Understand role types permissions and management - MaxCompute

Roles let you grant the same set of permissions to multiple users without configuring each user individually. Role-based access control (RBAC) reduces permission management overhead — assign permissions to a role once, then add or remove users from the role as needed.

MaxCompute supports two role types: administrator roles and resource roles. You can use built-in roles for common administrative tasks, or create custom roles tailored to your team's structure.

Role types

MaxCompute categorizes roles by the type of permissions they can hold:

Role type	Permission scope	How permissions are granted
Administrator role	Management permissions (user management, security configuration)	Policies only — not ACLs
Resource role	Object resource permissions (tables, packages, quotas)	ACLs or policies

Administrator roles cannot hold resource permissions. Resource roles cannot hold management permissions.

Built-in roles

MaxCompute provides four built-in administrator roles across two scopes.

Project-level built-in roles

Super_Administrator

The highest-level built-in role in a project. Holds all resource operation permissions and all management permissions. The project owner or any user assigned the Super_Administrator role can assign this role to other users.

Admin

A built-in administrator role with all resource operation permissions and a subset of management permissions. Restrictions:A built-in administrator role provided by MaxCompute. It is used to manage permissions for all objects and network connections (Networklink).

Only the project owner can assign the Admin role to users.
Users assigned the Admin role cannot reassign the Admin role to others.
Users assigned the Admin role cannot configure security policies, modify authentication models, or modify the permissions of the Admin role itself.

Tenant-level built-in roles

Super_Administrator

Holds all permissions that an Alibaba Cloud account has on MaxCompute, except the permissions to create a project, delete a project, and activate the MaxCompute service.

Admin

Holds permissions to manage all objects and network connections within the tenant.

Default project access

Project owners have all permissions on the projects that they created. Only the project owner can access objects in a project by default. Other users cannot access project objects unless the project owner explicitly grants them the required permissions.

Permissions of project-level administrator roles

The following table lists the permissions available to each project-level administrator role.

<table> <thead> <tr> <td>Permission type</td> <td>Object</td> <td>Operation</td> <td>Description</td> <td>Project owner</td> <td>Super_Administrator</td> <td>Admin</td> </tr> </thead> <colgroup></colgroup> <colgroup></colgroup> <colgroup></colgroup> <colgroup></colgroup> <colgroup></colgroup> <colgroup></colgroup> <colgroup></colgroup> <tbody> <tr> <td>Project security configuration</td> <td>Project</td> <td>SetSecurityConfiguration</td> <td>Configure security settings for a project.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Project</td> <td>GetSecurityConfiguration</td> <td>Query the security settings of a project.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Management of protected projects</td> <td>Project</td> <td>AddTrustedProject</td> <td>Add a protected project.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Project</td> <td>RemoveTrustedProject</td> <td>Remove a protected project.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Project</td> <td>ListTrustedProjects</td> <td>Query protected projects.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>User management</td> <td>Project</td> <td>AddUser</td> <td>Add a user.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Project</td> <td>RemoveUser</td> <td>Remove a user.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Project</td> <td>ListUsers</td> <td>Query users.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Project</td> <td>ListUserRoles</td> <td>Query the roles assigned to a user.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Role management</td> <td>Project</td> <td>CreateRole</td> <td>Create a role.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Project</td> <td>DescribeRole</td> <td>View the permissions of a role.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Project</td> <td>AlterRole</td> <td>Modify the attributes of a role.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Project</td> <td>DropRole</td> <td>Drop a role.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Project</td> <td>ListRoles</td> <td>Query roles.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Permission management by using a role</td> <td>Role</td> <td>GrantRole</td> <td>Assign a role to a user.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Role</td> <td>RevokeRole</td> <td>Revoke a role from a user.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Role</td> <td>ListRolePrincipals</td> <td>Query the users assigned a specific role.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Package management</td> <td>Project</td> <td>CreatePackage</td> <td>Create a package.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Project</td> <td>ShowPackages</td> <td>View packages.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Package</td> <td>DescribePackage</td> <td>View the details of a package.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Package</td> <td>DropPackage</td> <td>Drop a package.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Package</td> <td>InstallPackage</td> <td>Install a package.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Package</td> <td>UninstallPackage</td> <td>Uninstall a package.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Package</td> <td>AllowInstallPackage</td> <td>Allow a package to be installed and used in other projects.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Package</td> <td>DisallowInstallPackage</td> <td>Revoke the permissions for a package to be installed and used in other projects.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Package</td> <td>AddPackageResource</td> <td>Add a resource to a package.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Package</td> <td>RemovePackageResource</td> <td>Remove a resource from a package.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Label management</td> <td>Table</td> <td>GrantLabel</td> <td>Grant permissions to a role or user by using labels.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Table</td> <td>RevokeLabel</td> <td>Revoke label-based permissions from a role or user.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Table</td> <td>ShowLabelGrants</td> <td>Query the label-based permissions granted to a role or user.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Table</td> <td>SetDataLabel</td> <td>Configure labels for a role or user.</td> <td><img></td> <td><img></td> <td><img></td> </tr> <tr> <td>Clearance of expired permissions</td> <td>Project</td> <td>ClearExpiredGrants</td> <td>Clear information about expired permissions.</td> <td><img></td> <td><img></td> <td><img></td> </tr> </tbody> </table>

In the preceding table, indicates that the role has the permission, and indicates that the role does not have the permission.

Delete a role (tenant level)

To delete a tenant-level role in the MaxCompute console, perform the following steps:

Log on to the MaxCompute console and select a region in the top-left corner.
On the Role Management tab, find the target role and click Delete in the Actions column.
In the Delete Role dialog box, click OK.

Modify a role (tenant level)

Note

You can modify only the access policy of a role. You cannot modify the role name.

To modify the access policy of a tenant-level role in the MaxCompute console, perform the following steps:

Log on to the MaxCompute console and select a region in the top-left corner.
On the Role Management tab, find the target role and click Permission Management in the Actions column.
In the Edit Role dialog box, click OK.

Create a role (tenant level)

To create a tenant-level role in the MaxCompute console, perform the following steps:

Log on to the MaxCompute console and select a region in the top-left corner.
On the Role Management tab, click Add Role.

In the Add Role dialog box, configure the parameters that are described in the following table.

Parameter Name

Description

Role Name

The name of the new tenant-level role. The name must be unique within your Alibaba Cloud account. The name must meet the following requirements:

It must start with a letter.
It can contain only letters, underscores (_), and digits.
It must be 6 to 64 characters in length.

Policy Content

The access policy for the role. You can edit the policy code in the interface based on a policy template.

Click OK.

Custom roles

When built-in roles don't match your team's requirements, create custom roles. The types available depend on the scope:

Scope	Role type	What you can grant
Project level	Administrator or resource	Management permissions or object resource permissions within a project
Tenant level	Resource only	Permissions on object resources such as quotas, network links, and projects

Create a project-level role

Project owners and users assigned a built-in project-level role can create, query, and drop custom roles using the MaxCompute client, MaxCompute Studio, or the DataWorks console.

Important

After creating a role, assign it to users to put its permissions into effect. For details, see Assign a role to a user.

Syntax

create role <role_name> [privilegeproperties("type"="admin|resource")];

Parameters

Parameter	Required	Description
`role_name`	Yes	The name of the role. Must be unique within a project. Rules: starts with a letter; contains only letters and digits; 1–64 characters in length. Run `list roles;` on the MaxCompute client to check existing role names.
`privilegeproperties`	No	The role type. `"type"="admin"` creates an administrator role — permissions can only be granted through policies. `"type"="resource"` creates a resource role — permissions can be granted through ACLs or policies. If omitted, a resource role is created by default.

Examples

Create a resource role named Worker:

create role Worker;

Create an administrator role named sale_admin:

create role sale_admin privilegeproperties("type"="admin");

Query project-level roles

Syntax

list roles;

Example

list roles;

Output:

admin
super_administrator
worker

Drop a project-level role

Important

Before dropping a role, be aware of the following:

A role can only be dropped if no users are currently assigned to it. Revoke the role from all assigned users first. For details, see Revoke a role from a user.
Dropping a role does not delete its permissions. ACL-based, policy-based, and label-based permissions tied to the role remain in the project. If a new role is created with the same name, it inherits those residual permissions. Run purge privs from role after dropping the role to remove them.

Syntax

drop role <role_name>;

Parameters

Parameter	Required	Description
`role_name`	Yes	The name of the role to drop. Run `list roles;` on the MaxCompute client to check existing role names.

Example

drop role Worker;

Delete permissions of a dropped role

After a role is dropped, its residual permissions (ACL-based, policy-based, and label-based) remain in the project. The project owner, Admin, or Super_Administrator can remove them with the following command.

Run this command only after the role is dropped. If the role still exists, the command returns: "Principal <role_name> still exist in the project".

Syntax

purge privs from role <role_name>;

Parameters

Parameter	Required	Description
`role_name`	Yes	The name of the dropped role whose permissions you want to delete. Run `list roles;` to verify the role no longer exists before running this command.

What's next

Grant permissions to the roles you created: Perform access control based on project-level roles
Assign roles to users to put permissions into effect: Assign a role to a user

Limits

You can plan and manage tenant-level roles only in the following regions: China (Hangzhou), China (Shanghai), China (Beijing), China (Zhangjiakou), and China (Shenzhen).

References

Project-level role authorization