AliyunServiceRolePolicyForMaxComputeLakehouse is the authorization policy dedicated to a service-linked role. The policy is automatically attached to a service role when the service role is created. Then, the service-linked role is authorized to access other cloud services. This policy is updated by the relevant Alibaba Cloud service. Do not attach this policy to a RAM identity other than a service-linked role.
Policy details
Type: service system policy
Creation time: 18:22:48 on September 03, 2024
Update time: 02:30:35 on July 22, 2025
Current version: v3
Policy content
{
"Version": "1",
"Statement": [
{
"Action": [
"dlf:BatchCreatePartitions",
"dlf:BatchCreateTables",
"dlf:BatchDeletePartitions",
"dlf:BatchDeleteTables",
"dlf:BatchGetPartitions",
"dlf:BatchGetTables",
"dlf:BatchUpdatePartitions",
"dlf:BatchUpdateTables",
"dlf:CreateCatalog",
"dlf:CreateDatabase",
"dlf:CreateFunction",
"dlf:CreatePartition",
"dlf:CreateTable",
"dlf:DeleteCatalog",
"dlf:DeleteDatabase",
"dlf:DeleteFunction",
"dlf:DeletePartition",
"dlf:DeleteTable",
"dlf:GetAsyncTaskStatus",
"dlf:GetCatalog",
"dlf:GetCatalogAccessInfo",
"dlf:GetCatalogByInstanceId",
"dlf:GetCatalogSettings",
"dlf:GetDatabase",
"dlf:GetFunction",
"dlf:GetPartition",
"dlf:GetTable",
"dlf:ListCatalogs",
"dlf:ListDatabases",
"dlf:ListFunctionNames",
"dlf:ListFunctions",
"dlf:ListPartitionNames",
"dlf:ListPartitions",
"dlf:ListPartitionsByExpr",
"dlf:ListPartitionsByFilter",
"dlf:ListTableNames",
"dlf:ListTables",
"dlf:RenamePartition",
"dlf:RenameTable",
"dlf:UpdateCatalog",
"dlf:UpdateDatabase",
"dlf:UpdateFunction",
"dlf:UpdateTable",
"dlf:BatchGetPartitionColumnStatistics",
"dlf:DeletePartitionColumnStatistics",
"dlf:DeleteTableColumnStatistics",
"dlf:GetPartitionColumnStatistics",
"dlf:GetTableColumnStatistics",
"dlf:UpdateTableColumnStatistics",
"dlf:UpdatePartitionColumnStatistics",
"dlf:CreateLock",
"dlf:UnLock",
"dlf:AbortLock",
"dlf:RefreshLock",
"dlf:GetLock",
"dlf:GetConfig",
"dlf:DropDatabase",
"dlf:AlterDatabase",
"dlf:DropTable",
"dlf:AlterTable",
"dlf:ListTableDetails",
"dlf:CommitTable",
"dlf:GetTableToken",
"dlf:GetTableSnapshot",
"dlf:RollbackTable",
"dlf:MarkDonePartitions",
"dlf:ListBranches",
"dlf:CreateBranch",
"dlf:DropBranch",
"dlf:ForwardBranch",
"dlf:ListViews",
"dlf:CreateView",
"dlf:ListViewDetails",
"dlf:GetView",
"dlf:DropView",
"dlf:RenameView"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:DeleteServiceLinkedRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ram:ServiceName": "lakehouse.odps.aliyuncs.com"
}
}
},
{
"Action": "dlf-auth:ActOnBehalfOfAnotherUser",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"dlf:GetCatalogAccessInfo",
"dlf:GetDataToken",
"dlf:GetDataTokenByName"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"dlf:GrantPermissions",
"dlf:RevokePermissions",
"dlf:BatchGrantPermissions",
"dlf:BatchRevokePermissions",
"dlf:UpdatePermissions",
"dlf:ListPermissions"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"dlf:CreateRole",
"dlf:UpdateRole",
"dlf:DeleteRole",
"dlf:GetRole",
"dlf:ListRoles",
"dlf:GrantRolesToUser",
"dlf:RevokeRolesFromUser",
"dlf:GrantRoleToUsers",
"dlf:RevokeRoleFromUsers",
"dlf:UpdateRoleUsers",
"dlf:ListRoleUsers",
"dlf:ListUserRoles",
"dlf:GrantRolesToPrincipal",
"dlf:RevokeRolesFromPrincipal",
"dlf:GrantRoleToPrincipals",
"dlf:RevokeRoleFromPrincipals",
"dlf:UpdateRolePrincipals",
"dlf:BatchDeleteRoles"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "dlf:CheckPermissions",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"dlf:GetCatalogStorageStatistics",
"dlf:GetCatalogStorageIndicatorDetails",
"dlf:GetCatalogStorageRank",
"dlf:GetCatalogStorageAnalysis",
"dlf:GetDatabaseProfile",
"dlf:GetDatabaseStorageAnalysis",
"dlf:GetTableProfile",
"dlf:GetTableStorageAnalysis",
"dlf:ListPartitionProfiles",
"dlf:getLatestStorageStatisticsDate"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"dlf:SubscribeOptimize",
"dlf:GetOptimizeRegionStatus",
"dlf:GetOptimizeWorkspaceAuthorization",
"dlf:AddOptimizeWorkspace",
"dlf:ListOptimizeWorkspaces",
"dlf:PreCheckOptimizeWorkspaceConnection",
"dlf:CheckOptimizeWorkspaceConnection",
"dlf:DeleteOptimizeWorkspace",
"dlf:SetOptimizeEnable",
"dlf:SetOptimizePolicy",
"dlf:GetOptimizePolicy",
"dlf:AddOptimizeScheduleRule",
"dlf:ListOptimizeScheduleRules",
"dlf:DeleteOptimizeScheduleRule",
"dlf:RunOptimizeImmediately",
"dlf:GetOptimizeInfo",
"dlf:UpdateOptimizeTaskResult"
],
"Resource": "*",
"Effect": "Allow"
}
]
}