Configure cross-account authorization

Perform operations with the Alibaba Cloud account to which the data source belongs

1. Log on to the Resource Access Management (RAM) console with the Alibaba Cloud account to which the data source belongs. Then, create a RAM role on the Roles page. For information about how to create a RAM role, see Create a RAM role for a trusted Alibaba Cloud account.

   Key parameters:

   • Principal Type: Set this parameter to Cloud Account.

   • Role Name: Specify a custom role name.

   • Principal Name: Set this parameter to Other Account, and enter the ID of the Alibaba Cloud account to which the DataWorks workspace belongs in the field that appears.

2. Grant permissions to the created RAM role. For information about how to grant permissions to a RAM role, see Method 2: Grant permissions to a RAM role by clicking Precise Permission on the Roles page.

   Key parameters:

   • Policy: Set this parameter to System Policy.

   • Policy Name: The following table provides the details.

     Data source type	Policy name

     Data source type	Policy name
     ApsaraDB RDS data sources that run the MySQL, SQL Server, PostgreSQL, or MariaDB engine	AliyunDataWorksAccessingRdsReadOnlyPolicy
     Hive	AliyunDataWorksAccessingDLFReadOnlyPolicy and AliyunDataWorksAccessingEMRReadOnlyPolicy
     Kafka	AliyunDataWorksAccessingAlikafkaPolicy

3. Modify the trust policy for the created RAM role. For information about how to modify the trust policy for a RAM role, see Example 1: Change the trusted entity of a RAM role to an Alibaba Cloud account.

   Trust policy after modification:

   {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Principal": {
                   "Service": [
                       "<ID of the Alibaba Cloud account of a DataWorks user>@cdp.aliyuncs.com"
                   ]
               }
           }
       ],
       "Version": "1"
   }

   Note

   Replace <ID of the Alibaba Cloud account of a DataWorks user> with the ID of the Alibaba Cloud account to which the DataWorks workspace belongs.