MaxCompute:Policy-based permission management for users assigned built-in roles

Prerequisites

Before you begin, ensure that you have:

• The MaxCompute client installed. For more information, see Install and configure the MaxCompute client.

• The project owner role, or the Super_Administrator or Admin built-in role in the target project

Background

For users already assigned a built-in role, the policy-based mechanism is more effective than the access control list (ACL) mechanism for fine-grained permission control. The table below shows when to use each.

For more information, see Users and roles and Policy-based access control and download control.

Grant permissions using the policy-based mechanism

The following example shows how to prevent RAM user Alice (assigned to the Development role) from deleting tables whose names start with tb_. Alice belongs to the Alibaba Cloud account bo*@aliyun.com.

The approach creates a separate deny role (delete_test) rather than modifying the built-in role directly. This keeps the deny rule isolated and easy to revoke — you can remove it from a user without affecting others who share the built-in role.

1. Install and start the MaxCompute client.

2. Run CREATE ROLE to create a role named delete_test.

   CREATE ROLE delete_test;

   For more information, see Role planning.

3. Run GRANT to configure the delete_test role to deny DROP operations on all tables whose names start with tb_.

   GRANT DROP ON TABLE tb_* TO ROLE delete_test privilegeproperties("policy" = "true", "allow"="false");

   The "policy" = "true" flag activates the policy-based mechanism. The "allow"="false" flag sets the rule as a deny. For more information about the GRANT syntax, see the "Policy-based access control by using the GRANT statement" section in Policy-based access control and download control.

4. Run GRANT to assign the delete_test role to Alice.

   GRANT delete_test TO ram$bo*@aliyun.com:Alice;

   If you don't know the Alibaba Cloud account Alice belongs to, run LIST USERS; on the MaxCompute client to look it up. For more information, see Role planning.

5. Run SHOW GRANTS to verify Alice's permissions.

   SHOW GRANTS FOR ram$bo*@aliyun.com:Alice;

   Confirm that the output includes a [role/delete_test] block under Authorization Type: Policy with a D (Deny) prefix on the tb_*: Drop entry.

   [roles]
   role_project_admin, delete_test
   
   Authorization Type: Policy
   [role/delete_test]
   D       projects/mcproject_name/tables/tb_*: Drop
   [role/role_project_admin]
   A       projects/mcproject_name: *
   A       projects/mcproject_name/instances/*: *
   A       projects/mcproject_name/jobs/*: *
   A       projects/mcproject_name/offlinemodels/*: *
   A       projects/mcproject_name/packages/*: *
   A       projects/mcproject_name/registration/functions/*: *
   A       projects/mcproject_name/resources/*: *
   A       projects/mcproject_name/tables/*: *
   A       projects/mcproject_name/volumes/*: *
   
   Authorization Type: ObjectCreator
   AG      projects/mcproject_name/tables/local_test: All
   AG      projects/mcproject_name/tables/mr_multiinout_out1: All
   AG      projects/mcproject_name/tables/mr_multiinout_out2: All
   AG      projects/mcproject_name/tables/ramtest: All
   AG      projects/mcproject_name/tables/wc_in: All
   AG      projects/mcproject_name/tables/wc_in1: All
   AG      projects/mcproject_name/tables/wc_in2: All
   AG      projects/mcproject_name/tables/wc_out: All

   For more information, see Query permissions by using MaxCompute SQL.

6. Log in to the MaxCompute client as Alice and run DROP TABLE to test the restriction.

   DROP TABLE tb_test;

   If the deny rule is active, the command fails with an error similar to:

   FAILED: Catalog Service Failed, ErrorCode: 50, Error Message: ODPS-0130013:Authorization exception - Authorization Failed [4011],
   You have NO privilege 'odps:Drop' on {acs:odps:*:projects/mcproject_name/tables/tb_test}.
   Explicitly denied by policy.
   Context ID:85efa8e9-40da-4660-bbfd-b503dfa64c0a. --->Tips: Pricipal:RAM$bo*@aliyun.com:Alice; Deny by policy

   Two phrases confirm the policy-based deny rule is in effect: Explicitly denied by policy in the middle of the error, and Deny by policy at the end. If neither phrase appears, or if the table is deleted instead, check that all preceding steps were completed correctly.

Revoke permissions using the policy-based mechanism

If the tables with the tb_ prefix are no longer critical and you want to allow Alice to delete them, revoke the deny permission using one of the two methods below.