MaxCompute:ACL-based access control

Grant permissions

grant <actions> on <object_type> <object_name>
[(<column_list>)] to <subject_type> <subject_name>
[privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

Revoke permissions

revoke <actions> on <object_type> <object_name>
[(<column_list>)] from <subject_type> <subject_name>;

Grant or revoke column-level permissions

grant <actions> on table <table_name> (<column_list>) to <subject_type> <subject_name>;
revoke <actions> on table <table_name> (<column_list>) from <subject_type> <subject_name>;

Required parameters

Optional parameters

Example 1: Grant table-level permissions to a user

Create a table and grant Allen the Describe (read metadata) and Select (read data) permissions on it.

-- Switch to the project.
use test_project_a;

-- Create a partitioned table.
create table if not exists sale_detail
(
  shop_name     string,
  customer_id   string,
  total_price   double
)
partitioned by (sale_date string, region string);

-- Add Allen as a project member.
add user RAM$5527xxxxxxxx5788:1652xxxxxxxxxx1538;

-- Grant Describe and Select on the table to Allen.
grant Describe, Select on table sale_detail to USER RAM$5527xxxxxxxx5788:1652xxxxxxxxxx1538;

-- Verify the grant.
show grants for RAM$5527xxxxxxxx5788:1652xxxxxxxxxx1538;

Expected output:

Authorization Type: ACL
[user/RAM$5527xxxxxxxx5788:1652xxxxxxxxxx1538]
A       projects/test_project_a/tables/sale_detail: Describe | Select

Example 2: Grant column-level permissions to a user

Grant Alice all permissions on the shop_name and customer_id columns of sale_detail.

-- Switch to the project.
use test_project_a;

-- Add Alice as a project member.
add user RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;

-- Grant All on the specified columns to Alice.
grant All on table sale_detail (shop_name, customer_id) to USER RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;

-- Verify the grant.
show grants for RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;

Expected output:

Authorization Type: ACL
[user/RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649]
A       projects/test_project_a/tables/sale_detail/customer_id: All
A       projects/test_project_a/tables/sale_detail/shop_name: All

Example 3: Revoke permissions from users

Revoke the permissions granted in examples 1 and 2 from Allen and Alice.

-- Switch to the project.
use test_project_a;

-- Revoke Allen's table-level permissions.
revoke Describe, Select on table sale_detail (shop_name, customer_id) from USER RAM$5527xxxxxxxx5788:1652xxxxxxxxxx1538;

-- Revoke Alice's column-level permissions.
revoke All on table sale_detail (shop_name, customer_id) from USER RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;

-- Verify: Allen's and Alice's permission lists no longer contain the revoked permissions.
show grants for RAM$5527xxxxxxxx5788:1652xxxxxxxxxx1538;
show grants for RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;

Example 4: Grant project-level permissions to multiple users through a role

Grant Alice, Tom, and Lily the ability to create instances, resources, functions, and tables — and to list all objects — in test_project_a. Use a role to apply the same permissions to all three users in one step.

-- Switch to the project.
use test_project_a;

-- Add all three users as project members.
add user RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;
add user RAM$5527xxxxxxxx5788:3874xxxxxxxxxx1850;
add user ALIYUN$5638xxxxxxxx6899;

-- Create the Worker role and attach it to all three users.
create role Worker;
grant Worker TO RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;
grant Worker TO RAM$5527xxxxxxxx5788:3874xxxxxxxxxx1850;
grant Worker TO ALIYUN$5638xxxxxxxx6899;

-- Grant project-level permissions to the Worker role.
grant CreateInstance, CreateResource, CreateFunction, CreateTable, List on project test_project_a TO ROLE Worker;

-- Verify: Lily now has the Worker role and its permissions.
show grants for ALIYUN$5638xxxxxxxx6899;

Expected output:

[roles]
worker

Authorization Type: ACL
[role/worker]
A       projects/test_project_a: CreateTable | CreateResource | CreateInstance | CreateFunction | List

Example 5: Revoke a role from multiple users

Revoke the Worker role from Alice, Tom, and Lily. This removes all permissions that were inherited from the role.

-- Switch to the project.
use test_project_a;

-- Revoke the Worker role from all three users.
revoke Worker from RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;
revoke Worker from RAM$5527xxxxxxxx5788:3874xxxxxxxxxx1850;
revoke Worker from ALIYUN$5638xxxxxxxx6899;

-- Verify: Lily no longer has the Worker role or its permissions.
show grants for ALIYUN$5638xxxxxxxx6899;