Hologres:Query encrypted MaxCompute data

Step 1: Create a custom policy

1. Log on to the RAM console. In the left-side navigation pane, choose Permissions > Policies. On the Policies page, click Create Policy.

   

2. On the Create Policy page, click JSON. In the code editor, enter the following policy, then set Name to AliyunHologresEncryptionDefaultRolePolicy.

   

   This policy grants Hologres the KMS permissions it needs to obtain and decrypt data keys when querying encrypted MaxCompute data.

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "kms:Encrypt",
                   "kms:Decrypt",
                   "kms:GenerateDataKey",
                   "kms:DescribeKey"
               ],
               "Resource": "acs:kms:*:*:*/*",
               "Effect": "Allow"
           }
       ]
   }

3. Click OK. The custom policy is created.

Step 2: Create a RAM role and grant permissions

Hologres needs a RAM role to call KMS APIs on your behalf. Create the role and attach the policy created in step 1.

1. Log on to the RAM console. In the left navigation pane, choose Identities > Roles.

2. On the Roles page, click Create Role. Set Principal Type to Cloud Service and Principal Name to Hologres.

3. Click OK. In the dialog, enter AliyunHologresEncryptionDefaultRole in the Role Name field, then click OK.

   

4. On the role details page, click Grant Permission.

5. In the Grant Permission panel, set Resource Scope to Account. For Policy, select AliyunHologresEncryptionDefaultRolePolicy.

   

6. Click OK. On the role details page, click the Trust Policy tab to verify the trust policy.

Step 3: Switch the query engine to SQE

HQE cannot access encrypted MaxCompute data. Run the following statement to switch the database's foreign table query engine to SQE:

ALTER DATABASE <dbname> SET hg_experimental_enable_access_odps_orc_via_holo = false;

The change takes effect after you create a new connection. To verify the configuration, run:

SHOW hg_experimental_enable_access_odps_orc_via_holo;

If the output is false, the configuration is active.

Step 4: Query encrypted data

After completing the previous steps, query encrypted MaxCompute data the same way you query regular MaxCompute data. See Accelerate queries on MaxCompute data using foreign tables.