MaxCompute:Access control for packages

The following table describes the access control policies for packages that are provided by MaxCompute.

Parameters in the syntax:

• actions: required. The permissions that you want to grant. You can run the describe package project_name.package_name; command to query the permissions of the package.

• object_type: required. The type of the object in a package. You can run the describe package project_name.package_name; command to query the type of the object that is included in a package.

• object_name: required. The name of the object in a package. You can run the describe package project_name.package_name; command to query the name of the object that is included in a package.

• name: required. The name of the user or role to which you want to grant permissions. For more information about how to obtain user or role information, see View users or View roles.

• table_name: required. The name of the table on which you want to grant permissions. You can run the describe package project_name.package_name; command to query the name of the table that is included in a package.

• column_list: optional. The name of a column in the table. If you specify multiple column names, separate them with commas (,).

• "refobject"="true": required. This value true indicates that fine-grained access control is used for the package.

• "refproject"="<project_name>": required. The name of the MaxCompute project to which the package belongs.

• "package"="<package_name>": required. The name of the package.

Parameters in the syntax:

• number: the security level for sensitive data. For more information about label-based access control, see Label-based access control.

• table_name: required. The name of the table on which you want to grant permissions. You can run the describe package project_name.package_name; command to query the name of the table that is included in a package.

• column_list: optional. The name of a column in the table. If you specify multiple column names, separate them with commas (,).

• name: required. The name of the user or role to which you want to grant permissions. For more information about how to obtain user or role information, see View users or View roles.

• days: optional. The number of days for which a permission is valid. Unit: days. If you do not specify this parameter, the default value is 180.

• "refobject"="true": required. This value true indicates that fine-grained access control is used for the package.

• "refproject"="<project_name>": required. The name of the MaxCompute project to which the package belongs.

• "package"="<package_name>": required. The name of the package.

The following examples show the preceding access control methods based on the scenario examples in Cross-project resource access based on packages.

• Example 1: Perform ACL-based access control. John grants the SELECT permission on the sampletable table in the package to Bob.

  use prj2;
  -- Grant the SELECT permission on the sampletable table in the package to Bob. 
  grant Select on table sampletable to user aliyun$bob@aliyun.com privilegeproperties ("refobject"="true", "refproject"="prj1", "package"="datamining");
  
  -- View the ACL-based permissions on the sampletable table in the package. 
  show grants on table sampletable privilegeproperties ("refobject"="true", "refproject"="prj1", "package"="datamining");
  
  -- Revoke ACL-based permissions from Bob. 
  revoke Select on table sampletable from user aliyun$bob@aliyun.com privilegeproperties ("refobject"="true", "refproject"="prj1", "package"="datamining");

• Example 2: Perform label-based access control. In this example, the sampletable table has three columns t1, t2, and t3, in which t1 has a security level of 1, t2 has a security level of 2, and t3 has a security level of 3. John grants Bob the permissions on the data with the security level of 2 in the sampletable table in the package. The validity period of the permissions is seven days.

  use prj2;
  -- Enable LabelSecurity. 
  set LabelSecurity=true;
  
  -- Specify the security level for each column in the sampletable table. 
  set label 1 to table sampletable(t1);
  set label 2 to table sampletable(t2);
  set label 3 to table sampletable(t3);
  
  -- Grant Bob the permissions on the data that has a security level of 2 in the sampletable table. Set the validity period of the permissions to seven days. In the preceding example, Bob has the permissions to read data from the table. After you enable LabelSecurity, Bob has the permissions to read data from the t2 column of the table. 
  grant label 2 on table sampletable(t2) to user aliyun$bob@aliyun.com with exp 7 privilegeproperties ("refobject"="true", "refproject"="prj1", "package"="datamining");
  
  -- View the label-based permissions on the sampletable table in the package. 
  show label grants on table sampletable privilegeproperties ("refobject"="true", "refproject"="prj1", "package"="datamining");
  
  -- Revoke label-based permissions from Bob. 
  revoke label 2 on table sampletable(t2) from user aliyun$bob@aliyun.com privilegeproperties ("refobject"="true", "refproject"="prj1", "package"="datamining");

  Note

  If label-based access control is performed on table resources in a package, the resource provider must specify labels and the security levels of the labels when the resource provider grants other projects the permissions to use resources in the package. Sample command:

  allowproject<project_name>toinstallpackage<package_name>usinglabel<number>;