系統已支援的ResourceSchema
資訊安全中心系統內建了多個ResourceSchema以支援常見的資源類型，包括：MaxCompute、EMR_ON_ECS_HIVE、SEVERLESS_STARROCKS、HOLOGRES、DATAWORKS_ENTITY、DLF_V1、DLF_NEXT和LINDORM。
授權方式配置
每個 ResourceSchema 都包含 authMethods 欄位，定義該資源類型支援的授權方式：
{
"authMethods": [
{
"name": "default",
"displayName": "原生授權",
"isDefault": true
}
]
}
約定：
所有系統內建 ResourceSchema 預設至少包含
default授權方式default代表該資源類型的原生授權方式，由系統根據defSchema映射到具體的PermissionGrantService使用者不指定
authMethod或傳default時，系統自動使用原生授權方式
授權方式與資源類型映射：
資源類型 | default 映射 | 支援的其他授權方式 | 說明 |
SEVERLESS_STARROCKS | ranger | starrocksManager | 當前唯一支援多種授權方式的資源類型，預設使用 Ranger 授權，可選 StarRocks Manager |
HOLOGRES | hologres | - | 僅支援原生授權 |
DLF_V1 | dlfV1 | - | 僅支援 DLF 1.0 授權 |
EMR_ON_ECS_HIVE | ranger | - | 僅支援 Ranger 授權 |
LINDORM | ranger | - | 僅支援 Ranger 授權 |
DATAWORKS_ENTITY | default | - | 僅支援預設授權 |
MaxCompute | default | 不支援授權 | MaxCompute 許可權體系獨立 |
DLF_NEXT | default | 不支援授權 | DLF 3.0 許可權體系獨立 |
以下是這些ResourceSchema的定義：
MaxCompute
{
"name": "MaxCompute",
"displayName": "MaxCompute Resource",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER",
"RAM_ROLE"
],
"authMethods": [],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "workspace",
"type": "string",
"label": "DATAWORKS_WORKSPACE_ID",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [
"workspaceId",
"workspaceName",
"ownerBaseId"
],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "project",
"type": "string",
"label": "PROJECT",
"parent": "workspace",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 3,
"name": "schema",
"type": "string",
"label": "SCHEMA",
"parent": "project",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 4,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "schema",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": true,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"update",
"download",
"describe",
"alter",
"drop"
]
},
{
"level": 4,
"name": "resource",
"type": "string",
"label": "RESOURCE",
"parent": "schema",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"read",
"write",
"delete",
"all"
]
},
{
"level": 4,
"name": "udf",
"type": "string",
"label": "UDF",
"parent": "schema",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"read",
"write",
"delete",
"execute",
"all"
]
},
{
"level": 5,
"name": "column",
"type": "string",
"label": "COLUMN",
"parent": "table",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"update",
"download"
]
}
]
}
hive
{
"name": "EMR_ON_ECS_HIVE",
"displayName": "Emr On Ecs Hive Resource",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER"
],
"authMethods": [],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "instance",
"type": "string",
"label": "INSTANCE_ID",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [
"workspaceId",
"workspaceName",
"ownerBaseId"
],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "database",
"type": "string",
"label": "DATABASE",
"parent": "instance",
"mandatory": true,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"create",
"update",
"alter",
"select"
]
},
{
"level": 3,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "database",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"drop",
"update",
"alter",
"all"
]
}
]
}
starrocks
{
"name": "SEVERLESS_STARROCKS",
"displayName": "Serverless Starrocks Resource",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER",
"RAM_ROLE"
],
"authMethods": [
{
"name": "ranger",
"displayName": "Ranger",
"isDefault": true
},
{
"name": "starrocksManager",
"displayName": "StarRocks Manager",
"isDefault": false
}
],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "instance",
"type": "string",
"label": "INSTANCE_ID",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "internalCatalog",
"type": "string",
"label": "INTERNAL_CATALOG",
"parent": "instance",
"mandatory": false,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [],
"authMethodAccessTypes": [
{
"authMethod": "starrocksManager",
"accessTypes": ["all", "usage", "create database", "drop", "alter"]
}
]
},
{
"level": 2,
"name": "hiveCatalog",
"type": "string",
"label": "EXTERNAL_HIVE_CATALOG",
"parent": "instance",
"mandatory": false,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [],
"authMethodAccessTypes": [
{
"authMethod": "starrocksManager",
"accessTypes": ["all", "usage", "create database", "drop", "alter"]
}
]
},
{
"level": 3,
"name": "database",
"type": "string",
"label": "DATABASE",
"parent": "internalCatalog",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": true,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"create table",
"drop",
"alter",
"create view",
"create function",
"create materialized view"
],
"authMethodAccessTypes": [
{
"authMethod": "starrocksManager",
"accessTypes": ["all", "alter", "drop", "create table", "create view", "create function", "create materialized view", "create pipe"]
},
{
"authMethod": "ranger",
"accessTypes": ["create table", "drop", "alter", "create view", "create function", "create materialized view"]
}
]
},
{
"level": 3,
"name": "hiveDatabase",
"type": "string",
"label": "EXTERNAL_HIVE_DATABASE",
"parent": "hiveCatalog",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": true,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"create",
"update",
"alter",
"select"
],
"authMethodAccessTypes": [
{
"authMethod": "starrocksManager",
"accessTypes": ["all", "alter", "drop", "create table", "create view", "create function", "create materialized view", "create pipe"]
},
{
"authMethod": "ranger",
"accessTypes": ["create", "update", "alter", "select"]
}
]
},
{
"level": 4,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "database",
"mandatory": false,
"extendedInfo": {
"constraints": {
"enabled": true,
"supportedTypes": ["rowFilter"],
"maxConstraints": 1,
"definitions": {
"rowFilter": {
"description": "行級過濾條件，SQL WHERE 子句",
"type": "string",
"required": false,
"example": "ID > 3 AND Name = 'test'",
"authMethods": ["ranger"],
"restrictedAccessTypes": ["select"]
}
}
}
},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"delete",
"drop",
"insert",
"select",
"alter",
"export",
"update"
],
"authMethodAccessTypes": [
{
"authMethod": "starrocksManager",
"accessTypes": ["all", "alter", "drop", "select", "insert", "update", "export", "delete"]
},
{
"authMethod": "ranger",
"accessTypes": ["delete", "drop", "insert", "select", "alter", "export", "update"]
}
]
},
{
"level": 4,
"name": "view",
"type": "string",
"label": "VIEW",
"parent": "database",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [],
"authMethodAccessTypes": [
{
"authMethod": "starrocksManager",
"accessTypes": ["all", "select", "alter", "drop"]
}
]
},
{
"level": 4,
"name": "materializedView",
"type": "string",
"label": "MATERIALIZED_VIEW",
"parent": "database",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [],
"authMethodAccessTypes": [
{
"authMethod": "starrocksManager",
"accessTypes": ["all", "select", "alter", "refresh", "drop"]
}
]
},
{
"level": 4,
"name": "hiveTable",
"type": "string",
"label": "EXTERNAL_HIVE_TABLE",
"parent": "hiveDatabase",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select"
],
"authMethodAccessTypes": [
{
"authMethod": "starrocksManager",
"accessTypes": ["all", "alter", "drop", "select", "insert", "update", "export", "delete"]
},
{
"authMethod": "ranger",
"accessTypes": ["select"]
}
]
},
{
"level": 4,
"name": "hiveView",
"type": "string",
"label": "EXTERNAL_HIVE_VIEW",
"parent": "hiveDatabase",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [],
"authMethodAccessTypes": [
{
"authMethod": "starrocksManager",
"accessTypes": ["all", "select", "alter", "drop"]
}
]
},
{
"level": 4,
"name": "hiveMaterializedView",
"type": "string",
"label": "EXTERNAL_HIVE_MATERIALIZED_VIEW",
"parent": "hiveDatabase",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [],
"authMethodAccessTypes": [
{
"authMethod": "starrocksManager",
"accessTypes": ["all", "select", "alter", "refresh", "drop"]
}
]
}
]
}
StarRocks 授權方式差異說明：
資源層級 | ranger (預設) | starrocksManager | 說明 |
internalCatalog | ❌ 不支援 | ✅ 支援 | Ranger 下不是葉子節點 |
database | ✅ 支援 | ✅ 支援 | accessType 有差異 |
table | ✅ 支援 | ✅ 支援 | Ranger 支援 rowFilter 約束 |
view | ❌ 不支援 | ✅ 支援 | 僅 StarRocks Manager 支援 |
materializedView | ❌ 不支援 | ✅ 支援 | 僅 StarRocks Manager 支援 |
hiveCatalog | ❌ 不支援 | ✅ 支援 | Ranger 下不是葉子節點 |
hiveDatabase | ✅ 支援 | ✅ 支援 | accessType 有差異 |
hiveTable | ✅ 支援（僅 select） | ✅ 支援 | Ranger 僅支援 select |
hiveView | ❌ 不支援 | ✅ 支援 | 僅 StarRocks Manager 支援 |
hiveMaterializedView | ❌ 不支援 | ✅ 支援 | 僅 StarRocks Manager 支援 |
約束條件支援：
資源層級 | 約束類型 | 支援的授權方式 | accessType 限制 | 說明 |
table | rowFilter | ranger |
| 行級過濾條件，SQL WHERE 子句；聲明 rowFilter 時 accessType 僅允許 |
hologres
{
"name": "HOLOGRES",
"displayName": "Hologres Resource",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER"
],
"authMethods": [
{
"name": "hologres",
"displayName": "Hologres",
"isDefault": true
}
],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"enricherFields": [],
"recursiveSupported": false,
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "instance",
"type": "string",
"label": "INSTANCE_ID",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "database",
"type": "string",
"label": "DATABASE",
"parent": "instance",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 3,
"name": "schema",
"type": "string",
"label": "SCHEMA",
"parent": "database",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 4,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "schema",
"mandatory": true,
"extendedInfo": {},
"recursiveSupported": true,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"insert",
"update",
"delete",
"truncate",
"all"
]
},
{
"level": 5,
"name": "column",
"type": "string",
"label": "COLUMN",
"parent": "table",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"insert",
"update"
]
}
]
}
Hologres 列許可權說明：
配置項 | 說明 |
| 支援 |
| table 下的 level 5 子資源，通過 |
列許可權訪問類型 | 僅支援 |
dlf-legacy
{
"name": "DLF_V1",
"displayName": "Dlf 1.0 Resource",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER",
"RAM_ROLE"
],
"authMethods": [],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"enricherFields": [],
"recursiveSupported": false,
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "catalog",
"type": "string",
"label": "CATALOG",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "database",
"type": "string",
"label": "DATABASE",
"parent": "catalog",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"describe",
"alter",
"drop",
"createTable",
"createFunction",
"list"
]
},
{
"level": 3,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "database",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": true,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"update",
"describe",
"alter",
"drop"
]
},
{
"level": 4,
"name": "column",
"type": "string",
"label": "COLUMN",
"parent": "table",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select"
]
}
]
}
dlfNext
{
"name": "DLF_NEXT",
"displayName": "Dlf Next Resource",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER",
"RAM_ROLE",
"DLF_ROLE"
],
"authMethods": [],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"enricherFields": [],
"recursiveSupported": false,
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "catalog",
"type": "string",
"label": "CATALOG",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "database",
"type": "string",
"label": "DATABASE",
"parent": "catalog",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"describe",
"list",
"alter",
"drop",
"createTable",
"createFunction",
"createView",
"grant",
"all"
]
},
{
"level": 3,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "database",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": true,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select",
"update",
"alter",
"drop",
"grant",
"all"
]
},
{
"level": 4,
"name": "column",
"type": "string",
"label": "COLUMN",
"parent": "table",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"select"
]
}
]
}
DATAWORKS_ENTITY
{
"name": "DATAWORKS_ENTITY",
"displayName": "Dataworks Entity",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER",
"RAM_ROLE",
"DATAWORKS_WORKSPACE_ROLE",
"DATAWORKS_WORKSPACE_MEMBER"
],
"authMethods": [],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"enricherFields": [],
"recursiveSupported": false,
"isValidLeaf": false,
"accessTypeRestrictions": []
},{
"level": 1,
"name": "tenantRole",
"type": "string",
"label": "DATAWORKS_TENANT_ROLE_CODE",
"parent": "tenant",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [
"roleName"
],
"isValidLeaf": true,
"accessTypeRestrictions": [
"joinIn"
],
"authPrincipalRestrictions": [
"RAM_USER",
"RAM_ROLE"
]
},
{
"level": 1,
"name": "workspace",
"type": "string",
"label": "DATAWORKS_WORKSPACE_ID",
"parent": "tenant",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [
"workspaceId",
"workspaceName",
"ownerBaseId"
],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 2,
"name": "workspaceRole",
"type": "string",
"label": "DATAWORKS_WORKSPACE_ROLE_CODE",
"parent": "workspace",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"joinIn"
],
"authPrincipalRestrictions": [
"RAM_USER",
"RAM_ROLE"
]
}
]
}
Lindorm
{
"name": "LINDORM",
"displayName": "Lindorm",
"version": "v1.0.0",
"authPrincipal": [
"RAM_USER"
],
"authMethods": [],
"resources": [
{
"level": 0,
"name": "tenant",
"type": "string",
"label": "DATAWORKS_TENANT_ID",
"parent": "",
"mandatory": false,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": []
},
{
"level": 1,
"name": "instance",
"type": "string",
"label": "INSTANCE_ID",
"parent": "tenant",
"mandatory": true,
"extendedInfo": {},
"enricherFields": [
"instanceName"
],
"isValidLeaf": false,
"accessTypeRestrictions": [
"write",
"read",
"admin",
"trash",
"system",
"all"
]
},
{
"level": 2,
"name": "database",
"type": "string",
"label": "DATABASE",
"parent": "instance",
"mandatory": true,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": false,
"accessTypeRestrictions": [
"write",
"read",
"admin",
"trash",
"system",
"all"
]
},
{
"level": 3,
"name": "table",
"type": "string",
"label": "TABLE",
"parent": "database",
"mandatory": true,
"extendedInfo": {},
"recursiveSupported": false,
"enricherFields": [],
"isValidLeaf": true,
"accessTypeRestrictions": [
"write",
"read",
"admin",
"trash",
"all"
]
}
]
}