account ID.
| Format | Example |
|---|---|
<subUserName>@<Login Account>.onaliyun.com | holouser***@company.onaliyun.com |
<subUserName>@<Login Account> | holouser@company |
<subUserName>@<Account ID>.onaliyun.com | holouser@123456789xxxx |
<subUserName>@<Account ID> | holouser@123456789xxxx |
RAM$<subUserName> | RAM$holo_test |
RAM$<Login Account>:<subUserName> | RAM$company:holouser |
RAM$<Account ID>:<subUserName> | RAM$123456789xxxx:holouser |
Account IDs
An account ID is a numeric string. Example: 189813715xxxx. Get it from the Security Settings page of the Account Center.
To get the account ID of a RAM user (also called its UID), go to the RAM users page and click the target user name.
When granting permissions to a RAM user by UID, use the format p4_UID. Example: p4_12333388xxx.
Grant permissions using account IDs:
CREATE USER "189813715xxxx"; -- Grants the Alibaba Cloud account (ID: 189813715xxxx) access to Hologres.
CREATE USER "p4_12333388xxx" superuser; -- Assigns the superuser role to the RAM user (UID: 12333388xxx).To view the account ID of the current user:
SELECT current_user;AccessKey ID and secret
The AccessKey ID and AccessKey secret are the credentials used to connect to Hologres instances programmatically. The AccessKey ID acts as a username and the AccessKey secret acts as a password. Get them from the Security Management page of the User Management console.
AccessKey pairs have a validity period. If a pair expires, create a new one. For more information, see Create an Alibaba Cloud account.
When connecting to Hologres from a PostgreSQL client or a JDBC client, enter the AccessKey ID as the username and the AccessKey secret as the password.
What's next
Manage users — grant permissions to Alibaba Cloud accounts, RAM users, and custom accounts
Create a user mapping for MaxCompute access — enable custom accounts to query MaxCompute tables