MaxCompute:User planning and management

Background

After creating a MaxCompute project, only the project owner or users with a MaxCompute built-in role can access the project. To allow other users to collaborate, the project owner must add them to the project.

MaxCompute supports the following user types and operations.

Add an Alibaba Cloud account user (project-level)

To authorize another Alibaba Cloud account, the project owner must first add that account to the project.

• Syntax

  add user ALIYUN$<account_id>;

• Parameters

  Parameter	Required	Description
  account_id	Yes	The value for this parameter depends on your tenant's Use account ID setting. If enabled, provide the account ID. Otherwise, provide the login name. For example, for an account with the login name odps_test_user@aliyun.com, the account ID is 5527xxxxxxxx5788.

• Example

  This example adds the Alibaba Cloud account odps_test_user@aliyun.com (account ID: 5527xxxxxxxx5788) to the project test_project_a.

  If Use account ID is enabled

  add user ALIYUN$5527xxxxxxxx5788;

  If Use account ID is disabled

  add user ALIYUN$odps_test_user@aliyun.com;

Remove an Alibaba Cloud account (project-level)

If a user no longer needs to access a MaxCompute project, remove them from the project. Once removed, the user loses all permissions to access resources within that project.

• Syntax

  remove user ALIYUN$<account_id>;

• Usage notes

  • Before you remove a user with assigned roles, you must first revoke all their roles. For more information about how to view the roles assigned to a user, see View permission information. For more information about how to revoke roles, see Revoke roles from a user.

  • When a user is removed, their permissions are retained. If the user is added back to the project later, their previous permissions are automatically restored. To permanently clear a user's permissions, see Clear residual permissions of a removed user.

• Parameters

  Parameter	Required	Description
  account_id	Yes	The Alibaba Cloud account. Use the account ID if the Use Account ID tenant property is enabled; otherwise, use the login name. Examples: 5527xxxxxxxx5788 or odps_test_user@aliyun.com. Run the list users; command in the MaxCompute client to find the account identifier.

• Examples

  • Example 1: Remove the Alibaba Cloud account odps_test_user@aliyun.com (account ID: 5527xxxxxxxx5788) from the test_project_a project. This example assumes that no roles are assigned to the account.

    If Use Account ID is enabled

    remove user ALIYUN$5527xxxxxxxx5788;

    If Use Account ID is disabled

    remove user ALIYUN$odps_test_user@aliyun.com;

  • Example 2: Remove the Alibaba Cloud account odps_test_user@aliyun.com (account ID: 5527xxxxxxxx5788) from the test_project_a project. This example assumes the account has the Worker role.

    If Use Account ID is enabled

    -- Revoke the role from the user.
    revoke Worker from ALIYUN$5527xxxxxxxx5788;
    -- Remove the user.
    remove user ALIYUN$5527xxxxxxxx5788;

    If Use Account ID is disabled

    -- Revoke the role from the user.
    revoke Worker from ALIYUN$odps_test_user@aliyun.com;
    -- Remove the user.
    remove user ALIYUN$odps_test_user@aliyun.com;

Add a RAM user (project-level)

To grant authorization to a RAM user, the project owner must first add the user to the project.

• Syntax

  add user RAM$[<account_id>:]<RAM_user_UID>;

• Limitations

  • You can add only RAM users from your Alibaba Cloud account to a project. To add a RAM user from another Alibaba Cloud account, you must first add the Alibaba Cloud account that owns the RAM user to your project. Then, the owner of that account can sign in to the MaxCompute project and add the RAM user.

  • Before you add a RAM user to a MaxCompute project, verify that the project supports the RAM account system by running thelist accountproviders; command. IfRAM is not in the command output, run theadd accountprovider ram; command to enable the RAM account system for the project.

  • When a user is removed, their permissions are retained. If the user is added back to the project later, their previous permissions are automatically restored. To permanently clear a user's permissions, see Clear residual permissions of a removed user.

• Usage notes

  MaxCompute uses the RAM account system for identity but ignores the RAM permission system. Therefore, when an Alibaba Cloud account adds its RAM users to a MaxCompute project, MaxCompute does not apply the permissions that are defined for those users in RAM.

• Parameters

  Parameter	Required	Description
  account_id	No	The Alibaba Cloud account to which the RAM user belongs. If the Use Account ID tenant property is enabled, use the account ID. Otherwise, use the logon name. For example, odps_test_user@aliyun.com (account ID: 5527xxxxxxxx5788).
  RAM_user_UID	Yes	The UID of the RAM user. To obtain the UID, sign in to the RAM console. In the left-side navigation pane, choose Identities > Users and click the target user. You can find the UID in the Basic Information section.

• Example

  This example adds the RAM user RAM$odps_test_user@aliyun.com:ram_test(UID: 5527xxxxxxxx5788:2763xxxxxxxxxx1649) to the test_project_a project.

  If Use Account ID is enabled

  add user RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;

  If Use Account ID is disabled

  add user RAM$odps_test_user@aliyun.com:ram_test;

Remove a RAM user (project-level)

When a RAM user is no longer part of a MaxCompute project, remove the user from the project. Once removed, the user loses all permissions to access any resource within that project.

• Syntax

  remove user RAM$[<account_id>:]<ram_user_uid>;

• Usage notes

  • You must revoke any assigned roles before removing a RAM user. Otherwise, residual user information remains in the project. The user then appears as p4_xxxxxxxxxxxxxxxxxxxx and cannot be removed. However, this does not affect normal project operations. For more information about how to view the roles assigned to a user, see View permission information. For more information about how to revoke a role, see Revoke a role from a user.

  • When a user is removed, their permissions are retained. If the user is added back to the project later, their previous permissions are automatically restored. To permanently clear a user's permissions, see Clear residual permissions of a removed user.

• Parameters

  Parameter	Required	Description
  account_id	No	The Alibaba Cloud account to which the RAM user belongs. If the Use Account ID tenant property is enabled, use the account ID. Otherwise, use the logon name. For example, odps_test_user@aliyun.com (account ID: 5527xxxxxxxx5788).
  RAM_user_UID	Yes	The UID of the RAM user. To obtain the UID, sign in to the RAM console. In the left-side navigation pane, choose Identities > Users and click the target user. You can find the UID in the Basic Information section.

• Examples

  • Example 1: Remove the RAM user RAM$odps_test_user@aliyun.com:ram_test (UID: 5527xxxxxxxx5788:2763xxxxxxxxxx1649) from the test_project_a project. This example assumes the RAM user has no assigned roles.

    If Use account IDs is enabled

    remove user RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;

    If Use account IDs is disabled

    remove user RAM$odps_test_user@aliyun.com:ram_test;

  • Example 2: Remove the RAM user RAM$odps_test_user@aliyun.com:ram_test (UID: 5527xxxxxxxx5788:2763xxxxxxxxxx1649) from the test_project_a project. This example assumes the RAM user has the Worker role.

    If Use account IDs is enabled

    -- Revoke the role from the user.
    revoke Worker from RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;
    -- Remove the user.
    remove user RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;
    -- If RAM users are no longer needed, remove the RAM account provider.
    remove accountprovider ram;

    If Use account IDs is disabled

    -- Revoke the role from the user.
    revoke Worker from RAM$odps_test_user@aliyun.com:ram_test;
    -- Remove the user.
    remove user RAM$odps_test_user@aliyun.com:ram_test;
    -- If RAM users are no longer needed, remove the RAM account provider.
    remove accountprovider ram;

Add a RAM role (project-level)

You can create a RAM role and modify its policy in the RAM console, and then add it to a MaxCompute project. RAM users in the project can then assume this role to perform operations.

Unlike the roles described in Role planning, which are specific to a MaxCompute project, a RAM role is a platform-level identity managed in Resource Access Management (RAM). For more information about using RAM roles, see Assume a RAM role.

• Command format

  add user `RAM$<account_id>:role/<RAM role name>`;

• Usage notes

  The backticks (`) in the command are required.

• Parameters

  Parameter	Required	Description
  account_id	Yes	The Alibaba Cloud account that owns the RAM role. The value of this parameter depends on whether the Use account ID tenant property is enabled. If this property is enabled, provide the account ID. Otherwise, provide the login name. For example, odps_test_user@aliyun.com (account ID: 5527xxxxxxxx5788).
  RAM role name	Yes	The name of the RAM role. Log on to the RAM console. In the left-side navigation pane, choose Identities > Roles. The RAM role name is displayed on the Roles page.

• Example

  Add the RAM role ram_role to the test_project_a project:

  If Use account ID is enabled

  add user `RAM$5527xxxxxxxx5788:role/ram_role`;

  If Use account ID is disabled

  add user `RAM$odps_test_user@aliyun.com:role/ram_role`;

• Related operations

  If you plan to use this role for operations in DataWorks, you must also update its policy to grant permission to access the DataWorks service. This allows DataWorks to submit periodically scheduled jobs to MaxCompute.

Remove a RAM role (project-level)

Removes a RAM role from a MaxCompute project.

• Syntax

  remove user `RAM$<account_id>:role/<RAM_role_name>`;

• Usage notes

  The backticks (`) in the command are required.

• Parameters

  Parameter	Required	Description
  account_id	Yes	The Alibaba Cloud account that owns the RAM role. The value of this parameter depends on whether the Use account ID tenant property is enabled. If this property is enabled, provide the account ID. Otherwise, provide the login name. For example, odps_test_user@aliyun.com (account ID: 5527xxxxxxxx5788).
  RAM role name	Yes	The name of the RAM role. Log on to the RAM console. In the left-side navigation pane, choose Identities > Roles. The RAM role name is displayed on the Roles page.

• Example

  This example removes the RAM role ram_role from the test_project_a project.

  If Use account ID is enabled

  remove user `RAM$5527xxxxxxxx5788:role/ram_role`;

  If Use account ID is disabled

  remove user `RAM$odps_test_user@aliyun.com:role/ram_role`;

User list (project-level)

Lists the users in a MaxCompute project.

• Syntax

  list users;

• Example

  This command lists the users in a MaxCompute project.

  list users;

  The command returns the following output.

  When account IDs are enabled

  ALIYUN$5527xxxxxxxx5788
  RAM$5527xxxxxxxxxx1649
  RAM$5527xxxxxxxx5788:role/ram_role

  When account IDs are disabled

  ALIYUN$odps_test_user@aliyun.com
  RAM$odps_test_user@aliyun.com:ram_test
  RAM$odps_test_user@aliyun.com:role/ram_role

Next steps

After completing user planning, you can grant permissions: Manage user permissions using commands.