Simple Log Service:Authorize the default role for MaxCompute (same-account shipping)

Procedure

If your Simple Log Service and MaxCompute projects are in the same Alibaba Cloud account, first click Cloud Resource Access Authorization to create the AliyunLogDefaultRole role. Then, add it to the MaxCompute workspace as a member.

1. Modify the trust policy of the RAM role. For more information, see Modify the trust policy of a RAM role.

   Replace the existing trust policy with the following content.

   {
     "Statement": [
       {
         "Action": "sts:AssumeRole",
         "Effect": "Allow",
         "Principal": {
           "Service": [
             "log.aliyuncs.com",
             "dataworks.aliyuncs.com"
           ]
         }
       }
     ],
     "Version": "1"
   }

2. Add the RAM role as a workspace member.

   1. Log on to the DataWorks console.

   2. In the upper-left corner of the page, select a region.

   3. In the left-side navigation pane, click Workspace.

   4. On the Workspaces page, find the target workspace and click Manage in the Actions column.

   5. On the Workspace Settings page, click Workspace Members and Roles. On the Workspace Members tab, click Add Members.

   6. In the Add Members dialog box, select the current account and the AliyunLogDefaultRole role. Follow the on-screen instructions to complete the process.

      In the Batch Set Roles section, select Developer. For more information, see Grant permissions to other users.

   7. Grant permissions to AliyunLogDefaultRole to operate on MaxCompute tables.

      1. Log on to the MaxCompute console and select a region in the upper-left corner.

      2. In the left-side navigation pane, choose Workspace > Project Management. On the Project Management page, click Manage in the Actions column of the target project.

      3. On the MaxCompute project management page, click Role Permissions.

         If an error occurs, use your Alibaba Cloud account to add the current RAM user to the MaxCompute project. Find the admin role in the role list and click Manage Members. In the Manage Members dialog box, select the current RAM user and follow the on-screen instructions to add the user.

      4. In the role list, find the role_project_admin role and click Manage Members.

      5. In the Manage Members dialog box, select your Alibaba Cloud account and the AliyunLogDefaultRole role, then follow the prompts to add them.

      6. In the role list, find the role_project_admin role and click Edit Role.

      7. In the Edit Role dialog box, on the Table tab, select the target MaxCompute table and grant the Describe, Alter, and Update permissions.

      Important

      The permissions granted in the previous steps apply only to the specified MaxCompute table. To grant the role access to all tables in the current MaxCompute project, add your Alibaba Cloud account and the AliyunLogDefaultRole role to the admin role. Find the admin role in the role list and click Manage Members. In the Manage Members dialog box, select your Alibaba Cloud account and the AliyunLogDefaultRole role, and then follow the prompts to add them.

3. Create a MaxCompute data shipping job.

   After the authorization is complete, create a MaxCompute data shipping job (new version). For Write Permissions on MaxCompute, select Default Role. The job assumes the AliyunLogDefaultRole role to ship data to the MaxCompute table. For more information, see Create a MaxCompute data shipping job (new version).

FAQs

• How to check data completeness after shipping data to MaxCompute

• Troubleshoot common issues in MaxCompute data shipping jobs (new version)