DataWorks：使用資源群組進行精細化資源控制-最新

資源群組授權的工作原理

您可以使用資源群組（Resource Group）對阿里雲帳號內的資源進行分組管理。例如，為不同的專案建立對應的資源群組，並將資源轉移到對應的組中，以便集中管理各專案的資源。更多資訊，請參見什麼是資源群組。

在完成資源分組後，您可以為不同的RAM授權主體（RAM使用者、RAM使用者組或RAM角色）授予指定資源群組範圍的許可權，從而限定這個授權主體只能管理該資源群組內的資源。更多資訊，請參見資源分組和授權。

這種授權方式的優點有：

• 許可權精細化：確保每個身份能獲得最準確的資源存取權限，避免帳號下的多重專案的資源混合管理。

• 良好的擴充性：後續新增資源時，只需將其加入該資源群組，RAM身份便會自動獲得新資源的相應許可權，無需再次授權。

為RAM使用者授予資源群組層級的許可權

下面以RAM使用者為例，介紹授予指定資源群組內巨量資料開發治理平台DataWorks資源許可權的操作步驟。

支援資源群組的資源類型

巨量資料開發治理平台DataWorks支援資源群組的資源類型如下表所示：

不支援資源群組層級授權的操作

巨量資料開發治理平台DataWorks中不支援資源群組層級授權的操作（Action）如下：

對於不支援資源群組授權的操作，授權時資源範圍選取資源群組層級將無效。如果仍需要RAM使用者有上述操作許可權，您需要建立自訂權限原則，授權時資源範圍選取帳號層級。

以下是兩個自訂權限原則樣本，您可以根據實際需要調整策略內容。

• 允許不支援資源群組層級授權的全部唯讀操作：Action中列舉不支援資源群組層級授權的所有隻讀操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dataworks:CheckAbTestFeatures",
          "dataworks:CheckRamPermissions",
          "dataworks:CloneDataSource",
          "dataworks:CreateComputeResource",
          "dataworks:CreateDataSource",
          "dataworks:CreateDataSourceSharedRule",
          "dataworks:DeleteComputeResource",
          "dataworks:DeleteDataSource",
          "dataworks:DeleteDataSourceSharedRule",
          "dataworks:DsgDesensPlanAddOrUpdate",
          "dataworks:DsgDesensPlanQueryList",
          "dataworks:DsgPlatformQueryProjectsAndSchemaFromMeta",
          "dataworks:DsgQueryDesensStatusList",
          "dataworks:DsgQuerySensResult",
          "dataworks:DsgSceneAddOrUpdateScene",
          "dataworks:DsgSceneQuerySceneListByName",
          "dataworks:DsgScenedDeleteScene",
          "dataworks:DsgUpdateDesensStatusList",
          "dataworks:DsgUserGroupAddOrUpdate",
          "dataworks:DsgUserGroupDelete",
          "dataworks:DsgUserGroupGetOdpsRoleGroups",
          "dataworks:DsgUserGroupQueryList",
          "dataworks:DsgUserGroupQueryUserList",
          "dataworks:DsgWhiteListAddOrUpdate",
          "dataworks:DsgWhiteListDeleteList",
          "dataworks:DsgWhiteListQueryList",
          "dataworks:GetCatalog",
          "dataworks:GetColumn",
          "dataworks:GetComponent",
          "dataworks:GetComputeResource",
          "dataworks:GetConfig",
          "dataworks:GetCreateWorkflowInstancesResult",
          "dataworks:GetDataQualityAlertRule",
          "dataworks:GetDataQualityScan",
          "dataworks:GetDataQualityScanRun",
          "dataworks:GetDataQualityScanRunLog",
          "dataworks:GetDataQualityTemplate",
          "dataworks:GetDataSource",
          "dataworks:GetDatabase",
          "dataworks:GetDataset",
          "dataworks:GetDatasetVersion",
          "dataworks:GetJobStatus",
          "dataworks:GetLineageRelationship",
          "dataworks:GetMetaCollection",
          "dataworks:GetNetwork",
          "dataworks:GetPartition",
          "dataworks:GetRerunWorkflowInstancesResult",
          "dataworks:GetSchema",
          "dataworks:GetTable",
          "dataworks:GetTenantRole",
          "dataworks:GetUser",
          "dataworks:ImportCertificate",
          "dataworks:ListCatalogs",
          "dataworks:ListColumns",
          "dataworks:ListComponents",
          "dataworks:ListComputeResources",
          "dataworks:ListContacts",
          "dataworks:ListCrawlerTypes",
          "dataworks:ListDataQualityAlertRules",
          "dataworks:ListDataQualityScanRuns",
          "dataworks:ListDataQualityScans",
          "dataworks:ListDataQualityTemplates",
          "dataworks:ListDataSourceSharedRules",
          "dataworks:ListDataSources",
          "dataworks:ListDatabases",
          "dataworks:ListDatasetVersions",
          "dataworks:ListDatasets",
          "dataworks:ListDpProject",
          "dataworks:ListEntitiesInMetaCollection",
          "dataworks:ListLineageRelationships",
          "dataworks:ListLineages",
          "dataworks:ListMeasureData",
          "dataworks:ListMeasuresGroupByModule",
          "dataworks:ListMetaCollections",
          "dataworks:ListNetworks",
          "dataworks:ListPartitions",
          "dataworks:ListProjectIds",
          "dataworks:ListProjectModules",
          "dataworks:ListRegions",
          "dataworks:ListSchemas",
          "dataworks:ListTables",
          "dataworks:ListTaskInstances",
          "dataworks:ListTaskOperationLogs",
          "dataworks:ListTenantMembers",
          "dataworks:ListTenantRoles",
          "dataworks:ListUserResources",
          "dataworks:OpenDataWorksStandardService",
          "dataworks:PreviewDatasetVersion",
          "dataworks:QueryDefaultTemplate",
          "dataworks:QueryDefaultTemplates",
          "dataworks:QueryRecognizeDataByRuleType",
          "dataworks:QueryRecognizeRuleDetail",
          "dataworks:QueryRecognizeRulesType",
          "dataworks:QuerySensClassification",
          "dataworks:QuerySensLevel",
          "dataworks:QuerySensNodeInfo",
          "dataworks:TestDataSourceConnectivity",
          "dataworks:UpdateComputeResource",
          "dataworks:UpdateDataSource"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允許不支援資源群組層級授權的全部操作：Action中列舉不支援資源群組層級授權的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dataworks:AddDpProjectSubUser",
          "dataworks:AddDpProjectUserRole",
          "dataworks:AddDpTenantSubUser",
          "dataworks:AddEntityIntoMetaCollection",
          "dataworks:AddRecognizeRule",
          "dataworks:AddTenantMemberToRole",
          "dataworks:BatchUpdateTasks",
          "dataworks:BindDpSubUserAk",
          "dataworks:BindDpUserAk",
          "dataworks:CheckAbTestFeatures",
          "dataworks:CheckCallback",
          "dataworks:CheckProjectIdentifier",
          "dataworks:CheckRamPermissions",
          "dataworks:CloneDataSource",
          "dataworks:CreateBusiness",
          "dataworks:CreateComponent",
          "dataworks:CreateComputeResource",
          "dataworks:CreateDIJob",
          "dataworks:CreateDataAssetTag",
          "dataworks:CreateDataQualityAlertRule",
          "dataworks:CreateDataQualityScan",
          "dataworks:CreateDataQualityScanRun",
          "dataworks:CreateDataQualityTemplate",
          "dataworks:CreateDataSource",
          "dataworks:CreateDataSourceSharedRule",
          "dataworks:CreateDataWorksPayAsYouGoService",
          "dataworks:CreateDataset",
          "dataworks:CreateDatasetVersion",
          "dataworks:CreateDpProject",
          "dataworks:CreateDpSubUser",
          "dataworks:CreateFile",
          "dataworks:CreateFolder",
          "dataworks:CreateIdentifyCredential",
          "dataworks:CreateLineageRelationship",
          "dataworks:CreateMetaCollection",
          "dataworks:CreateProjectRole",
          "dataworks:CreateResourceFile",
          "dataworks:CreateTenantRole",
          "dataworks:CreateUdfFile",
          "dataworks:CreateWorkflowInstances",
          "dataworks:DataWorksMember",
          "dataworks:DeleteBusiness",
          "dataworks:DeleteComponent",
          "dataworks:DeleteComputeResource",
          "dataworks:DeleteDataAssetTag",
          "dataworks:DeleteDataQualityAlertRule",
          "dataworks:DeleteDataQualityScan",
          "dataworks:DeleteDataQualityTemplate",
          "dataworks:DeleteDataSource",
          "dataworks:DeleteDataSourceSharedRule",
          "dataworks:DeleteDataset",
          "dataworks:DeleteDatasetVersion",
          "dataworks:DeleteDpProject",
          "dataworks:DeleteDpProjectSubUser",
          "dataworks:DeleteDpTenantSubUser",
          "dataworks:DeleteFile",
          "dataworks:DeleteFolder",
          "dataworks:DeleteLineageRelationship",
          "dataworks:DeleteMetaCollection",
          "dataworks:DeleteNetwork",
          "dataworks:DeleteProjectRole",
          "dataworks:DeleteRecognizeRule",
          "dataworks:DeleteTask",
          "dataworks:DeleteTenantRole",
          "dataworks:DeleteWorkflow",
          "dataworks:DeployFile",
          "dataworks:DsgDesensPlanAddOrUpdate",
          "dataworks:DsgDesensPlanDelete",
          "dataworks:DsgDesensPlanQueryList",
          "dataworks:DsgDesensPlanUpdateStatus",
          "dataworks:DsgPlatformQueryProjectsAndSchemaFromMeta",
          "dataworks:DsgQueryDesensStatusList",
          "dataworks:DsgQuerySensResult",
          "dataworks:DsgSceneAddOrUpdateScene",
          "dataworks:DsgSceneQuerySceneListByName",
          "dataworks:DsgScenedDeleteScene",
          "dataworks:DsgStopSensIdentify",
          "dataworks:DsgUpdateDesensStatusList",
          "dataworks:DsgUserGroupAddOrUpdate",
          "dataworks:DsgUserGroupDelete",
          "dataworks:DsgUserGroupGetOdpsRoleGroups",
          "dataworks:DsgUserGroupQueryList",
          "dataworks:DsgUserGroupQueryUserList",
          "dataworks:DsgWhiteListAddOrUpdate",
          "dataworks:DsgWhiteListDeleteList",
          "dataworks:DsgWhiteListQueryList",
          "dataworks:EditRecognizeRule",
          "dataworks:EstablishRelationTableToBusiness",
          "dataworks:ExecuteAdhocWorkflowInstance",
          "dataworks:GetBusiness",
          "dataworks:GetCatalog",
          "dataworks:GetColumn",
          "dataworks:GetComponent",
          "dataworks:GetComputeResource",
          "dataworks:GetConfig",
          "dataworks:GetCreateWorkflowInstancesResult",
          "dataworks:GetDataQualityAlertRule",
          "dataworks:GetDataQualityScan",
          "dataworks:GetDataQualityScanRun",
          "dataworks:GetDataQualityScanRunLog",
          "dataworks:GetDataQualityTemplate",
          "dataworks:GetDataSource",
          "dataworks:GetDatabase",
          "dataworks:GetDataset",
          "dataworks:GetDatasetVersion",
          "dataworks:GetDeploymentPackage",
          "dataworks:GetDpProjectCreationInfo",
          "dataworks:GetFile",
          "dataworks:GetFileVersion",
          "dataworks:GetFolder",
          "dataworks:GetIDEEventDetail",
          "dataworks:GetJobStatus",
          "dataworks:GetLineageRelationship",
          "dataworks:GetMetaCollection",
          "dataworks:GetNetwork",
          "dataworks:GetPartition",
          "dataworks:GetRerunWorkflowInstancesResult",
          "dataworks:GetSchema",
          "dataworks:GetTable",
          "dataworks:GetTask",
          "dataworks:GetTaskInstance",
          "dataworks:GetTaskInstanceLog",
          "dataworks:GetTenantRole",
          "dataworks:GetUser",
          "dataworks:GetWorkflow",
          "dataworks:GetWorkflowInstance",
          "dataworks:ImportCertificate",
          "dataworks:ListAlarmResource",
          "dataworks:ListBusiness",
          "dataworks:ListCatalogs",
          "dataworks:ListColumns",
          "dataworks:ListComponents",
          "dataworks:ListComputeResources",
          "dataworks:ListContacts",
          "dataworks:ListCrawlerTypes",
          "dataworks:ListDataAssetTags",
          "dataworks:ListDataAssets",
          "dataworks:ListDataQualityAlertRules",
          "dataworks:ListDataQualityScanRuns",
          "dataworks:ListDataQualityScans",
          "dataworks:ListDataQualityTemplates",
          "dataworks:ListDataSourceSharedRules",
          "dataworks:ListDataSources",
          "dataworks:ListDataWorksPayAsYouGoServices",
          "dataworks:ListDatabases",
          "dataworks:ListDatasetVersions",
          "dataworks:ListDatasets",
          "dataworks:ListDeploymentPackages",
          "dataworks:ListDownstreamTaskInstances",
          "dataworks:ListDownstreamTasks",
          "dataworks:ListDpProject",
          "dataworks:ListDpProjectUser",
          "dataworks:ListDpTenantUser",
          "dataworks:ListEntitiesInMetaCollection",
          "dataworks:ListFileVersions",
          "dataworks:ListFiles",
          "dataworks:ListFolders",
          "dataworks:ListLineageRelationships",
          "dataworks:ListLineages",
          "dataworks:ListMeasureData",
          "dataworks:ListMeasuresGroupByModule",
          "dataworks:ListMetaCollections",
          "dataworks:ListNetworks",
          "dataworks:ListPartitions",
          "dataworks:ListPermissions",
          "dataworks:ListProjectIds",
          "dataworks:ListProjectModules",
          "dataworks:ListProjectProcesses",
          "dataworks:ListRegions",
          "dataworks:ListResourceGroup",
          "dataworks:ListSchemas",
          "dataworks:ListTables",
          "dataworks:ListTaskInstanceOperationLogs",
          "dataworks:ListTaskInstances",
          "dataworks:ListTaskOperationLogs",
          "dataworks:ListTasks",
          "dataworks:ListTenantMembers",
          "dataworks:ListTenantRoles",
          "dataworks:ListUpstreamTaskInstances",
          "dataworks:ListUpstreamTasks",
          "dataworks:ListUserResources",
          "dataworks:ListWorkflowInstances",
          "dataworks:ListWorkflows",
          "dataworks:MetaListDpOuterResource",
          "dataworks:MetaListDpTable",
          "dataworks:ModifyContacts",
          "dataworks:ModifyResourceGroup",
          "dataworks:MoveComponent",
          "dataworks:OpenDataWorksStandardService",
          "dataworks:PreviewDatasetVersion",
          "dataworks:QueryDefaultTemplate",
          "dataworks:QueryDefaultTemplates",
          "dataworks:QueryRecognizeDataByRuleType",
          "dataworks:QueryRecognizeRuleDetail",
          "dataworks:QueryRecognizeRulesType",
          "dataworks:QuerySensClassification",
          "dataworks:QuerySensLevel",
          "dataworks:QuerySensNodeInfo",
          "dataworks:RemoveEntityFromMetaCollection",
          "dataworks:RemoveProjectMembers",
          "dataworks:RemoveTaskInstanceDependencies",
          "dataworks:RemoveTenantMemberFromRole",
          "dataworks:RerunTaskInstances",
          "dataworks:RerunWorkflowInstances",
          "dataworks:ResumeTaskInstances",
          "dataworks:RunIdentifyOpenapi",
          "dataworks:SetConfig",
          "dataworks:SetSuccessTaskInstances",
          "dataworks:ShowResourceGroupDetail",
          "dataworks:StartWorkflowInstances",
          "dataworks:StopTaskInstances",
          "dataworks:StopWorkflowInstances",
          "dataworks:SubmitFile",
          "dataworks:SuspendTaskInstances",
          "dataworks:SyncRAMContactInfo",
          "dataworks:TagDataAssets",
          "dataworks:TerminateDISyncInstance",
          "dataworks:TestDataSourceConnectivity",
          "dataworks:TriggerSchedulerTaskInstance",
          "dataworks:UnTagDataAssets",
          "dataworks:UpdateBusiness",
          "dataworks:UpdateColumnBusinessMetadata",
          "dataworks:UpdateComponent",
          "dataworks:UpdateComputeResource",
          "dataworks:UpdateContactInfo",
          "dataworks:UpdateDataAssetTag",
          "dataworks:UpdateDataQualityAlertRule",
          "dataworks:UpdateDataQualityEvaluationTask",
          "dataworks:UpdateDataQualityScan",
          "dataworks:UpdateDataQualityTemplate",
          "dataworks:UpdateDataSource",
          "dataworks:UpdateDataset",
          "dataworks:UpdateDatasetVersion",
          "dataworks:UpdateFile",
          "dataworks:UpdateFolder",
          "dataworks:UpdateIDEEventResult",
          "dataworks:UpdateMetaCollection",
          "dataworks:UpdateProjectRole",
          "dataworks:UpdateTableBusinessMetadata",
          "dataworks:UpdateTask",
          "dataworks:UpdateTaskInstances",
          "dataworks:UpdateTenantRole",
          "dataworks:UpdateUdfFile",
          "dataworks:UpdateWorkflow",
          "dataworks:createIdentifyCredential"
        ],
        "Resource": "*"
      }
    ]
  }
  

常見問題