MaxCompute:REVOKE

Prerequisites

Limits

Precautions

• Before you use the ACL-based access control method, take note of the following items:

  • If you delete an object, MaxCompute revokes all permissions on the object that are granted by using the ACL-based access control method.

  • After a user is removed, the permissions that are granted to the user are retained. If the user is added to the project again, the historical access permissions of the user are activated again. For more information about how to clear the residual permission information of a removed user, see Completely clear the residual permission information of a removed user.

• Before you use the policy-based access control method, take note of the following items:

  • You can use the policy-based access control method to grant permissions on an object that does not exist. If you delete an existing object whose permissions are granted, the permission information related to the object is retained. As a result, if you create an object that has the same name as the deleted object, security risks may exist.

  • After a user is removed, the permissions that are granted to the user are retained. If the user is added to the project again, the historical access permissions of the user are activated again. For more information about how to clear the residual permission information of a removed user, see Completely clear the residual permission information of a removed user.

Syntax

• Disable ACL-based access control

  revoke <actions> on <object_type> <object_name> 
  [(<column_list>)] from <subject_type> <subject_name>;

• Disable policy-based access control

  revoke <actions> on <object_type> <object_name> 
  from ROLE <role_name> 
  privilegeproperties ("policy" = "true", "allow"="{true|false}");

Parameters

Environment

Examples

Revoke access permissions on a package from a user or role

Revoke the access permissions on a package from a user or role in the MaxCompute project where the package is installed.

• Syntax

  revoke <actions> on package <project_name>.<package_name> from {USER|ROLE} <name>;

• Parameters

  Parameter	Required	Description
  actions	Yes	The action on resources in a package. Set the value to Read.
  project_name	Yes	The name of the MaxCompute project to which the package belongs. Log on to the MaxCompute console. In the top navigation bar, select a region. On the Project management tab, obtain the name of the MaxCompute project.
  package_name	Yes	The name of the package. You can execute the show packages; statement on the MaxCompute client to obtain the information about the package that you created.
  name	Yes	The name of the user account or role from which you want to revoke the access permissions on the package. You can specify only one user account or role in a single statement. You can run the list users; or list roles; command on the MaxCompute client to obtain the name of the user account or role.

• Examples

  Revoke the access permissions on the specified package from Bella. Sample statement:

  -- Revoke the access permissions on the specified package from Bella. 
  revoke Read on package test_project_a.datashare from user RAM$Amy@aliyun.com:Bella;

Revoke label-based permissions granted by using explicit authorization

The project owner or a user who is assigned the Admin role revokes label-based permissions that are granted by using explicit authorization.

• Syntax

  revoke Label on table <table_name> [(<column_list>)] from {USER|ROLE} <name>;

• Precautions

  • If you revoke explicitly configured label-based permissions on a table, the explicitly configured label-based permissions on the columns in the table are also revoked.

  • If you revoke explicitly configured label-based permissions, the access-level labels that are configured for users or roles are not affected. For example, label-based access control allows a user whose access level is 2 to access the table data whose sensitivity level is lower than or equal to 3. If you disable label-based access control, the user can access the table data whose sensitivity level is lower than or equal to 2.

• Parameters

  Parameter	Required	Description
  table_name	Yes	The name of the table or view. You can run the show tables; command on the MaxCompute client to obtain the name of the table or view.
  column_list	No	This parameter is required if you want to revoke the permission to access sensitive data of a specified column in a table or view. You can specify multiple column names. Separate column names with commas (,).
  name	Yes	The name of the user or role. You can run the list users; or list roles; command on the MaxCompute client to obtain the name of the user account or role.

• Examples

  In these examples, the test_project_a project stores a table named sale_detail that contains the shop_name, customer_id, and total_price columns. Bob@aliyun.com is the owner of the test_project_a project. Allen is a RAM user that belongs to the Alibaba Cloud account Bob@aliyun.com and is added to the test_project_a project.

  Revoke the permissions to access data with high sensitivity levels from Allen. Sample statements:

  -- Revoke the permissions to access data whose sensitivity level is lower than or equal to 3 in the shop_name, customer_id, and total_price columns of the sale_detail table from Allen. 
  revoke Label on table sale_detail(shop_name, customer_id, total_price) from USER RAM$Bob@aliyun.com:Allen;
  -- View the permissions that are granted to Allen. 
  show label grants on table sale_detail for USER RAM$Bob@aliyun.com:Allen;
  -- The following result is returned: 
  User Label: 1
  +-------------+--------------+--------------------------+
  | Column      | GrantedLabel | Expires                  |
  +-------------+--------------+--------------------------+
  | total_price | 3            | 2021-12-31T19:56:18+0800 |
  +-------------+--------------+--------------------------+
  -- Revoke the permissions to access sensitive data in the sale_detail table from Allen. 
  revoke Label on table sale_detail from USER RAM$Bob@aliyun.com:Allen; 
  -- View the permissions that are granted to Allen. 
  show label grants on table sale_detail for USER RAM$Bob@aliyun.com:Allen;
  -- The following result is returned: 
  User Label: 1

Revoke a user from a role

Revokes a user from a specific role.

• Syntax

  revoke <role_name> from <user_name>;

• Parameters

  • role_name: required. The name of the role from which you want to revoke a user.

  • user_name: required. The name of the Alibaba Cloud account or RAM user that you want to revoke. The format of an Alibaba Cloud account is ALIYUN$****@aliyun.com;. The format of a RAM user is RAM$****.

• Examples

  -- Revoke the Alibaba Cloud account alice@aliyun.com from the player role. 
  revoke player from ALIYUN$alice@aliyun.com;

Related statements

• CREATE PACKAGE: creates a package.

• CREATE ROLE: creates a role in a MaxCompute project.

• SET LABEL: MaxCompute provides the label-based access control method. You can use this method to configure access level labels for users or roles and sensitivity level labels for table data or column data at the project level.

• GRANT: MaxCompute provides the ACL-based access control method. You can use this method to grant permissions on an object to a user or role to allow one or more specified actions on an object.