After you create a MaxCompute project, you can grant permissions to other Resource Access Management (RAM) users so they can assist with development. Once granted, RAM users can operate tables, resources, functions, or jobs in the project. This topic describes how to authorize RAM users.
Prerequisites
You have created a MaxCompute project.
If you have not created a MaxCompute project, create one first. For more information, see Create a MaxCompute project.
You have created a RAM user.
For more information about creating a RAM user, see Prepare a RAM user.
Authorization method
DataWorks provides a complete permission control solution for data development and administration. The following example uses DataWorks in standard mode to explain how to grant permissions when the development environment and production environment are isolated.
Development environment
Add members to your DataWorks workspace. After that, these members can develop MaxCompute jobs in DataWorks.
In the DataWorks Management Center, choose Members and Roles in the left-side navigation pane, click Add Member, select the target member from the list of accounts to be added, click > to move the member to the added accounts list, select Development in Batch Set Roles, and then click OK.
For more information about adding members in the DataWorks console, see Add workspace members.
After you add DataWorks members, see Permission mappings between MaxCompute and DataWorks for the MaxCompute permissions corresponding to each member role.
Production environment
You can find tables in the production environment in Data Map and request permissions on those tables.
For more information about requesting table permissions, see Request table permissions.
What to do next
Prepare your MaxCompute project development environment and install the required tools. For more information about environment setup and security tools, see Choose a connection tool.
FAQ
Q: When I access the logview of a MaxCompute job, I get "can't operate the joblnsght, error code NO_PERMISSION". What should I do?
A: MaxCompute project-level permissions and RAM global permissions are two independent systems. A RAM user may have the AliyunMaxComputeFullAccess or AliyunDataWorksFullAccess global permission, or may be a DataWorks workspace administrator. However, if the user has not been added to the corresponding MaxCompute project, the user still gets the NO_PERMISSION error when accessing logview. To resolve this issue, add the RAM user to the target MaxCompute project and grant a role:
Log on to the MaxCompute console and go to the target project.
On the Role Permissions tab, add the RAM user to the project through member management.
Assign a role to the user (for example, Developer or Operations).
Access the logview link again. The NO_PERMISSION error is resolved.