E-MapReduce:Groupes de ressources pour un contrôle fin

Autorisation par groupe de resources

Les groupes de resources vous permettent de regrouper et de gérer les resources au sein de votre compte Alibaba Cloud. Par exemple, vous pouvez créer un groupe de resources pour chaque projet et y déplacer les resources correspondantes pour une gestion centralisée. Pour en savoir plus, consultez la rubrique Présentation des groupes de resources.

Une fois vos resources regroupées, vous pouvez accorder des permissions au niveau du groupe de resources aux entités RAM, telles que les utilisateurs RAM, les groupes d'utilisateurs RAM ou les rôles RAM. Cela garantit qu'une entité ne peut gérer que les resources contenues dans ce groupe de resources spécifique. Pour plus de détails, voir Regroupement des resources et autorisation.

Cette méthode d'autorisation offre les avantages suivants :

• Permissions fines : chaque identité reçoit exactement les permissions nécessaires pour accéder aux resources. Cela évite de mélanger les resources de différents projets au sein d'un même compte.

• Évolutivité : lorsque vous ajoutez de nouvelles resources, il suffit de les inclure dans le groupe de resources. L'identité RAM hérite automatiquement des permissions pour ces nouvelles resources.

Accorder des permissions au niveau du groupe de resources

Cette rubrique décrit comment accorder à un RAM user les permissions nécessaires pour gérer les resources E-MapReduce au sein d'un groupe de resources spécifique.

Types de resource prenant en charge les groupes de resources

Le tableau suivant répertorie les types de resource dans E-MapReduce qui prennent en charge les groupes de resources :

Opérations sans autorisation au niveau du groupe de ressources

E-MapReduce ne prend pas en charge les autorisations au niveau du groupe de ressources pour les actions suivantes :

Pour les opérations qui ne prennent pas en charge l'autorisation au niveau du groupe de ressources, la définition de l'étendue de la resource sur resource group level n'aura aucun effet. Si un utilisateur RAM nécessite ces permissions, vous devez créer une politique personnalisée et définir l'étendue de la resource sur account level.

Voici deux exemples de politiques personnalisées. Ajustez le contenu selon vos besoins.

• Autorise toutes les opérations en lecture seule qui ne prennent pas en charge l'autorisation au niveau du groupe de ressources. L'élément Action répertorie ces opérations.

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "emr:GetApiTemplate",
          "emr:GetApplicationActions",
          "emr:GetAuditLogs",
          "emr:GetBackPlanInfo",
          "emr:GetBackupInfo",
          "emr:GetBackupRuleInfo",
          "emr:GetClusterCost",
          "emr:GetCostUploadSignature",
          "emr:GetDisasterRecoveryPlan",
          "emr:GetDoctorComputeSummary",
          "emr:GetDoctorHBaseRegion",
          "emr:GetDoctorHBaseRegionServer",
          "emr:GetDoctorHBaseTable",
          "emr:GetDoctorHDFSCluster",
          "emr:GetDoctorHDFSDirectory",
          "emr:GetFlowAgentTrackStatus",
          "emr:GetFlowAuditLogs",
          "emr:GetFlowEntityRelationGraph",
          "emr:GetMetadataTypeList",
          "emr:GetOverview",
          "emr:GetPriceForCreate",
          "emr:GetPriceForCreateOnKubeCluster",
          "emr:GetReleaseVersion",
          "emr:GetSlsTempToken",
          "emr:GetSupportApplications",
          "emr:ListAdviceAction",
          "emr:ListAlertContacts",
          "emr:ListApmMetadata",
          "emr:ListApplicationConfigVersions",
          "emr:ListBackupPlans",
          "emr:ListBackupRules",
          "emr:ListBackups",
          "emr:ListClusterAttach",
          "emr:ListClusterBootstrapActions",
          "emr:ListClusterCosts",
          "emr:ListClusterForAdmin",
          "emr:ListClusterForOuter",
          "emr:ListClusterHostComponentForAdmin",
          "emr:ListClusterOperationHostTask",
          "emr:ListClusterServiceConfigHistoryForAdmin",
          "emr:ListClusterTag",
          "emr:ListClusterTagForAdmin",
          "emr:ListClusterTypes",
          "emr:ListComponentDefaultTopologies",
          "emr:ListDependApplications",
          "emr:ListDisasterRecoveryPlans",
          "emr:ListDisasterRecoveryRecords",
          "emr:ListDiskOpsEvents",
          "emr:ListDoctorComputeSummary",
          "emr:ListDoctorHBaseRegionServers",
          "emr:ListDoctorHBaseTables",
          "emr:ListDoctorJobsStats",
          "emr:ListEcsInstances",
          "emr:ListEmrAvailableConfig",
          "emr:ListEmrAvailableMetaType",
          "emr:ListEmrAvailableResource",
          "emr:ListEmrMainVersion",
          "emr:ListEmrMainVersionServiceGroup",
          "emr:ListEmrMainVersions",
          "emr:ListExecutePlanMigrateInfo",
          "emr:ListExecutionPlanInstanceTrend",
          "emr:ListFailureJobExecutionInstances",
          "emr:ListFeatures",
          "emr:ListFlowClusterAllHosts",
          "emr:ListFlowClusterK8sNamespace",
          "emr:ListFlowEntitySnapshot",
          "emr:ListFlowProjectClusterSetting",
          "emr:ListFlowProjectUser",
          "emr:ListGlobalConfigs",
          "emr:ListHealthRule",
          "emr:ListJobExecutionInstanceTrend",
          "emr:ListJobExecutionInstances",
          "emr:ListJobExecutionPlanHierarchy",
          "emr:ListJobInstanceWorkers",
          "emr:ListJobMigrateInfo",
          "emr:ListKMSKeys",
          "emr:ListKafkaReassign",
          "emr:ListKafkaReassignForAdmin",
          "emr:ListKafkaReassignTopic",
          "emr:ListKafkaTopicStatistics",
          "emr:ListKafkaTopicStatisticsForAdmin",
          "emr:ListKeyPairNames",
          "emr:ListLibraries",
          "emr:ListLibraryInstallTasks",
          "emr:ListLibraryStatus",
          "emr:ListLocalDiskComponentInfo",
          "emr:ListMetaCluster",
          "emr:ListMetaDataSourceForOuter",
          "emr:ListMetaDatabaseForOuter",
          "emr:ListMetaTableColumnForOuter",
          "emr:ListMetaTableForOuter",
          "emr:ListMetaTablePartitionForOuter",
          "emr:ListMetastoreTypes",
          "emr:ListMetricsToDisplay",
          "emr:ListNodeGroupSpecs",
          "emr:ListNotes",
          "emr:ListOperation",
          "emr:ListOperationActivity",
          "emr:ListOperationStageInstanceRelation",
          "emr:ListOperationTask",
          "emr:ListPrivateZones",
          "emr:ListRamRole",
          "emr:ListRamUsers",
          "emr:ListRdsDatabase",
          "emr:ListRdsInstance",
          "emr:ListRegions",
          "emr:ListReleaseVersions",
          "emr:ListResourcePoolForAdmin",
          "emr:ListScalingActivity",
          "emr:ListScalingActivityV2",
          "emr:ListScalingConfigItemV2",
          "emr:ListScalingGroupV2",
          "emr:ListSecurityGroups",
          "emr:ListServiceComponentTopology",
          "emr:ListSlsProject",
          "emr:ListStack",
          "emr:ListStackService",
          "emr:ListStreamingSqlQuery",
          "emr:ListSupportedServiceName",
          "emr:ListTagKeys",
          "emr:ListTagValues",
          "emr:ListUserStatistics",
          "emr:ListVpcInfo",
          "emr:ListVswitch",
          "emr:QueryGrafanaData",
          "emr:QueryInfoByToken",
          "emr:QueryLogKey",
          "emr:QueryPrice",
          "emr:QuerySlsMetricData",
          "emr:QueryTableData",
          "emr:QueryTrendData",
          "emr:QueryUserById"
        ],
        "Resource": "*"
      }
    ]
  }
  

• Autorise toutes les opérations qui ne prennent pas en charge l'autorisation au niveau du groupe de ressources. L'élément Action répertorie ces opérations.

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "emr:AttachCluster",
          "emr:AttachClusterForNote",
          "emr:AuthRealName",
          "emr:BindPrivateZoneVpc",
          "emr:CheckAssumeRole",
          "emr:CheckDLFCatalogAuth",
          "emr:CheckProductActiveStatus",
          "emr:CheckRenewClusterForAdmin",
          "emr:CheckUserBalance",
          "emr:CheckUserRole",
          "emr:CleanupFlowEntitySnapshot",
          "emr:CommitFlowEntitySnapshot",
          "emr:CommonApiWhiteList",
          "emr:CreateAlertContact",
          "emr:CreateAlertDingDingGroup",
          "emr:CreateAlertUserGroup",
          "emr:CreateBackup",
          "emr:CreateBackupPlan",
          "emr:CreateBackupRule",
          "emr:CreateCloudNativeCluster",
          "emr:CreateClusterBootstrapAction",
          "emr:CreateClusterCost",
          "emr:CreateClusterEni",
          "emr:CreateClusterTemplate",
          "emr:CreateClusterV3",
          "emr:CreateClusterWithTemplate",
          "emr:CreateClusterWithTemplateForInternal",
          "emr:CreateDisasterRecoveryPlan",
          "emr:CreateExternalUsers",
          "emr:CreateFlowProject",
          "emr:CreateFlowProjectClusterSetting",
          "emr:CreateJob",
          "emr:CreateJobExecutionPlanFolder",
          "emr:CreateLibrary",
          "emr:CreateMetaTablePreviewTask",
          "emr:CreateMetaTablePreviewTaskForOuter",
          "emr:CreateNote",
          "emr:CreateOnKubeCluster",
          "emr:CreateParagraph",
          "emr:CreateScalingGroupV2",
          "emr:CreateUserPassword",
          "emr:CreateUserStatistics",
          "emr:CreateVerificationCode",
          "emr:DeleteAlertContacts",
          "emr:DeleteAlertDingDingGroups",
          "emr:DeleteAlertUserGroups",
          "emr:DeleteApiTemplate",
          "emr:DeleteApplication",
          "emr:DeleteClusterBootstrapAction",
          "emr:DeleteClusterScript",
          "emr:DeleteClusterTemplate",
          "emr:DeleteDiagnoseReport",
          "emr:DeleteDisasterRecoveryPlan",
          "emr:DeleteExecutionPlan",
          "emr:DeleteFlowEditLock",
          "emr:DeleteFlowProject",
          "emr:DeleteFlowProjectById",
          "emr:DeleteFlowProjectClusterSetting",
          "emr:DeleteFlowProjectUser",
          "emr:DeleteJob",
          "emr:DeleteJobExecutionPlanFolder",
          "emr:DeleteJobExecutionPlanParam",
          "emr:DeleteLibraries",
          "emr:DeleteNote",
          "emr:DeleteParagraph",
          "emr:DeleteScalingRule",
          "emr:DeleteScalingTaskGroup",
          "emr:DeleteUsers",
          "emr:DescribeAvailableInstanceType",
          "emr:DescribeClusterForInternal",
          "emr:DescribeClusterForOuter",
          "emr:DescribeClusterHealth",
          "emr:DescribeClusterOperationHostTaskLog",
          "emr:DescribeClusterResourcePoolSchedulerTypeForAdmin",
          "emr:DescribeClusterServiceConfigForAdmin",
          "emr:DescribeClusterServiceConfigTagForAdmin",
          "emr:DescribeClusterTemplate",
          "emr:DescribeDiskOpsActivity",
          "emr:DescribeEmrMainVersion",
          "emr:DescribeExecutionPlan",
          "emr:DescribeFlowAgentToken",
          "emr:DescribeFlowAgentUser",
          "emr:DescribeFlowEntitySnapshot",
          "emr:DescribeFlowNodeInstanceContainerLog",
          "emr:DescribeFlowProjectClusterSetting",
          "emr:DescribeJob",
          "emr:DescribeKafkaReassign",
          "emr:DescribeLibraryDetail",
          "emr:DescribeLibraryInstallTaskDetail",
          "emr:DescribeMetaDataSourceForOuter",
          "emr:DescribeMetaDatabaseForOuter",
          "emr:DescribeMetaTableColumnForOuter",
          "emr:DescribeMetaTablePartitionForOuter",
          "emr:DescribeMetaTablePreviewTask",
          "emr:DescribeMetaTablePreviewTaskForOuter",
          "emr:DescribeNote",
          "emr:DescribeOperationTask",
          "emr:DescribeParagraph",
          "emr:DescribeRdsInstance",
          "emr:DescribeScalingActivity",
          "emr:DescribeScalingCommonConfig",
          "emr:DescribeScalingGroupInstanceV2",
          "emr:DescribeScalingGroupV2",
          "emr:DescribeScalingMetrics",
          "emr:DescribeScalingRule",
          "emr:DescribeScalingTaskGroup",
          "emr:DescribeServiceConfigDefinition",
          "emr:DescribeServiceHealth",
          "emr:DescribeUserStatistics",
          "emr:DetachAndReleaseClusterEni",
          "emr:DetachCluster",
          "emr:DetachClusterForNote",
          "emr:DiffFlowEntitySnapshot",
          "emr:DumpMetaDataSourceForOuter",
          "emr:EnableApplication",
          "emr:ExecuteFsAction",
          "emr:ExecuteHiveSql",
          "emr:ExistsUser",
          "emr:GetApiTemplate",
          "emr:GetApplicationActions",
          "emr:GetAuditLogs",
          "emr:GetBackPlanInfo",
          "emr:GetBackupInfo",
          "emr:GetBackupRuleInfo",
          "emr:GetClusterCost",
          "emr:GetCostUploadSignature",
          "emr:GetDisasterRecoveryPlan",
          "emr:GetDoctorComputeSummary",
          "emr:GetDoctorHBaseRegion",
          "emr:GetDoctorHBaseRegionServer",
          "emr:GetDoctorHBaseTable",
          "emr:GetDoctorHDFSCluster",
          "emr:GetDoctorHDFSDirectory",
          "emr:GetFlowAgentTrackStatus",
          "emr:GetFlowAuditLogs",
          "emr:GetFlowEntityRelationGraph",
          "emr:GetMetadataTypeList",
          "emr:GetOverview",
          "emr:GetPriceForCreate",
          "emr:GetPriceForCreateOnKubeCluster",
          "emr:GetReleaseVersion",
          "emr:GetSlsTempToken",
          "emr:GetSupportApplications",
          "emr:HasRamOauthPolicy",
          "emr:IncreaseNodesDiskSize",
          "emr:InnerCheckAckInstance",
          "emr:InnerDescribeUserAccountStatus",
          "emr:InstallLibraries",
          "emr:KillExecutionJobInstance",
          "emr:KillExecutionPlanInstance",
          "emr:ListAdviceAction",
          "emr:ListAlertContacts",
          "emr:ListApmMetadata",
          "emr:ListApplicationConfigVersions",
          "emr:ListBackupPlans",
          "emr:ListBackupRules",
          "emr:ListBackups",
          "emr:ListClusterAttach",
          "emr:ListClusterBootstrapActions",
          "emr:ListClusterCosts",
          "emr:ListClusterForAdmin",
          "emr:ListClusterForOuter",
          "emr:ListClusterHostComponentForAdmin",
          "emr:ListClusterOperationHostTask",
          "emr:ListClusterServiceConfigHistoryForAdmin",
          "emr:ListClusterTag",
          "emr:ListClusterTagForAdmin",
          "emr:ListClusterTypes",
          "emr:ListComponentDefaultTopologies",
          "emr:ListDependApplications",
          "emr:ListDisasterRecoveryPlans",
          "emr:ListDisasterRecoveryRecords",
          "emr:ListDiskOpsEvents",
          "emr:ListDoctorComputeSummary",
          "emr:ListDoctorHBaseRegionServers",
          "emr:ListDoctorHBaseTables",
          "emr:ListDoctorJobsStats",
          "emr:ListEcsInstances",
          "emr:ListEmrAvailableConfig",
          "emr:ListEmrAvailableMetaType",
          "emr:ListEmrAvailableResource",
          "emr:ListEmrMainVersion",
          "emr:ListEmrMainVersionServiceGroup",
          "emr:ListEmrMainVersions",
          "emr:ListExecutePlanMigrateInfo",
          "emr:ListExecutionPlanInstanceTrend",
          "emr:ListFailureJobExecutionInstances",
          "emr:ListFeatures",
          "emr:ListFlowClusterAllHosts",
          "emr:ListFlowClusterK8sNamespace",
          "emr:ListFlowEntitySnapshot",
          "emr:ListFlowProjectClusterSetting",
          "emr:ListFlowProjectUser",
          "emr:ListGlobalConfigs",
          "emr:ListHealthRule",
          "emr:ListJobExecutionInstanceTrend",
          "emr:ListJobExecutionInstances",
          "emr:ListJobExecutionPlanHierarchy",
          "emr:ListJobInstanceWorkers",
          "emr:ListJobMigrateInfo",
          "emr:ListKMSKeys",
          "emr:ListKafkaReassign",
          "emr:ListKafkaReassignForAdmin",
          "emr:ListKafkaReassignTopic",
          "emr:ListKafkaTopicStatistics",
          "emr:ListKafkaTopicStatisticsForAdmin",
          "emr:ListKeyPairNames",
          "emr:ListLibraries",
          "emr:ListLibraryInstallTasks",
          "emr:ListLibraryStatus",
          "emr:ListLocalDiskComponentInfo",
          "emr:ListMetaCluster",
          "emr:ListMetaDataSourceForOuter",
          "emr:ListMetaDatabaseForOuter",
          "emr:ListMetaTableColumnForOuter",
          "emr:ListMetaTableForOuter",
          "emr:ListMetaTablePartitionForOuter",
          "emr:ListMetastoreTypes",
          "emr:ListMetricsToDisplay",
          "emr:ListNodeGroupSpecs",
          "emr:ListNotes",
          "emr:ListOperation",
          "emr:ListOperationActivity",
          "emr:ListOperationStageInstanceRelation",
          "emr:ListOperationTask",
          "emr:ListPrivateZones",
          "emr:ListRamRole",
          "emr:ListRamUsers",
          "emr:ListRdsDatabase",
          "emr:ListRdsInstance",
          "emr:ListRegions",
          "emr:ListReleaseVersions",
          "emr:ListResourcePoolForAdmin",
          "emr:ListScalingActivity",
          "emr:ListScalingActivityV2",
          "emr:ListScalingConfigItemV2",
          "emr:ListScalingGroupV2",
          "emr:ListSecurityGroups",
          "emr:ListServiceComponentTopology",
          "emr:ListSlsProject",
          "emr:ListStack",
          "emr:ListStackService",
          "emr:ListStreamingSqlQuery",
          "emr:ListSupportedServiceName",
          "emr:ListTagKeys",
          "emr:ListTagValues",
          "emr:ListUserStatistics",
          "emr:ListVpcInfo",
          "emr:ListVswitch",
          "emr:ManageUserPlatform",
          "emr:MetastoreCreateDatabase",
          "emr:MetastoreCreateKafkaTopic",
          "emr:MetastoreCreateTable",
          "emr:MetastoreDataPreview",
          "emr:MetastoreDeleteKafkaTopic",
          "emr:MetastoreDescribeDataSource",
          "emr:MetastoreDescribeDatabase",
          "emr:MetastoreDescribeKafkaConsumerGroup",
          "emr:MetastoreDescribeKafkaTopic",
          "emr:MetastoreDescribeTable",
          "emr:MetastoreDescribeTask",
          "emr:MetastoreDropDatabase",
          "emr:MetastoreDropTable",
          "emr:MetastoreListDataSource",
          "emr:MetastoreListDataSourceForAdmin",
          "emr:MetastoreListDatabases",
          "emr:MetastoreListKafkaConsumerGroup",
          "emr:MetastoreListKafkaTopic",
          "emr:MetastoreListKafkaTopicForAdmin",
          "emr:MetastoreListTablePartition",
          "emr:MetastoreListTables",
          "emr:MetastoreListTask",
          "emr:MetastoreRetryTask",
          "emr:MetastoreSearchTables",
          "emr:MetastoreSync",
          "emr:MetastoreUpdateKafkaTopic",
          "emr:MetastoreUpdateKafkaTopicBatch",
          "emr:MetastoreUpdateTable",
          "emr:MigrateJobs",
          "emr:ModifyAlertContact",
          "emr:ModifyAlertDingDingGroup",
          "emr:ModifyAlertUserGroup",
          "emr:ModifyClusterBootstrapAction",
          "emr:ModifyClusterTemplate",
          "emr:ModifyExecutionPlanBasicInfo",
          "emr:ModifyFlow",
          "emr:ModifyFlowProject",
          "emr:ModifyFlowProjectClusterSetting",
          "emr:ModifyFlowProjectGeneralSetting",
          "emr:ModifyFlowVariableCollection",
          "emr:ModifyHealthRuleConfig",
          "emr:ModifyJob",
          "emr:ModifyJobExecutionPlanFolder",
          "emr:ModifyJobExecutionPlanParam",
          "emr:ModifyScalingConfigItemV2",
          "emr:ModifyScalingGroupV2",
          "emr:ModifyScalingRule",
          "emr:ModifyUserChannelInfo",
          "emr:ModifyUserStatistics",
          "emr:PassRole",
          "emr:PreCheckClusterBootstrapAction",
          "emr:QueryGrafanaData",
          "emr:QueryInfoByToken",
          "emr:QueryLogKey",
          "emr:QueryPrice",
          "emr:QuerySlsMetricData",
          "emr:QueryTableData",
          "emr:QueryTrendData",
          "emr:QueryUserById",
          "emr:ReassignKafka",
          "emr:RefreshBackupList",
          "emr:RemoveBackupPlan",
          "emr:RemoveBackupRule",
          "emr:RemoveScalingConfigItemV2",
          "emr:RestoreBackup",
          "emr:RestoreFlowEntitySnapshot",
          "emr:ResumeExecutionPlanInstance",
          "emr:ResumeExecutionPlanScheduler",
          "emr:ResumeFlow",
          "emr:RetryCreateLdapUser",
          "emr:RetryCreateUserPassword",
          "emr:RetryExecutionPlan",
          "emr:RetryExecutionPlanInstance",
          "emr:RetryOperationActivity",
          "emr:RunApiTemplate",
          "emr:RunDisasterRecoveryPlan",
          "emr:RunDiskOpsActivity",
          "emr:RunExecutionPlan",
          "emr:RunNoteParagraphs",
          "emr:RunParagraph",
          "emr:RunScalingActionV2",
          "emr:SaveParagraph",
          "emr:SaveReport",
          "emr:StartFlow",
          "emr:StartKafkaPreferredReplicaElection",
          "emr:StopParagraph",
          "emr:SuspendExecutionPlanInstance",
          "emr:SuspendExecutionPlanScheduler",
          "emr:UninstallLibraries",
          "emr:UpdateClusterCost",
          "emr:UpdateClusterMetaCollect",
          "emr:UpdateDisasterRecoveryPlan",
          "emr:UpdateKafkaReassignParam",
          "emr:UpdateLibraryInstallTaskStatus",
          "emr:UpdateNodeMaintenanceStatus",
          "emr:UpgradeHistory",
          "emr:UploadCostBucket",
          "emr:describeOperationTask",
          "emr:queryTableData",
          "emr:queryTrendData"
        ],
        "Resource": "*"
      }
    ]
  }
  

FAQ