ResourceSchemas compatibles
Security Center proporciona ResourceSchemas integrados para tipos de recursos comunes, entre los que se incluyen: MaxCompute, EMR_ON_ECS_HIVE, SEVERLESS_STARROCKS, HOLOGRES, DATAWORKS_ENTITY, DLF_V1, DLF_NEXT y LINDORM.
Configuración del método de autorización
Cada campo authMethods en un ResourceSchema define los métodos de autorización que admite el tipo de recurso:
{ "authMethods": [ { "name": "default", "displayName": "Native Authorization", "isDefault": true } ] }
Convenciones:
Todos los ResourceSchemas integrados incluyen como mínimo el método de autorización
default.defaultrepresenta el método de autorización nativo del tipo de recurso. El sistema lo asigna a unPermissionGrantServiceespecífico según el valor dedefSchema.Si no especifica
authMethodo pasadefault, el sistema utiliza automáticamente el método de autorización nativo.
Asignaciones entre métodos de autorización y tipos de recurso:
|
Tipo de recurso |
Asignación predeterminada |
Otros métodos de autorización |
Descripción |
|
SEVERLESS_STARROCKS |
ranger |
starrocksManager |
SEVERLESS_STARROCKS es el único tipo de recurso que admite varios métodos de autorización. Ranger se usa de forma predeterminada y StarRocks Manager está disponible como alternativa. |
|
HOLOGRES |
hologres |
- |
Solo se admite la autorización nativa. |
|
DLF_V1 |
dlfV1 |
- |
Solo se admite la autorización de DLF 1.0. |
|
EMR_ON_ECS_HIVE |
ranger |
- |
Solo se admite la autorización mediante Ranger. |
|
LINDORM |
ranger |
- |
Solo se admite la autorización mediante Ranger. |
|
DATAWORKS_ENTITY |
default |
- |
Solo se admite la autorización predeterminada. |
|
MaxCompute |
default |
Autorización no compatible |
MaxCompute cuenta con un sistema de permisos independiente. |
|
DLF_NEXT |
default |
Autorización no compatible |
DLF 3.0 cuenta con un sistema de permisos independiente. |
A continuación se muestra la definición de cada ResourceSchema:
MaxCompute
{
"name": "MaxCompute",
"displayName": "MaxCompute Resource",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER",
"RAM_ROLE"
],
"authMethods": [],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "workspace",
"type": "string",
"label": "DATAWORKS_WORKSPACE_ID",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [
"workspaceId",
"workspaceName",
"ownerBaseId"
],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "project",
"type": "string",
"label": "PROJECT",
"parent": "workspace",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 3,
"name": "schema",
"type": "string",
"label": "SCHEMA",
"parent": "project",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 4,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "schema",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": true,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"update",
"download",
"describe",
"alter",
"drop"
]
},
{
"level": 4,
"name": "resource",
"type": "string",
"label": "RESOURCE",
"parent": "schema",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"read",
"write",
"delete",
"all"
]
},
{
"level": 4,
"name": "udf",
"type": "string",
"label": "UDF",
"parent": "schema",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"read",
"write",
"delete",
"execute",
"all"
]
},
{
"level": 5,
"name": "column",
"type": "string",
"label": "COLUMN",
"parent": "table",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"update",
"download"
]
}
]
}
hive
{
"name": "EMR_ON_ECS_HIVE",
"displayName": "Emr On Ecs Hive Resource",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER"
],
"authMethods": [],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "instance",
"type": "string",
"label": "INSTANCE_ID",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [
"workspaceId",
"workspaceName",
"ownerBaseId"
],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "database",
"type": "string",
"label": "DATABASE",
"parent": "instance",
"mandatory": true,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"create",
"update",
"alter",
"select"
]
},
{
"level": 3,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "database",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"drop",
"update",
"alter",
"all"
]
}
]
}
starrocks
{ "name": "SEVERLESS_STARROCKS", "displayName": "Serverless Starrocks Resource", "version": "v1.0.0", "authPrincipal": [ "RAM_USER", "RAM_ROLE" ], "authMethods": [ { "name": "ranger", "displayName": "Ranger", "isDefault": true }, { "name": "starrocksManager", "displayName": "StarRocks Manager", "isDefault": false } ], "resources": [ { "level": 0, "name": "tenant", "type": "string", "label": "DATAWORKS_TENANT_ID", "parent": "", "mandatory": false, "extendedInfo": {}, "recursiveSupported": false, "enricherFields": [], "isValidLeaf": false, "accessTypeRestrictions": [] }, { "level": 1, "name": "instance", "type": "string", "label": "INSTANCE_ID", "parent": "tenant", "mandatory": true, "extendedInfo": {}, "enricherFields": [], "isValidLeaf": false, "accessTypeRestrictions": [] }, { "level": 2, "name": "internalCatalog", "type": "string", "label": "INTERNAL_CATALOG", "parent": "instance", "mandatory": false, "extendedInfo": {}, "enricherFields": [], "isValidLeaf": true, "accessTypeRestrictions": [], "authMethodAccessTypes": [ { "authMethod": "starrocksManager", "accessTypes": ["all", "usage", "create database", "drop", "alter"] } ] }, { "level": 2, "name": "hiveCatalog", "type": "string", "label": "EXTERNAL_HIVE_CATALOG", "parent": "instance", "mandatory": false, "extendedInfo": {}, "enricherFields": [], "isValidLeaf": true, "accessTypeRestrictions": [], "authMethodAccessTypes": [ { "authMethod": "starrocksManager", "accessTypes": ["all", "usage", "create database", "drop", "alter"] } ] }, { "level": 3, "name": "database", "type": "string", "label": "DATABASE", "parent": "internalCatalog", "mandatory": false, "extendedInfo": {}, "recursiveSupported": true, "enricherFields": [], "isValidLeaf": true, "accessTypeRestrictions": [ "create table", "drop", "alter", "create view", "create function", "create materialized view" ], "authMethodAccessTypes": [ { "authMethod": "starrocksManager", "accessTypes": ["all", "alter", "drop", "create table", "create view", "create function", "create materialized view", "create pipe"] }, { "authMethod": "ranger", "accessTypes": ["create table", "drop", "alter", "create view", "create function", "create materialized view"] } ] }, { "level": 3, "name": "hiveDatabase", "type": "string", "label": "EXTERNAL_HIVE_DATABASE", "parent": "hiveCatalog", "mandatory": false, "extendedInfo": {}, "recursiveSupported": true, "enricherFields": [], "isValidLeaf": true, "accessTypeRestrictions": [ "create", "update", "alter", "select" ], "authMethodAccessTypes": [ { "authMethod": "starrocksManager", "accessTypes": ["all", "alter", "drop", "create table", "create view", "create function", "create materialized view", "create pipe"] }, { "authMethod": "ranger", "accessTypes": ["create", "update", "alter", "select"] } ] }, { "level": 4, "name": "table", "type": "string", "label": "TABLE", "parent": "database", "mandatory": false, "extendedInfo": { "constraints": { "enabled": true, "supportedTypes": ["rowFilter"], "maxConstraints": 1, "definitions": { "rowFilter": { "description": "Row-level filter condition, SQL WHERE clause", "type": "string", "required": false, "example": "ID > 3 AND Name = 'test'", "authMethods": ["ranger"], "restrictedAccessTypes": ["select"] } } } }, "recursiveSupported": false, "enricherFields": [], "isValidLeaf": true, "accessTypeRestrictions": [ "delete", "drop", "insert", "select", "alter", "export", "update" ], "authMethodAccessTypes": [ { "authMethod": "starrocksManager", "accessTypes": ["all", "alter", "drop", "select", "insert", "update", "export", "delete"] }, { "authMethod": "ranger", "accessTypes": ["delete", "drop", "insert", "select", "alter", "export", "update"] } ] }, { "level": 4, "name": "view", "type": "string", "label": "VIEW", "parent": "database", "mandatory": false, "extendedInfo": {}, "recursiveSupported": false, "enricherFields": [], "isValidLeaf": true, "accessTypeRestrictions": [], "authMethodAccessTypes": [ { "authMethod": "starrocksManager", "accessTypes": ["all", "select", "alter", "drop"] } ] }, { "level": 4, "name": "materializedView", "type": "string", "label": "MATERIALIZED_VIEW", "parent": "database", "mandatory": false, "extendedInfo": {}, "recursiveSupported": false, "enricherFields": [], "isValidLeaf": true, "accessTypeRestrictions": [], "authMethodAccessTypes": [ { "authMethod": "starrocksManager", "accessTypes": ["all", "select", "alter", "refresh", "drop"] } ] }, { "level": 4, "name": "hiveTable", "type": "string", "label": "EXTERNAL_HIVE_TABLE", "parent": "hiveDatabase", "mandatory": false, "extendedInfo": {}, "recursiveSupported": false, "enricherFields": [], "isValidLeaf": true, "accessTypeRestrictions": [ "select" ], "authMethodAccessTypes": [ { "authMethod": "starrocksManager", "accessTypes": ["all", "alter", "drop", "select", "insert", "update", "export", "delete"] }, { "authMethod": "ranger", "accessTypes": ["select"] } ] }, { "level": 4, "name": "hiveView", "type": "string", "label": "EXTERNAL_HIVE_VIEW", "parent": "hiveDatabase", "mandatory": false, "extendedInfo": {}, "recursiveSupported": false, "enricherFields": [], "isValidLeaf": true, "accessTypeRestrictions": [], "authMethodAccessTypes": [ { "authMethod": "starrocksManager", "accessTypes": ["all", "select", "alter", "drop"] } ] }, { "level": 4, "name": "hiveMaterializedView", "type": "string", "label": "EXTERNAL_HIVE_MATERIALIZED_VIEW", "parent": "hiveDatabase", "mandatory": false, "extendedInfo": {}, "recursiveSupported": false, "enricherFields": [], "isValidLeaf": true, "accessTypeRestrictions": [], "authMethodAccessTypes": [ { "authMethod": "starrocksManager", "accessTypes": ["all", "select", "alter", "refresh", "drop"] } ] } ] }
Diferencias entre los métodos de autorización de StarRocks:
|
Nivel de recurso |
ranger (predeterminado) |
starrocksManager |
Descripción |
|
internalCatalog |
❌ No compatible |
✅ Compatible |
No es un nodo hoja en Ranger |
|
database |
✅ Compatible |
✅ Compatible |
El accessType difiere |
|
table |
✅ Compatible |
✅ Compatible |
Ranger admite restricciones rowFilter |
|
view |
❌ No compatible |
✅ Compatible |
Solo compatible con StarRocks Manager |
|
materializedView |
❌ No compatible |
✅ Compatible |
Solo compatible con StarRocks Manager |
|
hiveCatalog |
❌ No compatible |
✅ Compatible |
No es un nodo hoja en Ranger |
|
hiveDatabase |
✅ Compatible |
✅ Compatible |
El accessType difiere |
|
hiveTable |
✅ Compatible (solo select) |
✅ Compatible |
Ranger solo admite select |
|
hiveView |
❌ No compatible |
✅ Compatible |
Solo compatible con StarRocks Manager |
|
hiveMaterializedView |
❌ No compatible |
✅ Compatible |
Solo compatible con StarRocks Manager |
Compatibilidad con restricciones:
|
Nivel de recurso |
Tipo de restricción |
Métodos de autorización compatibles |
Restricciones de accessType |
Descripción |
|
table |
rowFilter |
ranger |
|
Condición de filtro de nivel de fila, cláusula WHERE de SQL. Cuando se declara rowFilter, solo se permite |
hologres
{
"name": "HOLOGRES",
"displayName": "Hologres Resource",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER"
],
"authMethods": [
{
"name": "hologres",
"displayName": "Hologres",
"isDefault": true
}
],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"enricherFields": [],
"recursiveSupported": false,
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "instance",
"type": "string",
"label": "INSTANCE_ID",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "database",
"type": "string",
"label": "DATABASE",
"parent": "instance",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 3,
"name": "schema",
"type": "string",
"label": "SCHEMA",
"parent": "database",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 4,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "schema",
"mandatory": true,
"extendedInfo": {},
"recursiveSupported": true,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"insert",
"update",
"delete",
"truncate",
"all"
]
},
{
"level": 5,
"name": "column",
"type": "string",
"label": "COLUMN",
"parent": "table",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"insert",
"update"
]
}
]
}
Permisos de nivel de columna en Hologres:
|
Elemento de configuración |
Descripción |
|
|
Admite el método de autorización |
|
Sub-recurso |
Sub-recurso de nivel 5 bajo table. Especifique un nombre de columna con el campo |
|
Tipos de acceso para permisos de columna |
Solo se admiten |
dlf-legacy
{
"name": "DLF_V1",
"displayName": "Dlf 1.0 Resource",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER",
"RAM_ROLE"
],
"authMethods": [],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"enricherFields": [],
"recursiveSupported": false,
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "catalog",
"type": "string",
"label": "CATALOG",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "database",
"type": "string",
"label": "DATABASE",
"parent": "catalog",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"describe",
"alter",
"drop",
"createTable",
"createFunction",
"list"
]
},
{
"level": 3,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "database",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": true,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"update",
"describe",
"alter",
"drop"
]
},
{
"level": 4,
"name": "column",
"type": "string",
"label": "COLUMN",
"parent": "table",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select"
]
}
]
}
dlfNext
{
"name": "DLF_NEXT",
"displayName": "Dlf Next Resource",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER",
"RAM_ROLE",
"DLF_ROLE"
],
"authMethods": [],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"enricherFields": [],
"recursiveSupported": false,
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "catalog",
"type": "string",
"label": "CATALOG",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "database",
"type": "string",
"label": "DATABASE",
"parent": "catalog",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"describe",
"list",
"alter",
"drop",
"createTable",
"createFunction",
"createView",
"grant",
"all"
]
},
{
"level": 3,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "database",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": true,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"update",
"alter",
"drop",
"grant",
"all"
]
},
{
"level": 4,
"name": "column",
"type": "string",
"label": "COLUMN",
"parent": "table",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select"
]
}
]
}
DATAWORKS_ENTITY
{
"name": "DATAWORKS_ENTITY",
"displayName": "Dataworks Entity",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER",
"RAM_ROLE",
"DATAWORKS_WORKSPACE_ROLE",
"DATAWORKS_WORKSPACE_MEMBER"
],
"authMethods": [],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"enricherFields": [],
"recursiveSupported": false,
"isValidLeaf": false,
"accessTypeRestrictions": []
},{
"level": 1,
"name": "tenantRole",
"type": "string",
"label": "DATAWORKS_TENANT_ROLE_CODE",
"parent": "tenant",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [
"roleName"
],
"isValidLeaf": true,
"accessTypeRestrictions": [
"joinIn"
],
"authPrincipalRestrictions": [
"RAM_USER",
"RAM_ROLE"
]
},
{
"level": 1,
"name": "workspace",
"type": "string",
"label": "DATAWORKS_WORKSPACE_ID",
"parent": "tenant",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [
"workspaceId",
"workspaceName",
"ownerBaseId"
],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "workspaceRole",
"type": "string",
"label": "DATAWORKS_WORKSPACE_ROLE_CODE",
"parent": "workspace",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"joinIn"
],
"authPrincipalRestrictions": [
"RAM_USER",
"RAM_ROLE"
]
}
]
}
Lindorm
{
"name": "LINDORM",
"displayName": "Lindorm",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER"
],
"authMethods": [],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "instance",
"type": "string",
"label": "INSTANCE_ID",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [
"instanceName"
],
"isValidLeaf": false,
"accessTypeRestrictions": [
"write",
"read",
"admin",
"trash",
"system",
"all"
]
},
{
"level": 2,
"name": "database",
"type": "string",
"label": "DATABASE",
"parent": "instance",
"mandatory": true,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": [
"write",
"read",
"admin",
"trash",
"system",
"all"
]
},
{
"level": 3,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "database",
"mandatory": true,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"write",
"read",
"admin",
"trash",
"all"
]
}
]
}