MaxCompute:RAM permissions

Overview page — number of jobs

SQL analysis

Project management

Migration services

Quota management

Notebook management

Resource observation

Job O&M

Migration services (MMA)

Cost management

Disaster recovery management

Tenant management

Intelligent optimization

System policies

MaxCompute provides two system policies:

• AliyunMaxComputeFullAccess: Grants all permissions listed in this topic. This policy may grant excessive permissions — attach it to RAM users or RAM roles with caution.

• AliyunMaxComputeReadOnlyAccess: Grants all List and Get permissions listed in this topic. Attach this policy to RAM users or RAM roles that only need read access.

Custom policies

Create custom policies in the RAM console for fine-grained permission management. For more information, see Create a custom policy.

A RAM policy consists of a Version field and one or more Statement entries. Each statement includes an Effect, one or more Action values, a Resource (Alibaba Cloud Resource Name), and an optional Condition. The Action and Resource values come from the permission tables above. The Condition value comes from the Condition element section. For more information about policy syntax, see Policy structure and syntax.

The following are example custom policies.

Policy for managing MaxCompute project objects

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "odps:ListProjects",
                "odps:GetProject",
                "odps:CreateProject",
                "odps:DeleteProject",
                "odps:UpdateProjectDefaultQuota",
                "odps:UpdateProjectStatus",
                "odps:UpdateUsersToSuperAdmin",
                "odps:ListOutboundInternetAddress",
                "odps:UpdateOutboundInternetAddress"
            ],
            "Resource": "*"
        }
    ]
}

Policy for managing MaxCompute quota objects

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "odps:UpdateQuota",
                "odps:UpdateQuotaPlan",
                "odps:UpdateSubQuotas",
                "odps:UpdateQuotaSchedule",
                "odps:CreateQuotaPlan",
                "odps:DeleteQuotaPlan",
                "odps:CreateQuotaSchedule",
                "odps:ListQuotaRoutingRules",
                "odps:CreateQuotaRoutingRule",
                "odps:GetQuotaRoutingRule",
                "odps:RemoveQuotaRoutingRule",
                "odps:UpdateQuotaRoutingRule"
            ],
            "Resource": "*"
        }
    ]
}

Policy to deny creation of unencrypted MaxCompute projects

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "odps:CreateProject",
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "odps:Encryption": [
                        "false"
                    ]
                }
            }
        }
    ]
}

Policy to allow viewing MaxCompute resource observation data

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "odps:GetMetric",
                "odps:GetQuotaUsage",
                "odps:GetStorageSummaryCompared",
                "odps:GetStorageSizeSummary",
                "odps:SumDailyBillsByItem",
                "odps:SumStorageMetricsByDate",
                "odps:GetStorageAmountSummary",
                "odps:ListStorageProjectsInfo",
                "odps:ListTopJobInfo",
                "odps:ListStorageTablesInfo",
                "odps:ListStoragePartitionsInfo",
                "odps:GetTableAccessInfoTopK",
                "odps:GetTableIpAccessInfoTopK",
                "odps:GetTableAccessInfo",
                "odps:ListTableSlotDetail",
                "odps:GetTunnelThroughputSummary"
            ],
            "Resource": "*"
        }
    ]
}