MaxCompute:Policy-based access control

Before you use the policy-based access control method, make sure that the following conditions are met:

• The name of the role to which you want to grant permissions is obtained, and the role is added to your MaxCompute project.

  You can run the list roles; command on the MaxCompute client to query the name of the role.

  For more information about how to create a role, see Role planning.

• The type of the object on which you want to grant permissions, the name of the object, and the actions that you want to allow on the object are obtained.

  For more information about object types and actions supported for each type of object, see MaxCompute permissions.

Before you use the policy-based access control method, take note of the following items:

• If both the whitelist and blacklist mechanisms are used, the blacklist mechanism takes precedence.

• You can use the policy-based access control method to grant a role the permissions on an object that does not exist. If you delete an existing object whose permissions are granted to a role, the permission information related to the object is retained. As a result, if you create an object that has the same name as the deleted object, security risks may exist.

• After a user is removed, the permissions that are granted to the user are retained. If the user is added to the project again, the historical access permissions of the user are activated again. For more information about how to clear the residual permission information of a removed user, see Completely clear the residual permission information of a removed user.

The following code provides the syntaxes of the commands that you can use to perform policy-based access control:

• Grant permissions

  grant <actions> on <object_type> <object_name> 
  to ROLE <role_name> 
  privilegeproperties("policy" = "true", "allow"="{true|false}"[, "conditions"= "<conditions>"]);

• Revoke permissions

  revoke <actions> on <object_type> <object_name> 
  from ROLE <role_name> 
  privilegeproperties ("policy" = "true", "allow"="{true|false}");

The following table describes the parameters used in the preceding syntaxes.

For example, the Alibaba Cloud account Bob@aliyun.com is the owner of the project test_project_a. Allen and Tom are the RAM users of Bob@aliyun.com. The RAM user Allen is assigned the Admin role of the project test_project_a. In the following examples, all the authorization operations are performed on the MaxCompute client.

• Example 1: Use a role to grant permissions to a user based on the blacklist mechanism

  In this example, the Drop permission is granted to the RAM user Tom. This way, the RAM user Tom is denied from dropping tables whose names start with tb_ from the project test_project_a.

  • Use ACL-based commands to perform policy-based access control:

    -- Go to the test_project_a project by using the Alibaba Cloud account Bob@aliyun.com. 
    use test_project_a; 
    -- Create a role named Worker. 
    create role Worker; 
    -- Add the RAM user Tom to the project as a member. 
    add user RAM$Bob@aliyun.com:Tom;
    -- Assign the role Worker to the RAM user Tom. 
    grant Worker TO RAM$Bob@aliyun.com:Tom; 
    -- Deny the role Worker from dropping tables whose names start with tb_ from the project test_project_a. 
    grant Drop on table tb_* to ROLE Worker privilegeproperties("policy" = "true", "allow"="false");
    -- Query the permissions of the RAM user Tom. 
    show grants for RAM$Bob@aliyun.com:Tom; 
    -- The following authorization result is returned. The result D indicates Deny. The RAM user Tom is denied from dropping tables whose names start with tb_ from the project. 
    Authorization Type: Policy
    [role/worker]
    D      projects/test_project_a/tables/tb_*: Drop

  • Perform policy-based access control in the MaxCompute console.

    1. Log on to the MaxCompute console, and select a region in the top navigation bar.

    2. In the left-side navigation pane, click Projects.

    3. On the Projects page, find the desired project and click Manage in the Actions column.

    4. On the Role Permissions tab, click Create Project-level Role.

    5. In the Create Role dialog box, set Role Type to Resource, configure the Role Name parameter, and then set Authorization Method to Policy.

       Enter the following policy document:

       {
           "Statement":[
               {
                   "Action":[
                       "odps:Drop"
                   ],
                   "Effect":"Deny",
                   "Resource":[
                       "acs:odps:*:projects/test_project_a/tables/tb_*"
                   ]
               }
           ],
           "Version":"1"
       }

    6. On the Role Permissions tab, find the role that you created and click Manage Members in the Actions column. In the dialog box that appears, select RAM$Bob@aliyun.com:Tom from the Accounts to Be Added section, click the rightwards arrow to add the selected object to the Added Accounts section, and then click OK.

• Example 2: Revoke the permissions that are granted by using the policy-based access control method based on the blacklist mechanism from a user

  In this example, the Drop permission that is granted to the RAM user Tom in Example 1 is revoked.

  -- Go to the test_project_a project by using the Alibaba Cloud account Bob@aliyun.com. 
  use test_project_a; 
  -- Revoke the role Worker from the RAM user Tom. 
  revoke Worker from RAM$Bob@aliyun.com:Tom;
  -- Query the permissions of the RAM user Tom. The RAM user Tom does not have the Drop permission. 
  show grants for RAM$Bob@aliyun.com:Tom; 

• Example 3: Use a role to grant permissions to a user based on the whitelist mechanism

  In this example, the Update permission is granted to the RAM user Tom to allow Tom to update tables whose names start with tb_ in the project test_project_a.

  • Use ACL-based commands to perform policy-based access control:

    -- Go to the test_project_a project by using the Alibaba Cloud account Bob@aliyun.com. 
    use test_project_a; 
    -- Create a role named Worker. 
    create role Worker; 
    -- Add the RAM user Tom to the project as a member. 
    add user RAM$Bob@aliyun.com:Tom;
    -- Assign the role Worker to the RAM user Tom. 
    grant Worker TO RAM$Bob@aliyun.com:Tom; 
    -- Allow the role Worker to update tables whose names start with tb_ in the project test_project_a. 
    grant Update on table tb_* to ROLE Worker privilegeproperties("policy" = "true", "allow"="true");
    -- Query the permissions of the RAM user Tom. 
    show grants for RAM$Bob@aliyun.com:Tom; 
    -- The following authorization result is returned. The result A indicates Allow. The RAM user Tom is allowed to update the tables whose names start with tb_ in the project. 
    Authorization Type: Policy
    [role/worker]
    A       projects/test_project_a/tables/tb_*: Update

  • Perform policy-based access control in the MaxCompute console.

    1. Log on to the MaxCompute console, and select a region in the top navigation bar.

    2. In the left-side navigation pane, click Projects.

    3. On the Projects page, find the desired project and click Manage in the Actions column.

    4. On the Role Permissions tab, click Create Project-level Role.

    5. In the Create Role dialog box, set Role Type to Resource, specify the Role Name parameter, and set Authorization Method to Policy.

       Enter the following policy document:

       {
           "Statement":[
               {
                   "Action":[
                       "odps:Update"
                   ],
                   "Effect":"Allow",
                   "Resource":[
                       "acs:odps:*:projects/test_project_a/tables/tb_*"
                   ]
               }
           ],
           "Version":"1"
       }

    6. On the Role Permissions tab, find the role that you created and click Manage Members in the Actions column. In the dialog box that appears, select RAM$Bob@aliyun.com:Tom from the Accounts to Be Added section, click the rightwards arrow to add the selected object to the Added Accounts section, and then click OK.

• Example 4: Revoke the permissions that are granted by using the policy-based access control method based on the whitelist mechanism from a user

  In this example, the Update permission that is granted to the RAM user Tom in Example 3 is revoked.

  -- Go to the test_project_a project by using the Alibaba Cloud account Bob@aliyun.com. 
  use test_project_a; 
  -- Revoke the role Worker from the RAM user Tom. 
  revoke Worker from RAM$Bob@aliyun.com:Tom;
  -- Query the permissions of the RAM user Tom. The RAM user Tom does not have the Update permission. 
  show grants for RAM$Bob@aliyun.com:Tom; 

• Example 5: Grant finer-grained permissions to a user that is assigned a built-in role

  In this example, the RAM user Allen is denied from dropping any table from the project test_project_a.

  • Use ACL-based commands to perform policy-based access control:

    -- Go to the test_project_a project by using the Alibaba Cloud account Bob@aliyun.com. 
    use test_project_a; 
    -- Create a role named Worker. 
    create role Worker; 
    -- Assign the role Worker to the RAM user Allen. 
    grant Worker TO RAM$Bob@aliyun.com:Allen; 
    -- Deny the role Worker from dropping any table from the project test_project_a. 
    grant Drop on table * to ROLE Worker privilegeproperties("policy" = "true", "allow"="false");
    -- Query the permissions of the RAM user Allen. 
    show grants for RAM$Bob@aliyun.com:Allen; 
    -- The following authorization result is returned. The RAM user Allen is denied from dropping any table from the project. 
    [roles]
    role_project_admin, worker
    
    Authorization Type: Policy
    [role/role_project_admin]
    A       projects/test_project_a: *
    A       projects/test_project_a/instances/*: *
    A       projects/test_project_a/jobs/*: *
    A       projects/test_project_a/offlinemodels/*: *
    A       projects/test_project_a/packages/*: *
    A       projects/test_project_a/registration/functions/*: *
    A       projects/test_project_a/resources/*: *
    A       projects/test_project_a/tables/*: *
    A       projects/test_project_a/volumes/*: *
    
    [role/worker]
    A       projects/test_project_a/tables/tb_*: Update
    D       projects/test_project_a/tables/*: Drop
    -- A in AG indicates Allow. G in AG indicates With Grant Option, which authorizes the account to grant permissions on objects.
    Authorization Type: ObjectCreator
    AG      projects/test_project_a/tables/local_test: All
    AG      projects/test_project_a/tables/mr_multiinout_out1: All
    AG      projects/test_project_a/tables/mr_multiinout_out2: All
    AG      projects/test_project_a/tables/ramtest: All
    AG      projects/test_project_a/tables/wc_in: All
    AG      projects/test_project_a/tables/wc_in1: All
    AG      projects/test_project_a/tables/wc_in2: All
    AG      projects/test_project_a/tables/wc_out: All

  • Perform policy-based access control in the MaxCompute console.

    1. Log on to the MaxCompute console, and select a region in the top navigation bar.

    2. In the left-side navigation pane, click Projects.

    3. On the Projects page, find the desired project and click Manage in the Actions column.

    4. On the Role Permissions tab, click Create Project-level Role.

    5. In the Create Role dialog box, set Role Type to Resource, specify the Role Name parameter, and set Authorization Method to Policy.

       Enter the following policy document:

       {
           "Statement":[
               {
                   "Action":[
                       "odps:Drop"
                   ],
                   "Effect":"Deny",
                   "Resource":[
                       "acs:odps:*:projects/test_project_a/tables/*"
                   ]
               }
           ],
           "Version":"1"
       }

    6. On the Role Permissions tab, find the role that you created and click Manage Members in the Actions column. In the dialog box that appears, select RAM$Bob@aliyun.com:Allen from the Accounts to Be Added section, click the rightwards arrow to add the selected object to the Added Accounts section, and then click OK.

• Example 6: Revoke permissions from a user that is assigned a built-in role

  In this example, the Drop permission that is granted to the RAM user Allen in Example 5 is revoked. Sample statements:

  -- Go to the test_project_a project by using the Alibaba Cloud account Bob@aliyun.com. 
  use test_project_a; 
  -- Revoke the role Worker from the RAM user Allen. 
  revoke Worker from RAM$Bob@aliyun.com:Allen;
  -- Query the permissions of the RAM user Allen. The RAM user Allen does not have the Drop permission. 
  show grants for RAM$Bob@aliyun.com:Allen; 

• Example 7: Assign a role to the RAM user Tom, and grant the permissions to query all tables to the role based on the whitelist mechanism.

  • Use ACL-based commands to perform policy-based access control:

    -- Go to the test_project_a project by using the Alibaba Cloud account Bob@aliyun.com. 
    use test_project_a;
    -- Create a role named Worker. 
    create role Worker;
    -- Add the RAM user Tom to the project as a member. 
    add user RAM$Bob@aliyun.com:Tom;
    -- Assign the role Worker to the RAM user Tom. 
    grant Worker TO RAM$Bob@aliyun.com:Tom;
    -- Grant the permissions to query all tables in the project test_project_a to the role Worker. 
    grant Describe,select on table * to ROLE Worker privilegeproperties("policy" = "true", "allow"="true");
    -- Query the authorization result. 
    show grants for RAM$Bob@aliyun.com:Tom;
    -- The following authorization result is returned. The result A indicates Allow. The RAM user Tom is allowed to query all tables in the project. 
    Authorization Type: Policy
    [role/worker]
    A      projects/test_project_a/tables/*: Describe | Select

  • Perform policy-based access control in the MaxCompute console.

    1. Log on to the MaxCompute console, and select a region in the top navigation bar.

    2. In the left-side navigation pane, click Projects.

    3. On the Projects page, find the desired project and click Manage in the Actions column.

    4. On the Role Permissions tab, click Create Project-level Role.

    5. In the Create Role dialog box, set Role Type to Resource, specify the Role Name parameter, and set Authorization Method to Policy.

       Enter the following policy document:

       {
           "Statement":[
               {
                   "Action":[
                       "odps:Describe",
                       "odps:Select"
                   ],
                   "Effect":"Allow",
                   "Resource":[
                       "acs:odps:*:projects/test_project_a/tables/*"
                   ]
               }
           ],
           "Version":"1"
       }

    6. On the Role Permissions tab, find the role that you created and click Manage Members in the Actions column. In the dialog box that appears, select RAM$Bob@aliyun.com:Tom from the Accounts to Be Added section, click the rightwards arrow to add the selected object to the Added Accounts section, and then click OK.

After you have a command of how the policy-based access control method works, you can perform the following operations based on your business requirements:

• Perform access control based on project-level roles

• Manage user permissions by using commands

• Check permissions