Authorize a custom role to write data to MaxCompute (same account for delivery) - Simple Log Service

In the new version of data shipping job, data from a logstore must be written to a MaxCompute table. You can authorize the job to assume a custom RAM role for this. This guide explains how to authorize the custom RAM role when both the MaxCompute project and Simple Log Service project belong to the same Alibaba Cloud account.

Prerequisites

If you use a Resource Access Management (RAM) user, make sure that the RAM user has permissions to manage RAM roles.
A MaxCompute project is added to the required DataWorks workspace as the data source. For more information, see Add a MaxCompute data source.

Procedure

After you authorize a RAM role to write data to MaxCompute, a MaxCompute data shipping job can assume the RAM role to write the data of a logstore to a MaxCompute table. To complete the authorization, you must add the RAM role as a workspace member.

Create a RAM role, such as MaxComputeShipRole.
Important
- When creating a RAM role, set Principal Type to Cloud Service, and Principal Name to Simple Log Service.
- Check the trust policy of the RAM role. Make sure that the Service element contains at least "log.aliyuncs.com".
```
{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "log.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}
```

Modify the trust policy of a RAM role.

Replace the original trust policy with the following content.

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "log.aliyuncs.com",
          "dataworks.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}

Add the RAM role as a workspace member.
1. Log on to the DataWorks console.
2. In the upper-left corner of the page that appears, select a region.
3. In the left-side navigation pane, click Workspace. On the Workspaces page, click Manage in the Actions column of the target workspace.
4. On the Workspace Settings page, click Workspace Members and Roles, then click Add Members.
5. In the Add Members dialog box, select the current logon account and the target RAM role, and follow the page instructions to complete the addition.
  In this step, set Batch Set Roles to Deploy. For more information, see Grant permissions to a RAM user.
6. Grant the RAM role the permissions to manage a MaxCompute table.
  1. Log on to the MaxCompute console and select a region in the upper-left corner.
  2. Choose Workspace > Projects. On the Projects page, click Manage in the Actions column of the target project.
  3. On the MaxCompute project settings page, click Role Permissions.
    If the following error occurs, you need to add the current logon RAM account to the target MaxCompute project under the Alibaba Cloud account. First, click Manage Members for the admin role in the role list. Then, in the Manage Members dialog box, select the current logon RAM account and follow the page instructions to complete the addition.
  4. In the role list, click Manage Members corresponding to the role_project_admin role.
  5. In the Member Management dialog box, select the current logon account and the target RAM role account, such as MaxComputeShipRole, and add them as prompted.
  6. In the role list, click Edit Role for the role_project_admin role.
  7. On the Table tab of the Edit Role dialog box, select the target MaxCompute table, and select Describe, Alter, and Update.
Important
The preceding authorization procedure applies only to the specified MaxCompute table. If you want to authorize a RAM role to manage all tables in the current MaxCompute project, grant the permissions of the admin role to the current logon account and the RAM role. In the role list, click Manage Members for the admin role. Then, in the Manage Members dialog box, select the current logon account and the RAM role, and follow the page instructions to complete the addition.
Create a MaxCompute data shipping job.
When you create a data shipping job of the new version, set Authorization of MaxCompute Write Permission to Custom Role, then enter the Alibaba Cloud Resource Name (ARN) of the custom RAM role, such as acs:ram::10**12:role/maxcomputeshiprole. This authorizes the job to assume the custom RAM role to ship data to the MaxCompute table. For more information, see Create a data shipping job of the new version to ship data to MaxCompute.

Simple Log Service:Authorize a custom RAM role to write data to MaxCompute (ship data within an Alibaba Cloud account)

Prerequisites

Procedure

FAQs