MaxCompute:ACL-based access control

The following table describes the use scenarios of the ACL-based access control method.

Before you use the ACL-based access control method, make sure that the following conditions are met:

• The account of the user to whom you want to grant permissions or the name of the role to which you want to grant permissions is obtained. The role or account is added to your MaxCompute project. If the account of the user is an Alibaba Cloud account, record the Alibaba Cloud account in the format of ALIYUN$<account_id>. If the account of the user is a RAM user, record the RAM user in the format of RAM$<account_id>:<RAM user ID>. If the account of the user is a RAM role, record the RAM role in the format of `RAM$<account_id>:role/<Name of the RAM role>`.

  You can run the list users; or list roles; command on the MaxCompute client to query the account or role name.

  If you want to add a user or role, see User planning and management or Role planning.

• The type of the object on which you want to grant permissions, the name of the object, and the actions that you want to allow on the object are obtained.

  For more information about object types and actions supported for each type of object, see MaxCompute permissions.

Before you use the ACL-based access control method, take note of the following limits:

• You can use the ACL-based access control method to grant the permissions only on an existing object and to an existing subject. If you delete an object and then create an object with the same name, the new object does not inherit the permissions on the deleted object.

• The ACL-based access control method does not support authorization by using the [with grant option] clause. For example, if User A authorizes User B to access an object, User B cannot authorize User C to access the same object.

• The ACL-based access control method is implemented based only on the whitelist mechanism. You cannot use this method to deny actions on objects.

Before you use the ACL-based access control method, take note of the following items:

• If you delete an object, MaxCompute revokes all permissions on the object that are granted by using the ACL-based access control method.

• After a user is removed, the permissions that are granted to the user are retained. If the user is added to the project again, the historical access permissions of the user are activated again. For more information about how to clear the residual permission information of a removed user, see Completely clear the residual permission information of a removed user.

The following code provides the syntaxes of the commands that you can use to perform ACL-based access control.

• Grant permissions

  grant <actions> on <object_type> <object_name> 
  [(<column_list>)] to <subject_type> <subject_name> 
  [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

• Revoke permissions

  revoke <actions> on <object_type> <object_name> 
  [(<column_list>)] from <subject_type> <subject_name>;

• Perform column-level access control

  grant <actions> on table <table_name> (<column_list>) to <subject_type> <subject_name>;
  revoke <actions> on table <table_name> (<column_list>) from <subject_type> <subject_name>;

The following table describes the parameters used in the preceding syntaxes.

For example, the Alibaba Cloud account Bob@aliyun.com (user ID: 5527xxxxxxxx5788) is the owner of the project test_project_a. Allen (user ID: 1652xxxxxxxxxx1538), Alice (user ID: 2763xxxxxxxxxx1649), and Tom (user ID: 3874xxxxxxxxxx1850) are the RAM users of the Alibaba Cloud account Bob@aliyun.com. In the following examples, commands are run on the MaxCompute client.

• Example 1: Grant permissions to a user

  In this example, a partitioned table named sale_detail is created in the project test_project_a. The Describe and Select permissions are granted to the RAM user Allen to allow Allen to read the metadata and data of the table. Sample commands:

  -- Go to the test_project_a project by using the Alibaba Cloud account Bob@aliyun.com. 
  use test_project_a; 
  -- Create a partitioned table named sale_detail in the project. 
  create table if not exists sale_detail
  (
  shop_name     string,
  customer_id   string,
  total_price   double
  )
  partitioned by (sale_date string, region string);
  --Add the RAM user Allen to the project as a member. 
  add user RAM$5527xxxxxxxx5788:1652xxxxxxxxxx1538;
  -- Grant the permissions to the RAM user Allen. 
  grant Describe, Select on table sale_detail to USER RAM$5527xxxxxxxx5788:1652xxxxxxxxxx1538;
  -- Query the authorization result. 
  show grants for RAM$5527xxxxxxxx5788:1652xxxxxxxxxx1538; 
  -- The following authorization result is returned: 
  Authorization Type: ACL
  [user/RAM$5527xxxxxxxx5788:1652xxxxxxxxxx1538]
  A       projects/test_project_a/tables/sale_detail: Describe | Select

• Example 2: Grant permissions to a user

  In this example, all permissions on the columns shop_name and customer_id in the table sale_detail created in Example 1 are granted to the RAM user Alice. Sample commands:

  -- Go to the test_project_a project by using the Alibaba Cloud account Bob@aliyun.com. 
  use test_project_a; 
  -- Add the RAM user Alice to the project as a member. 
  add user RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;
  -- Grant the permissions to the RAM user Alice. 
  grant All on table sale_detail (shop_name, customer_id) to USER RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;
  -- Query the authorization result. 
  show grants for RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649; 
  -- The following authorization result is returned: 
  Authorization Type: ACL
  [user/RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649]
  A       projects/test_project_a/tables/sale_detail/customer_id: All
  A       projects/test_project_a/tables/sale_detail/shop_name: All

• Example 3: Revoke permissions from a user

  In this example, the permissions that are granted to the RAM users Allen and Alice in Example 1 and Example 2 are revoked. Sample commands:

  -- Go to the test_project_a project by using the Alibaba Cloud account Bob@aliyun.com. 
  use test_project_a; 
  -- Revoke the Describe and Select permissions that are granted to the RAM user Allen. 
  revoke Describe, Select on table sale_detail (shop_name, customer_id) from USER RAM$5527xxxxxxxx5788:1652xxxxxxxxxx1538;
  -- Revoke the permissions on the table that are granted to the RAM user Alice. 
  revoke All on table sale_detail (shop_name, customer_id) from USER RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;
  -- Query the permissions of the RAM user Allen. The RAM user Allen does not have the Describe and Select permissions. 
  show grants for RAM$5527xxxxxxxx5788:1652xxxxxxxxxx1538; 
  -- Query the permissions of the RAM user Alice. The RAM user Alice does not have the permissions on the table. 
  show grants for RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649; 

• Example 4: Use a role to grant the same permissions to multiple users

  In this example, the RAM users Alice and Tom and the Alibaba Cloud account Lily@aliyun.com (user ID: 5638xxxxxxxx6899) are granted the CreateInstance, CreateResource, CreateFunction, CreateTable, and List permissions on the project test_project_a. Sample commands:

  -- Go to the test_project_a project by using the Alibaba Cloud account Bob@aliyun.com. 
  use test_project_a; 
  -- Add the RAM users Alice and Tom and the Alibaba Cloud account Lily@aliyun.com to the project as members. 
  add user RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;
  add user RAM$5527xxxxxxxx5788:3874xxxxxxxxxx1850;
  add user ALIYUN$5638xxxxxxxx6899;
  -- Create a role named Worker. 
  create role Worker; 
  -- Assign the role Worker to the three members. 
  grant Worker TO RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649; 
  grant Worker TO RAM$5527xxxxxxxx5788:3874xxxxxxxxxx1850; 
  grant Worker TO ALIYUN$5638xxxxxxxx6899; 
  -- Grant the CreateInstance, CreateResource, CreateFunction, CreateTable, and List permissions on the project to the role Worker. 
  grant CreateInstance, CreateResource, CreateFunction, CreateTable, List on project test_project_a TO ROLE Worker;
  -- Query the permissions of the Alibaba Cloud account Lily@aliyun.com. 
  show grants for ALIYUN$5638xxxxxxxx6899; 
  -- The following authorization result is returned: The authorization result shows that the Alibaba Cloud account Lily@aliyun.com is granted the preceding permissions. 
  [roles]
  worker
  
  Authorization Type: ACL
  [role/worker]
  A       projects/test_project_a: CreateTable | CreateResource | CreateInstance | CreateFunction | List

• Example 5: Revoke the same permissions that are granted by using a role from multiple users

  In this example, the same permissions that are granted to the RAM users Alice and Tom and the Alibaba Cloud account Lily@aliyun.com in Example 3 are revoked. Sample commands:

  -- Go to the test_project_a project by using the Alibaba Cloud account Bob@aliyun.com. 
  use test_project_a; 
  -- Revoke the role Worker from the RAM users Alice and Tom and the Alibaba Cloud account Lily@aliyun.com. 
  revoke Worker from RAM$5527xxxxxxxx5788:2763xxxxxxxxxx1649;
  revoke Worker from RAM$5527xxxxxxxx5788:3874xxxxxxxxxx1850;
  revoke Worker from ALIYUN$5638xxxxxxxx6899;
  -- Query the permissions of the Alibaba Cloud account Lily@aliyun.com. The Alibaba Cloud account Lily@aliyun.com does not have the permissions of the role Worker. 
  show grants for ALIYUN$5638xxxxxxxx6899; 

After you have a command of how the ACL-based access control method works, you can perform the following operations based on your business requirements:

• Perform access control based on project-level roles

• Manage user permissions by using commands

• Check permissions