MaxCompute:Conjunto de comandos de permissão

Gerenciamento de funções

• Create a project-level role

  • Comando

    create role <role_name> [privilegeproperties("type"="admin|resource")];

  • Exemplos

    • Crie uma função de recurso chamada Worker.

      create role Worker;

    • Crie uma função de administrador chamada sale_admin.

       create role sale_admin privilegeproperties("type"="admin");

• View a list of project-level roles

  list roles;

• Drop a project-level role

  • Comando

    drop role <role_name>;

  • Exemplo

    drop role Worker;

Gerenciamento de usuários

• Add an Alibaba Cloud account user (project-level)

  • Comando

    create role <role_name> [privilegeproperties("type"="admin|resource")];

  • Exemplo

    • Para criar uma função de recurso Worker, execute um comando semelhante ao seguinte:

      create role Worker;

    • Para criar uma função administrativa sale_admin, execute um comando semelhante ao seguinte:

       create role sale_admin privilegeproperties("type"="admin");

• Remove an Alibaba Cloud account (project-level)

  • Comando

    drop role <role_name>;

  • Exemplo

    drop role Worker;

• Add a RAM user (project-level)

• Remove a RAM user (project-level)

• Add a RAM role (project-level)

• Remove a RAM role (project-level)

  • Comando

    remove user `RAM$<account_name>:role/<RAM role name>`;

  • Exemplo

    remove user RAM$odps_test_user@aliyun.com:role/ram_role;

• User list (project-level)

  list users;

Autorização de funções

Grant operation permissions on an object to a role

• Conceder permissões de operação em um projeto a uma função

  • Comando

    • Autorização ACL

      GRANT Read|Write|List|CreateTable|CreateInstance|CreateFunction|CreateResource|All 
            ON project <project_name> 
            TO ROLE <role_name> [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

    • Implementar autorização de política usando sintaxe ACL

      GRANT Read|Write|List|CreateTable|CreateInstance|CreateFunction|CreateResource|All 
            ON project <project_name> 
            TO ROLE <role_name> privilegeproperties("policy" = "true", "{allow}"="{true|false}"[, "conditions"= "<conditions>", "expires"="<days>"]);

  • Exemplo

    -- ACL authorization.
    grant CreateTable, CreateFunction, CreateInstance, List on project test_project_a to ROLE Worker;
    -- Policy authorization.
    grant CreateTable, CreateFunction, CreateInstance, List 
          on project test_project_a  
          to ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

• Conceder permissões de operação em uma tabela a uma função

  • Comando

    • Autorização ACL

      GRANT Describe|Select|Alter|Update|Drop|ShowHistory|All 
            ON TABLE <table_name> [(<column_list>)] 
            TO ROLE <role_name> [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

    • Implementar autorização de política usando sintaxe ACL

      GRANT Describe|Select|Alter|Update|Drop|ShowHistory|All 
            ON TABLE <table_name> [(<column_list>)] 
            TO ROLE <role_name> privilegeproperties("policy" = "true", "{allow}"="{true|false}"[, "conditions"= "<conditions>", "expires"="<days>"]);

  • Exemplo

    -- ACL authorization.
    grant Describe, Select on table sale_detail to ROLE Worker;
    -- Policy authorization.
    grant Describe, Select  
          on table sale_detail   
          to ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

• Conceder permissões de operação em um modelo a uma função

  • Comando

    • Autorização ACL

      GRANT Describe|Execute|Alter|Drop|All 
            ON MODEL <model_name> 
            TO ROLE <role_name> [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

    • Implementar autorização de política usando sintaxe ACL

      GRANT Describe|Execute|Alter|Drop|All 
            ON MODEL <model_name> 
            TO ROLE <role_name> privilegeproperties("policy" = "true", "{allow}"="{true|false}"[, "conditions"= "<conditions>", "expires"="<days>"]);

  • Exemplo

    -- Enter the test_project_a project.
    use test_project_a;
    -- ACL authorization.
    GRANT All ON MODEL my_model TO ROLE Worker;
    -- Policy authorization using ACL syntax.
    GRANT All  
          ON MODEL my_model  
          TO ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

• Conceder permissões de operação em um recurso a uma função

  • Comando

    • Autorização ACL

      GRANT Read|Write|Delete|All 
            ON resource <resource_name> 
            TO ROLE <role_name> [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

    • Implementar autorização de política usando sintaxe ACL

      GRANT Read|Write|Delete|All 
            ON resource <resource_name> 
            TO ROLE <role_name> privilegeproperties("policy" = "true", "{allow}"="{true|false}"[, "conditions"= "<conditions>", "expires"="<days>"]);

  • Exemplo

    -- ACL authorization.
    grant Read, Write on resource udtf.jar to ROLE Worker;
    -- Policy authorization.
    grant Read, Write   
          on resource udtf.jar  
          to ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

• Conceder permissões de operação em uma função (UDF) a uma função (role)

  • Comando

    GRANT Read|Write|Delete|Execute|All 
          ON FUNCTION <function_name> 
          TO ROLE <role_name> [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

  • Exemplo

    -- ACL authorization.
    grant Read, Write on function udf_test to ROLE Worker;
    -- Policy authorization.
    grant Read, Write   
          on function udf_test  
          to ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

• Conceder permissões de operação em uma instância a uma função

  • Comando

    • Autorização ACL

      GRANT Read|Write|All 
            ON instance <instance_id> 
            TO ROLE <role_name> [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

    • Implementar autorização de política usando sintaxe ACL

      GRANT Read|Write|All  
            ON instance <instance_id>   
            TO ROLE <role_name> privilegeproperties("policy" = "true", "{allow}"="{true|false}"[, "conditions"= "<conditions>", "expires"="<days>"]);

  • Exemplo

    -- ACL authorization.
    grant All on instance 202112300224**** to ROLE Worker;
    -- Policy authorization.
    grant All    
          on instance 202112300224****   
          to ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

Revoke operation permissions on an object from a role

• Revogar permissões de operação em um projeto de uma função

  • Comando

    • Revogar autorização ACL.

      REVOKE Read|Write|List|CreateTable|CreateInstance|CreateFunction|CreateResource|All 
            ON project <project_name> 
            FROM ROLE <role_name>;

    • Revogar autorização de política.

      REVOKE Read|Write|List|CreateTable|CreateInstance|CreateFunction|CreateResource|All 
            ON project <project_name> 
            FROM ROLE <role_name> privilegeproperties("policy" = "true", "{allow}"="{true|false}");

  • Exemplo

    -- Revoke ACL authorization.
    revoke CreateTable, CreateFunction, CreateInstance, List on project test_project_a from ROLE Worker;
    -- Revoke policy authorization.
    revoke CreateTable, CreateFunction, CreateInstance, List 
          on project test_project_a  
          from ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

• Revogar permissões de operação em uma tabela de uma função

  • Comando

    • Revogar autorização ACL

      REVOKE Describe|Select|Alter|Update|Drop|ShowHistory|All 
            ON TABLE <table_name> [(<column_list>)] 
            FROM ROLE <role_name>;

    • Revogar autorização de política

      REVOKE Describe|Select|Alter|Update|Drop|ShowHistory|All 
            ON TABLE <table_name> [(<column_list>)] 
            FROM ROLE <role_name> privilegeproperties("policy" = "true", "{allow}"="{true|false}");

  • Exemplo

    -- Revoke ACL authorization.
    revoke Describe, Select on table sale_detail from ROLE Worker;
    -- Revoke policy authorization.
    revoke Describe, Select  
          on table sale_detail   
          from ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

• Revogar permissões de operação em um modelo de uma função

  • Comando

    • Revogar autorização ACL

      REVOKE Describe|Execute|Alter|Drop|All 
            ON MODEL <model_name>
            FROM ROLE <role_name>;

    • Revogar autorização de política

      REVOKE Describe|Execute|Alter|Drop|All 
            ON MODEL <model_name> 
            FROM ROLE <role_name> privilegeproperties("policy" = "true", "{allow}"="{true|false}");

  • Exemplo

    -- Enter the test_project_a project.
    use test_project_a;
    -- Revoke ACL authorization.
    REVOKE All ON MODEL my_model FROM ROLE Worker;
    -- Revoke policy authorization.
    REVOKE All  
          ON MODEL my_model  
          FROM ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

• Revogar permissões de operação em um recurso de uma função

  • Comando

    • Revogar autorização ACL

      REVOKE Read|Write|Delete|All 
            ON resource <resource_name> 
            FROM ROLE <role_name>;

    • Revogar autorização de política

      REVOKE Read|Write|Delete|All 
            ON resource <resource_name> 
            FROM ROLE <role_name> privilegeproperties("policy" = "true", "{allow}"="{true|false}");

  • Exemplo

    -- Revoke ACL authorization.
    revoke Read, Write on resource udtf.jar from ROLE Worker;
    -- Revoke policy authorization.
    revoke Read, Write   
          on resource udtf.jar  
          from ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

• Revogar permissões de operação em uma função (UDF) de uma função (role)

  • Comando

    • Revogar autorização ACL

      REVOKE Read|Write|Delete|Execute|All 
            ON FUNCTION <function_name> 
            FROM ROLE <role_name>;

    • Revogar autorização de política

      REVOKE Read|Write|Delete|Execute|All 
            ON FUNCTION <function_name>  
            FROM ROLE <role_name> privilegeproperties("policy" = "true", "{allow}"="{true|false}");

  • Exemplo

    -- Revoke ACL authorization.
    revoke Read, Write on function udf_test from ROLE Worker;
    -- Revoke policy authorization.
    revoke Read, Write   
          on function udf_test  
          from ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

• Revogar permissões de operação em uma instância de uma função

  • Comando

    REVOKE Read|Write|All  
          ON instance <instance_id>   
          FROM ROLE <role_name> privilegeproperties("policy" = "true", "{allow}"="{true|false}");

  • Exemplo

    -- Revoke ACL authorization.
    revoke All on instance 202112300224**** from ROLE Worker;
    -- Revoke policy authorization.
    revoke All    
          on instance 202112300224****   
          from ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

Grant the Download permission to a role

• Comando

  GRANT Download ON {Table|Resource|Function|Instance} <object_name> TO ROLE <role_name>;

• Exemplo

  grant download on table sale_detail to ROLE Worker;

Revoke the Download permission from a role

• Comando

  REVOKE Download ON {Table|Resource|Function|Instance} <object_name> FROM ROLE <role_name>;

• Exemplo

  revoke download on table sale_detail from ROLE Worker;

Grant permissions to access high-sensitivity data to a role

• Comando

  GRANT Label <number> ON TABLE <table_name> [(<column_list>)] TO ROLE <role_name> [WITH exp <days>];

• Exemplo

  grant Label 4 on table sale_detail to ROLE Worker;

Revoke permissions to access high-sensitivity data from a role

• Comando

  REVOKE Label ON TABLE <table_name> [(<column_list>)] FROM ROLE <role_name>;

• Exemplo

  revoke Label on table sale_detail from ROLE Worker;

Attach a role to a user

• Comando

  GRANT <role_name> TO <user_name>;

• Exemplo

  grant Worker to ALIYUN$Ka**@aliyun.com;
  grant Worker to RAM$Bo*@aliyun.com:Allen;

Detach a role from a user

• Comando

  REVOKE <role_name> FROM <user_name>;

• Exemplo

  revoke Worker from ALIYUN$Ka**@aliyun.com;
  revoke Worker from RAM$Bo*@aliyun.com:Allen;

Autorização de usuários

Conceder permissões de operação a usuários

• Conceder permissões de operação em um projeto a um usuário

  • Comando

    grant Read|Write|List|CreateTable|CreateInstance|CreateFunction|CreateResource|All
          on project <project_name>
          to USER <user_name> [privilegeproperties("conditions" = "<conditions>",

  • Exemplo

    grant CreateTable, CreateFunction, CreateInstance, List on project test_project_a to user RAM$Ka**@aliyun.com:Lily;

• Conceder permissões de operação em uma tabela a um usuário

  • Comando

    grant Describe|Select|Alter|Update|Drop|ShowHistory|All
          on table <table_name> [(<column_list>)]
          to USER <user_name> [privilegeproperties("conditions" = "<conditions>"

  • Exemplo

    grant Describe, Select on table sale_detail to USER RAM$Bo*@aliyun.com:Allen;

• Conceder permissões de operação em um recurso a um usuário

  • Comando

    grant Read|Write|Delete|All
          on resource <resource_name>
          to USER <user_name> [privilegeproperties("conditions" = "<conditions>",

  • Exemplo

    grant Read, Write on resource udtf.jar to USER RAM$Bo*@aliyun.com:Alice;

• Conceder permissões de operação em uma função (UDF) a um usuário

  • Comando

    grant Read|Write|Delete|Execute|All
          on function <function_name>
          to USER <user_name> [privilegeproperties("conditions" = "<conditions>"

  • Exemplo

    grant Read, Write on function udf_test to USER RAM$Bo*@aliyun.com:Tom;

• Conceder permissões de operação em uma instância a um usuário

  • Comando

    grant Read|Write|All
          on instance <instance_id>
          to USER <user_name> [privilegeproperties("conditions" = "<conditions>"

  • Exemplo

    grant All on instance 202112300224**** to USER RAM$Bo*@aliyun.com:Tom;

Revogar permissões de operação de usuários

• Revogar permissões de operação em um projeto de um usuário

  • Comando

    revoke Read|Write|List|CreateTable|CreateInstance|CreateFunction|CreateResource|All
          on project <project_name>
          from USER <user_name>;

  • Exemplo

    revoke CreateTable, CreateFunction, CreateInstance, List on project test_project_a from user RAM$Ka**@aliyun.com:Lily;

• Revogar permissões de operação em uma tabela de um usuário

  • Comando

    revoke Describe|Select|Alter|Update|Drop|ShowHistory|All
          on table <table_name> [(<column_list>)]
          from USER <user_name>;

  • Exemplo

    revoke Describe, Select on table sale_detail from USER RAM$Bo*@aliyun.com:Allen;

• Revogar permissões de operação em um recurso de um usuário

  • Comando

    revoke Read|Write|Delete|All
          on resource <resource_name>
          from USER <user_name>;

  • Exemplo

    revoke Read, Write on resource udtf.jar from USER RAM$Bo*@aliyun.com:Alice;

• Revogar permissões de operação em uma função (UDF) de um usuário

  • Comando

    revoke Read|Write|Delete|Execute|All
          on function <function_name>
          from USER <user_name>;

  • Exemplo

    revoke Read, Write on function udf_test from USER RAM$Bo*@aliyun.com:Tom;

• Revogar permissões de operação em uma instância de um usuário

  • Comando

    revoke Read|Write|All
          on instance <instance_id>
          from USER <user_name>;

  • Exemplo

    revoke All on instance 202112300224**** from USER RAM$Bo*@aliyun.com:Tom;

Grant operation permissions on an object to a role e Attach a role to a user

-- Grant permissions to the Worker role.
   -- ACL authorization.
grant CreateTable, CreateFunction, CreateInstance, List on project test_project_a to ROLE Worker;
   -- Policy authorization.
grant CreateTable, CreateFunction, CreateInstance, List 
      on project test_project_a  
      to ROLE Worker privilegeproperties("policy" = "true", "allow"="true");
-- Assign the Worker role to users.
grant Worker to RAM$Bo*@aliyun.com:Allen;
grant Worker to RAM$Bo*@aliyun.com:Alice;
grant Worker to RAM$Bob@aliyun.com:Tom;

Revoke operation permissions on an object from a role ou Detach a role from a user

-- Revoke permissions from the Worker role.
   -- Revoke ACL authorization.
revoke CreateTable, CreateFunction, CreateInstance, List on project test_project_a from ROLE Worker;
   -- Revoke policy authorization.
revoke CreateTable, CreateFunction, CreateInstance, List 
      on project test_project_a  
      from ROLE Worker privilegeproperties("policy" = "true", "allow"="true");
-- Or
-- Revoke the Worker role from a user.
revoke Worker from RAM$Bo*@aliyun.com:Allen;

Conceder a permissão Download a usuários

• Comando

  grant Download on {Table|Resource|Function|Instance} <object_name> to USER <user_name>;

• Exemplo

  grant Download on table sale_detail to USER RAM$Bo*@aliyun.com:Allen;

Revogar a permissão Download de usuários

• Comando

  revoke Download on {Table|Resource|Function|Instance} <object_name> from USER <user_name>;

• Exemplo

  revoke Download on table sale_detail from USER RAM$Bo*@aliyun.com:Allen;

Grant the Download permission to a role e Attach a role to a user

-- Create a role named Worker.
create role Worker;
-- Grant permissions to the Worker role.
grant download on table sale_detail to ROLE Worker;
-- Assign the Worker role to users.
grant Worker to RAM$Bo*@aliyun.com:Allen;
grant Worker to RAM$Bo*@aliyun.com:Alice;
grant Worker to RAM$Bob@aliyun.com:Tom;

Revoke the Download permission from a role ou Detach a role from a user

-- Revoke permissions from the Worker role.
revoke download on table sale_detail from ROLE Worker;
-- Or
-- Revoke the Worker role from a user.
revoke Worker from RAM$Bo*@aliyun.com:Allen;

Conceder a usuários permissões para acessar dados altamente sensíveis

• Comando

  grant Label <number> on table <table_name> [(<column_list>)] to USER <user_name> [with exp <days>];

• Exemplo

  grant Label 4 on table sale_detail to USER RAM$Bo*@aliyun.com:Allen;

Revogar permissões de usuário para acessar dados altamente sensíveis

• Comando

  revoke Label on table <table_name> [(<column_list>)] from USER <user_name>;

• Exemplo

  revoke Label on table sale_detail from ROLE Worker;

Grant permissions to access high-sensitivity data to a role e attach a role to a user

-- Create a role named Worker.
create role Worker;
-- Grant permissions to the Worker role.
grant Label 4 on table * to ROLE Worker;
-- Assign the Worker role to users.
grant Worker to RAM$Bo*@aliyun.com:Allen;
grant Worker to RAM$Bo*@aliyun.com:Alice;
grant Worker to RAM$Bob@aliyun.com:Tom;

Revoke permissions to access high-sensitivity data from a role ou detach a role from a user

-- Revoke permissions from the Worker role.
revoke Label on table * from ROLE Worker;
-- Or
-- Revoke the Worker role from a user.
revoke Worker from RAM$Bo*@aliyun.com:Allen;

Completely purge the remaining permission information of a deleted user

• Comando

  purge privs from user <user_name>;

• Exemplo

  purge privs from user RAM$Bo*@aliyun.com:Allen;

Consulta de informações de permissão

Consultar as permissões de uma função específica e informações sobre os usuários associados a ela

Para obter mais informações sobre como consultar as permissões de uma função específica e os usuários aos quais ela está atribuída, consulte Query the permissions of a specified role and information about the users that are assigned the role.

• Comando

  describe role <role_name>;

• Exemplo

  describe role Worker;

Consultar as informações de permissão de um usuário

• Query the permissions of the current user and information about the role that is assigned to the user

  show grants;

• Query the permissions of a specified user and information about the role that is assigned to the user

  • Comando

    show grants for <user_name>;

  • Exemplo

    show grants for ALIYUN$Bo*@aliyun.com;
    show grants for RAM$Bo*@aliyun.com:Allen;

Consultar as informações de autorização ACL de um objeto

Para obter mais informações sobre como consultar a autorização ACL de um objeto, consulte Query the ACL authorization information of a specified object.

• Comando

  show acl for <object_name> [on type <object_type>];

• Exemplo

  show acl for test_project_a on type project;

Consultar informações de permissão baseadas em rótulo

• Query all highly sensitive data tables that the current user can access

  show label grants;

• Query highly sensitive data tables of a specified level that the current user can access

  • Comando

    show label <level> grants;

  • Exemplo

    show label 2 grants;

• Query highly sensitive data tables that a specified user can access

  • Comando

    show label grants for user <user_name>;

  • Exemplo

    show label grants for user RAM$Bob@aliyun.com:Allen;

• Query highly sensitive data tables of a specified level that a specified user can access

  • Comando

    show label <level> grants for user <user_name>;

  • Exemplo

    show label 3 grants for user RAM$Bob@aliyun.com:Allen;

• Query users who are authorized to access a specified sensitive data table

  • Comando

    show label grants on table <table_name>;

  • Exemplo

    show label grants on table sale_detail;

• Query users of a specified level who can access a specified sensitive data table

  • Comando

    show label <level> grants on table <table_name>;

  • Exemplo

    show label 4 grants on table sale_detail;

• Query the permissions of a specified user on a specified sensitive data table

  • Comando

    show label [<label>] grants on table <table_name> for user <user_name>;

  • Exemplo

    show label grants on table sale_detail for user RAM$Bob@aliyun.com:Allen;

• Query the sensitivity levels of all columns in a specified table

  • Comando

    describe <table_name>;

  • Exemplo

    describe sale_detail;

Consultar informações de autorização de pacote

• Query the permissions on a specified package

  • Comando

    show acl for <project_name>.<package_name> on type package;

  • Exemplo

    show acl for test_project_b.datashare on type package;

• Query the permissions on an object in a specified package

  • Comando

    show grants on <object_type> <object_name> privilegeproperties ("refobject"="true", "refproject"="<project_name>", "package"="<package
    _name>");

  • Exemplo

    show grants on Table sale_detail privilegeproperties ("refobject"="true", "refproject"="test_project_a", "package"="datashare");

• Query the label-based permissions on a table in a specified package

  • Comando

    show label grants on table <table_name> privilegeproperties ("refobject"="true", "refproject"="<project_name>", "package"="<package_name>");

  • Exemplo

    show label grants on table sale_detail privilegeproperties ("refobject"="true", "refproject"="test_project_a", "package"="datashare");

Visualizar as configurações de segurança de um projeto

• Proteção de dados do projeto

  • Ativar ou desativar o mecanismo de proteção de dados de um projeto

    set ProjectProtection=true|false;

  • Visualizar as configurações de segurança do projeto

    show SecurityConfiguration;

    O resultado retornado contém ProjectProtection=true|false, que indica se a proteção de dados do projeto está ativada ou desativada, respectivamente.

• Visualizar projetos confiáveis adicionados

  list trustedprojects;

• Política de controle de acesso LabelSecurity

  • Ativar ou desativar a política de controle de acesso LabelSecurity

    set LabelSecurity=true|false;

  • Visualizar as configurações de segurança do projeto

    show SecurityConfiguration;

    O resultado retornado contém LabelSecurity=true|false. O valor true indica que o controle de acesso baseado em rótulo está ativado para o projeto; o valor false indica que está desativado.

• Recurso de controle de permissão de download

  • Ativar ou desativar o recurso de controle de permissão de download

    setproject odps.security.enabledownloadprivilege=true|false;

  • Visualizar propriedades do projeto

    setproject;

    O resultado retornado contém odps.security.enabledownloadprivilege = true|false, onde true indica que o recurso de controle de download do projeto está ativado e false indica que está desativado.