全部产品
Search
文档中心

权限控制

更新时间: 2021-09-24

权限控制

DataHub采用阿里云RAM进行访问控制。用户对DataHub资源的访问,通过RAM进行鉴权。阿里云主账号拥有所属资源的所有权限,子用户在创建时并没有任何权限,不能访问任何资源,用户需要在RAM中对该子用户进行授权操作。关于如何创建RAM子用户与创建授权策略并进行授权可参见RAM使用文档。以下将介绍DataHub在RAM下的访问控制体系。

DataHub RAM权限控制

DataHub资源

DataHub在RAM的访问控制中的资源体系包含Project、Topic和Subscription。目前支持Project、Topic和Subscription级别的鉴权,并不支持Shard的访问控制。其中Subscription是指对某个特定Project下的Topic的一次订阅。

资源

RAM中的资源描述

Project

acs:dhs:$region:$accountid:projects/$projectName

Topic

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

Subscription

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId

DataHub API及对应在RAM中的授权策略

Project

API

Action

Resource

CreateProject

dhs:CreateProject

acs:dhs:$region:$accountid:projects/*

ListProject

dhs:ListProject

acs:dhs:$region:$accountid:projects/*

DeleteProject

dhs:DeleteProject

acs:dhs:$region:$accountid:projects/$projectName

GetProject

dhs:GetProject

acs:dhs:$region:$accountid:projects/$projectName

Topic

API

Action

Resource

CreateTopic

dhs:CreateTopic

acs:dhs:$region:$accountid:projects/$projectName/topics/*

ListTopic

dhs:ListTopic

acs:dhs:$region:$accountid:projects/$projectName/topics/*

DeleteTopic

dhs:DeleteTopic

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

GetTopic

dhs:GetTopic

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

UpdateTopic

dhs:UpdateTopic

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

Subscription

API

Action

Resource

CreateSubscription

dhs:CreateSubscription

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/*

DeleteSubscription

dhs:DeleteSubscription

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId

GetSubscription

dhs:GetSubscription

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId

UpdateSubscription

dhs:UpdateSubscription

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId

ListSubscription

dhs:ListSubscription

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/*

CommitOffset

dhs:GetSubscription

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId

GetOffset

dhs:GetSubscription

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId

Connector

API

Action

Resource

CreateConnector

dhs:CreateConnector

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*

DeleteConnector

dhs:DeleteConnector

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*

GetConnector

dhs:GetConnector

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*

UpdateConnector

dhs:UpdateConnector

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*

ListConnector

dhs:ListConnector

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*

Shard

API

Action

Resource

ListShard

dhs:ListShard

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

MergeShard

dhs:UpdateShard

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

SplitShard

dhs:UpdateShard

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

PubSub

API

Action

Resource

PutRecords

dhs:PutRecords

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

GetRecords

dhs:GetRecords

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

GetCursor

dhs:GetRecords

acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

DataHub支持的Condition

Condition

功能

合法取值

acs:SourceIp

指定ip网段

普通ip, 支持*通配

acs:SecureTransport

是否是https协议

true/false

acs:MFAPresent

是否多设备认证

true/false

acs:CurrentTime

指定访问时间

ISO8601格式

DataHub系统授权策略

DataHub授权策略在RAM系统中已有系统策略,用户可以根据需求直接添加系统策略。

AliyunDataHubFullAccess

包含DataHub相关的所有权限,一般用于管理DataHub资源。

AliyunDataHubReadOnlyAccess

只读访问DataHub服务的权限,可以查看DataHub所有的资源情况,例如查看project详细信息,列出project列表,读数据等等,但是不能更新、创建以及写数据。

AliyunDataHubSubscribeAccess

向DataHub订阅数据的权限,只包含和读数据相关的必要操作,包括GetTopic,ListShard,GetRecords以及订阅和点位相关的所有接口。

AliyunDataHubPublishAccess

向DataHub发布数据的权限,只包含和写数据相关的必要操作,包括GetTopic,ListShard以及PutRecords。

DataHub自定义授权策略

DataHub目前只有上述四种系统权限策略,如果无法满足需求,用户可以添加自定义权限策略。具体操作路径在RAM系统中:策略管理->自定义授权策略->新建授权策略。下面给出几个自定义策略示例:

WebConsole中显示

// 为了在WebConsole中能够显示拥有权限的project,需要在Statement中增加如下配置
// 因为WebConsole需要ListProject和GetProject,才能在页面展示project
{
  "Action": ["dhs:ListProject","dhs:GetProject"],
  "Resource": "acs:dhs:*:*:projects/*",
  "Effect": "Allow"
}

WebConsole中创建topic

// 在WebConsole的project页面中显示topic需要ListTopic和GetTopic权限
// 如希望能够在WebConsole中的project:test下能够创建topic,可以使用如下配置
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:ListProject", "dhs:GetProject"],
      "Resource": "acs:dhs:*:*:projects/*",
      "Effect": "Allow"
    },
    {
      "Action": ["dhs:ListTopic", "dhs:GetTopic", "dhs:CreateTopic"],
      "Resource": "acs:dhs:*:*:projects/test/topics/*",
      "Effect": "Allow"
    }
  ]
}

其他自定义授权策略

//只允许用户获取指定Project下topic的信息
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:ListTopic", "dhs:GetTopic"],
      "Resource": "acs:dhs:cn-hangzhou:12121312:projects/foo/topics/*",
      "Effect": "Allow"
    }
  ]
}
// 新订阅功能授权Policy样例1: 给用户授权具有project foo下topic的所有订阅权限
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:*Subscription"],
      "Resource": "acs:dhs:cn-hangzhou:*:projects/foo/topics/*/subscriptions/*",
      "Effect": "Allow"
    }
  ]
}
// 新订阅功能授权Policy样例2: 给用户授权仅具有project foo下查询订阅的权限
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:ListSubscription"],
      "Resource": "acs:dhs:cn-hangzhou:*:projects/foo/topics/*/subscriptions/*",
      "Effect": "Allow"
    }
  ]
}
// 新订阅功能授权Policy样例3: 给用户授权仅具有project foo下的topic t1特定订阅'14985645198374IoCK'的提交点位权限
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:GetSubscription"],
      "Resource": "acs:dhs:cn-hangzhou:*:projects/foo/topics/t1/subscriptions/14985645198374IoCK",
      "Effect": "Allow"
    }
  ]
}
// 对指定Topic进行 Split/Merge shard, 包括ListShard, SplitShard, MergeShard
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:*Shard"],
      "Resource": "acs:dhs:cn-hangzhou:12121312:projects/foo/topics/bar",
      "Effect": "Allow"
    }
  ]
}