How an Alibaba Cloud account creates a RAM user and grants permissions for data development - Hologres

This topic describes how to create a RAM user and grant permissions for data development in DataWorks.

Background

By default, the Alibaba Cloud account that purchases an instance becomes its superuser.

The Alibaba Cloud account must grant other users permissions to access the instance.

A RAM user is subject to two types of permission controls.

RAM permissions

RAM permissions are optional. A RAM user with the required RAM permissions can manage instances in the Hologres console. For example, the user can create, delete, or scale instances, modify network types, and view instance information.
Instance development permissions

Instance development permissions are required. To connect to an instance and perform data development, a RAM user must first be granted development permissions by an Alibaba Cloud account.

Hologres allows you to grant permissions to RAM users by using a simple permission model or an expert permission model.

Simple permission model (recommended)

The simple permission model (SPM) is a coarse-grained permission model that Hologres provides based on the PostgreSQL authorization system to improve user experience. For more information, see Simple permission model (SPM).
Expert permission model

The expert permission model uses the same authorization system as standard PostgreSQL. You can grant permissions to RAM users by running standard PostgreSQL authorization statements. For more information, see Expert permission model.

If you already have a RAM user, skip this section.

Log on to the Alibaba Cloud website with your Alibaba Cloud account.
Go to the RAM console.
In the left navigation pane, choose Identities > User.
Click Create User.

You can also click Add User to create multiple RAM users at once.
In the User Account Information section, enter the Logon Name and Display Name.
In the Access Mode section, select Console Access.
Set a logon password for the RAM user.
Click OK.

Grant RAM permissions to the RAM user.

For more information, see Grant permissions to a RAM user.
Grant instance development permissions to the RAM user.

To connect to an instance and perform data development, a RAM user must first be granted development permissions by an Alibaba Cloud account. For more information, see Grant a RAM user development permissions on an instance.

To perform data development in DataWorks as a RAM user, you must add the user to the appropriate workspace. Follow these steps:

Go to the workspace configuration page.
1. Log on to the DataWorks console, switch to the target region, and then click Workspace.
2. In the Actions column of the target workspace, click Manage to go to the workspace management page.
On the Workspace Members tab, click Add Member in the upper-right corner.
In the Add Member dialog box, click Refresh to populate the Available Accounts list with all RAM users from your Alibaba Cloud account.
In the Available Accounts list, select the member accounts that you want to add, and click > to move them to the Selected Accounts list.
Select the roles you want to grant and click OK.

The workspace creator is assigned the administrator role by default. For details about role permissions, see Appendix: List of preset role permissions (workspace level).
Log on to the DataWorks console as the RAM user, and then choose Data Development and O&M > DataStudio.
You can now perform data development as required.

Go to the workspace configuration page.
1. Log on to the DataWorks console.
2. In the left navigation pane, click Workspace.
3. In the Actions column of the target workspace, click Manage to go to the workspace management page.
On the Workspace Members tab, find the member you want to remove and click Remove in the Actions column. Then, follow the on-screen instructions.

Note
Removing a RAM user from a workspace does not revoke their development permissions on the Hologres instance.