Simple Log Service:Write data to MaxCompute by using a custom RAM role

Use the GUI to grant permissions to the RAM role

1. Modify the trust policy of the RAM role.

   1. Log on to the RAM console.

   2. In the left-side navigation pane, choose Identities > Roles.

   3. On the Roles page, click the RAM role that you want to manage.

   4. On the Trust Policy tab, click Edit Trust Policy.

   5. Replace the content in the code editor with the following policy document and click Save trust policy document:

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "log.aliyuncs.com",
                "dataworks.aliyuncs.com"
              ]
            }
          }
        ],
        "Version": "1"
      }

2. Add the RAM role as a workspace member.

   1. Log on to the DataWorks console.

   2. In the upper-left corner of the page that appears, select a region.

   3. In the left-side navigation pane, click Workspaces.

   4. On the Workspaces page, find the workspace that you want to manage and click Manage in the Actions column.

   5. On the Workspace Members tab of the Workspace page, click Add Members.

   6. In the Add Members dialog box, select and add the current logon account and the RAM role.

      In the Batch Assign Roles section, select Development. For more information, see Grant permissions to a RAM user.

3. Grant the RAM role the permissions to manage a MaxCompute table.

   1. On the Workspace page, choose Compute Engine Information > MaxCompute > Go to the MaxCompute Console.

   2. On the MaxCompute project management page, click Role Permissions. If the following error is reported, perform the following operations in the role list: Find the admin role and click Manage Members in the Actions column. In the Manage Members dialog box, select and add the current logon account.

   3. In the role list, find the role_project_admin role and click Manage Members in the Actions column.

   4. In the Manage Members dialog box, select and add the current logon account and the RAM role.

   5. In the role list, find the role_project_admin role and click Manage Members in the Actions column.

   6. On the Table tab of the Edit Role dialog box, find the MaxCompute table that you want to manage and select Describe, Alter, and Update.

After you configure the settings, you can assign the RAM role to a MaxCompute data shipping job of the new version to ship data to the specified MaxCompute table. When you create the data shipping job, select Custom Role for Write Permissions on MaxCompute and specify the Alibaba Cloud Resource Name (ARN) of the RAM role. Example: acs:ram::10**12:role/maxcomputeshiprole. For more information about how to obtain the ARN of a RAM role, see View the information about a RAM role.

Use the CLI to grant permissions to the RAM role

1. Log on to the DataWorks console.

2. In the upper-left corner of the page that appears, select a region.

3. In the left-side navigation pane, click Workspaces.

4. On the Workspaces page, find the workspace that you want to manage, move the pointer over Shortcuts, and then click Data Development.

5. Create a workflow.

   1. On the Scheduled Workflow page, choose Create > Create Workflow.

   2. In the Create Workflow dialog box, configure Workflow Name and click Create.

6. Create a node.

   1. On the Scheduled Workflow page, choose Create > Create Node > MaxCompute > ODPS SQL.

   2. In the Create Node dialog box, configure Name and Path, and click Confirm.

      You must set Path to the workflow that you created in Step 5.

7. In the code editor of the node, run the required commands to complete the authorization. The following table describes the commands.

   

   Command	Description
   USE project-name;	Specifies a MaxCompute project. The MaxCompute project must be the same as the MaxCompute project that you specified when you created your data shipping job of the new version. For more information, see Create a data shipping job of the new version to ship data to MaxCompute.
   ADD USER RAM$****.aliyunid.com:`role/maxcomputeshiprole`;	Adds the RAM role as a user to the MaxCompute project. ****.aliyunid.com specifies the Alibaba Cloud account to which the MaxCompute project belongs. You can run the list users; command to view the Alibaba Cloud account. maxcomputeshiprole specifies the name of the custom RAM role. The name must be in lowercase letters.
   GRANT CreateInstance ON PROJECT project-name TO USER RAM$*****:`role/maxcomputeshiprole`;	Grants the RAM role the permission to create instances in the specified MaxCompute project.
   GRANT DESCRIBE, ALTER, UPDATE ON TABLE table-name to user RAM$****.aliyunid.com:`role/maxcomputeshiprole`;	Grants the RAM role the permissions to view, modify, and update the specified MaxCompute table. Note The preceding authorization takes effect only on the specified MaxCompute table. If you want to grant the RAM role the permissions to manage all tables in the current MaxCompute project, run the GRANT admin to user RAM$****.aliyunid.com:`role/maxcomputeshiprole`; command to complete the authorization.
   SHOW GRANTS FOR `RAM$****.aliyunid.com:role/maxcomputeshiprole`;	Checks whether the authorization is successful.

   If information similar to the following code is returned, the authorization is successful:

   Authorization Type: ACL
   [user/RAM$****.aliyunid.com:role/maxcomputeshiprole]
   A       projects/default_project_****: CreateInstance
   A       projects/default_project_****/tables/****: Describe | Alter | Update

   The following error messages may appear during the authorization process:

   • If the FAILED: mismatched input error message appears, the RAM user does not have the permissions to execute statements such as ADD USER. For more information, see What do I do if the error message FAILED: mismatched input appears?

   • If the FAILED: ODPS-0130013:Authorization exception - Authorization Failed [4003], You have NO privilege to do the PROJECT SECURITY OPERATION for {acs:odps:*:projects/xxxxxx/authorization/users}. Context ID:1111-11111-1111-1111-11111. error message appears, the user does not have the permissions to manage MaxCompute projects or grant permissions to other users. For more information, see What do I do if the system reports an error that a user does not have the required permissions?