how to manage user permissions in the console - MaxCompute

Grant project-level management permissions

Project-level management permissions cover project security configuration, user and role management, package management, label-based access control, and expired permission cleanup. For more information, see List of project management permissions.

Procedure

Log in to the MaxCompute console and select a region in the upper-left corner.
In the left-side navigation pane, choose Manage Configurations > Projects.
On the Projects page, click Manage in the Actions column for the target project.
On the Project Settings page, click the Role Permissions tab.

On the Role Permissions tab, you can create an Admin role or modify the permissions of an existing Admin role.

Note
By default, only an Alibaba Cloud account has the permission to manage roles for a project. To grant permissions using a RAM account, such as a RAM user or a RAM role, the account must have the required project management permissions.
- Create an Admin role
  1. Click Create Project-level Role to create a project role with the required MaxCompute permissions.
  2. In the Create Role dialog box, configure the parameters as prompted and click OK.
    
    Set Role Type to Admin, and then enter an authorization policy.
- Modify the permissions of an existing Admin role.
  
  On the Role Permissions tab, find the target role and click Modify Authorization in the Actions column. After you modify the policy, click Confirm to save the changes.
For more information about the values for Action and Resource, see List of project management permissions. This topic provides policy examples based on management modules.
Find the target project-level role and click Manage Members in the Actions column. In the Manage Members dialog box, you can view the members assigned to the role, assign the role to users, or remove users from the role, which revokes it.

Policy examples

Note

Management permissions for a module often involve multiple actions and resources. The examples use a wildcard (*) to grant permissions on multiple objects at once.
For more information about Action and Resource values, see List of project management permissions.
Replace project_name with your MaxCompute project name.

Role management

This policy grants permissions to manage roles.

{
  "Statement": [
    {
      "Action": [
        "odps:*"
      ],
      "Effect": "Allow",
      "Resource": [
        "acs:odps:*:projects/project_name/authorization/roles",
        "acs:odps:*:projects/project_name/authorization/roles/*/*"
      ]
    }
  ],
  "Version": "1"
}

Package management

This policy grants permissions to manage packages.

{
  "Statement": [
    {
      "Action": [
        "odps:*"
      ],
      "Effect": "Allow",
      "Resource": [
        "acs:odps:*:projects/project_name/authorization/packages",
        "acs:odps:*:projects/project_name/authorization/packages/*",
        "acs:odps:*:projects/project_name/authorization/packages/*/*/*"
      ]
    }
  ],
  "Version": "1"
}

Note

To manage packages in the console, the user must have the list permission on the project. Grant the list permission on the current project first. For console-based authorization, see Grant project-level operation permissions on objects. For command-based authorization, see Manage user permissions by using commands.

Project security

This policy grants permissions to modify project security configurations.

{
  "Statement":[
    {
      "Action":[
        "odps:*"
      ],
      "Effect":"Allow",
      "Resource":[
        "acs:odps:*:projects/project_name/authorization/configurations/*"
      ]
    }
  ],
  "Version":"1"
}

User management

This policy grants permissions to manage project users.

{
  "Statement":[
    {
      "Action":[
        "odps:*"
      ],
      "Effect":"Allow",
      "Resource":[
        "acs:odps:*:projects/project_name/authorization/users"
      ]
    }
  ],
  "Version":"1"
}

All management permissions

This policy grants all management permissions.

{
  "Statement":[
    {
      "Action":[
        "odps:*"
      ],
      "Effect":"Allow",
      "Resource":[
        "acs:odps:*:projects/project_name/authorization/*"
      ]
    }
  ],
  "Version":"1"
}

Grant project-level operation permissions on objects

Project-level operation permissions apply to objects within a project, such as tables, functions, and resources. Examples include CreateTable, CreateInstance, and SelectTable. For more information, see List of permissions for projects and objects within projects.

Procedure

Log in to the MaxCompute console and select a region in the upper-left corner.
In the left-side navigation pane, choose Manage Configurations > Projects.
On the Projects page, click Manage in the Actions column for the target project.
On the Project Settings page, click the Role Permissions tab.

You can create a Resource role or edit an existing Resource role.

Note
By default, only an Alibaba Cloud account has the permission to manage roles for a project. To grant permissions using a RAM account, such as a RAM user or a RAM role, the account must have the required project management permissions.
- Create a Resource role
  1. Click Create Project-level Role to create a project role with the required MaxCompute permissions.
  2. In the Create Role dialog box, configure the parameters as prompted and click OK.
    
    Set Role Type to Resource. Then, grant permissions by using an ACL or a policy.
- Modify the permissions of an existing Resource role
  - On the Role Permissions tab, find the target role and click Modify Authorization in the Actions column. Then, modify the permissions by using ACL or by editing the policy.
For more information about permissions, see List of permissions for projects and objects within projects. This topic provides examples of how to grant permissions by using ACL and policies in the console. For more details, see Grant project-level management permissions.
Find the target project-level role and click Manage Members in the Actions column. In the Manage Members dialog box, you can view the members assigned to the role, assign the role to users, or remove users from the role, which revokes it.

Authorization examples

Note

For more information about actions and objects for project-level operation permissions, see List of permissions for projects and objects within projects.
Replace project_name with your MaxCompute project name.

ACL

You can use an ACL to grant a Resource role permissions to create tables (CreateTable) and instances (CreateInstance), list all object types in the project (List), and read metadata (Describe) and data (Select) from all tables.

Note

Do not close the progress bar or page while authorization is in progress. Otherwise, the authorization is interrupted.

Policy

This policy grants a Resource role permissions to create tables (CreateTable) and instances (CreateInstance), list all object types in the project (List), read metadata of all tables (Describe), and read data from all tables (Select).

{
    "Statement": [{
            "Action": ["odps:CreateTable","odps:CreateInstance","odps:List"],
            "Effect": "Allow",
            "Resource": ["acs:odps:*:projects/project_name"]},
        {
            "Action": ["odps:Describe","odps:Select"],
            "Effect": "Allow",
            "Resource": ["acs:odps:*:projects/project_name/tables/*"]}],
    "Version": "1"}

This policy grants a Resource role permissions to read metadata (Describe) and query data (Select) from all tables whose names start with tmp, read and update all resources and functions, and denies permission to delete any table.

{
    "Statement": [{
            "Action": ["odps:Describe","odps:Select"],
            "Effect": "Allow",
            "Resource": ["acs:odps:*:projects/project_name/tables/tmp_*"]},
        {
            "Action": ["odps:Read","odps:Write"],
            "Effect": "Allow",
            "Resource": ["acs:odps:*:projects/project_name/resources/*"]},
            {
            "Action": ["odps:Read","odps:Write"],
            "Effect": "Allow",
            "Resource": ["acs:odps:*:projects/project_name/functions/*"]},
            {
            "Action": ["odps:Drop"],
            "Effect": "Deny",
            "Resource": ["acs:odps:*:projects/project_name/tables/*"]}],
    "Version": "1"}

If data storage by schema is enabled for the project (see Schema operations), you must modify the policy as follows:

{
    "Statement": [{
            "Action": ["odps:Describe","odps:Select"],
            "Effect": "Allow",
            "Resource": ["acs:odps:*:projects/project_name/schemas/*/tables/tmp_*"]},
        {
            "Action": ["odps:Read","odps:Write"],
            "Effect": "Allow",
            "Resource": ["acs:odps:*:projects/project_name/schemas/*/resources/*"]},
            {
            "Action": ["odps:Read","odps:Write"],
            "Effect": "Allow",
            "Resource": ["acs:odps:*:projects/project_name/schemas/*/functions/*"]},
            {
            "Action": ["odps:Drop"],
            "Effect": "Deny",
            "Resource": ["acs:odps:*:projects/project_name/schemas/*/tables/*"]}],
    "Version": "1"}

Grant tenant-level management permissions

Tenant-level management permissions cover user and role operations at the tenant level, including adding or removing users, creating or deleting roles, viewing users and roles, assigning or revoking roles for users, and adding roles to or removing them from projects.

Note

Only an Alibaba Cloud account or a user with the tenant-level Super_Administrator or Admin role can manage tenant-level permissions.

To grant management permissions to a RAM account (RAM user or RAM role), use an Alibaba Cloud account to assign the Super_Administrator or Admin role. These roles provide extensive management permissions. For details, see Role planning. Use caution when assigning these roles. For more information about tenant-level roles, see Grant tenant-level role permissions.

Log in to the MaxCompute console and select a region in the upper-left corner.
In the left-side navigation pane, choose Manage Configurations > Tenants .
On the Tenants page, click the Users tab.
On the Users tab, find the target RAM user and click Modify Role in the Actions column.

In the Edit Role dialog box, move the desired roles from the Available Roles section to the Added Roles section, and then click OK.

Grant tenant-level object operation permissions

Tenant-level object operation permissions apply to tenant-level objects such as quotas and network connections. Examples include Usage and CreateNetworkLink. These permissions also enable a single account to manage objects across multiple projects, which simplifies permission management. For more information about tenant-level roles, see Grant tenant-level role permissions.

Procedure

Log in to the MaxCompute console and select a region in the upper-left corner.
In the left-side navigation pane, choose Manage Configurations > Tenants .
On the Tenants page, click the Roles tab.

On the Roles page, you can create a new tenant-level role or manage the permissions of an existing custom role.

Note

Only an Alibaba Cloud account or a user with the tenant-level Super_Administrator or Admin role can manage tenant-level permissions.

Add a tenant-level role

On the Roles tab, click Add Role. In the Add Role dialog box, enter a custom Role Name, provide the Policy Content, and then click OK.

Parameter	Description
Role name	The name of the new tenant-level role. Must be unique within your Alibaba Cloud account, 6 to 64 characters long, start with a letter, and contain only letters, digits, and underscores (_).
Policy content	The permission policy for the role. Edit the policy code based on a template.

Modify the permissions of an existing tenant-level role

On the Roles tab, find the target role and click Manage Permissions in the Actions column. Modify the authorization policy and click OK to save your changes.

On the Users tab, find the user you want to authorize and click Modify Role in the Actions column.

In the Edit Role dialog box, move the desired roles from the Available Roles section to the Added Roles section, and then click OK.

Policy examples

Note

These examples use a wildcard (*) to grant permissions on multiple objects at once.
For more information about specific actions and resources, see List of permissions on objects in a tenant.

This policy grants a tenant-level role the Usage permission on all quotas in all regions, and the CreateNetworkLink, List, and Execute permissions on all network connections.

{
    "Statement":[
      {
            "Action":[
                "odps:Usage"
            ],
            "Effect":"Allow",
            "Resource":[
                "acs:odps:*:regions/*/quotas/*"
            ]
      },
      {
            "Action":[
                "odps:CreateNetworkLink",
                "odps:List",
                "odps:Execute"
            ],
            "Effect":"Allow",
            "Resource":[
                "acs:odps:*:networklinks/*"
            ]
      }
    ],
    "Version":"1"
}

This policy grants a tenant-level role all operation permissions on the MaxCompute projects project_1 and project_2.
```
{
    "Statement":[
        {
            "Action":[
                "odps:*"
            ],
            "Effect":"Allow",
            "Resource":[
                "acs:odps:*:projects/project_1",
                "acs:odps:*:projects/project_1/*",
                "acs:odps:*:projects/project_2",
                "acs:odps:*:projects/project_2/*"
            ]
        }
    ],
    "Version":"1"
}
```
Note
Only the project owner or a user with the project Super_Administrator or Admin role can perform this action. After granting permissions on a project object through a tenant-level role, you must add that role to the project for the permissions to take effect. On the Role Permissions tab, set Role Level to Tenant. Then, find the target role and click Enable in the Actions column.