Realtime Compute for Apache Flink:Grant namespace permissions

Add a member

1. Make sure that you have the permissions to add members. Log on to the development console of Realtime Compute for Apache Flink. For example, members with the owner role can add members.

2. In the top navigation bar, select the namespace you want to manage from the drop-down list.

   

3. In the left-side navigation pane, click Security. On the page that appears, click the Members tab.

4. Click Add Member to add a member and configure the Role parameter for the member.

   

   • Select RAM account: Select an existing Resource Access Management (RAM) user or RAM role in the current Alibaba Cloud account. You can select multiple RAM users and RAM roles.

   • Add account manually: Enter the ID of another Alibaba Cloud account, a RAM user, or a RAM role that you want to add.

     Note

     For information about how to view the ID of an Alibaba Cloud account, a RAM user, or a RAM role, see View the ID of an Alibaba Cloud account, a RAM user, or a RAM role.

   • Role: Select a predefined or custom role from the drop-down list. To view the permissions of a specific role, find the role that you want to view on the Role Management tab and click View permissions in the Actions column.

5. Click OK.

6. The added member can log on to the development console of Realtime Compute for Apache Flink to access and use the namespace.

   Note

   If the member is already logged on, the member can refresh the page to access the namespace.

Modify and delete a member

• Modify a member

  Make sure that you have the permissions to modify members. Find the member you want to modify and click Edit in the Actions column. You can assign another predefined or custom role to the member. For information about how to view the permissions of an existing custom role, see View role permissions and members.

• Delete a member

  Make sure that you have the permissions to delete members. Find the member you want to delete and click Delete in the Actions column. After the operation, the member immediately loses access to the namespace.

Roles and permissions

Realtime Compute for Apache Flink supports the following roles:

• Predefined roles: owner, editor, and viewer. Predefined roles cannot be deleted and their permissions cannot be modified.

• Custom roles: Custom roles can be created, modified, and deleted by members with the owner role or a role that has the related permissions. A custom role must have a larger scope of permissions than the viewer role. You can create up to 10 custom roles in a namespace.

The following table describes the permissions of different roles.

Create a custom role

1. Make sure that you are assigned the owner role or a role that has the permissions to manage roles. Log on to the development console of Realtime Compute for Apache Flink.

2. In the top navigation bar, select the namespace you want to manage from the drop-down list.

   

3. In the left-side navigation pane, click Security. On the page that appears, click the Role Management tab.

4. Click Add Role and configure the parameters. The following table describes the parameters.

   Parameter	Description
   Role Name	Enter a name for the custom role. The name can be up to 64 characters in length and can contain digits, letters, and hyphens (-). The name must start with a letter.
   Role Notes	Enter a description or supplementary information for the role. For example, you can specify the purpose of the role or the scope of the permissions granted to the role. You can enter up to 256 characters.
   Role Permissions	Add permissions based on the viewer or editor role. A custom role must have a larger scope of permissions than the viewer role. When you add a permission, the associated permissions are automatically selected to ensure the integrity of access control. For information about the associated permissions of a specific permission, see the "Roles and permissions" section of this topic.

5. Click OK. The added role appears in the list.

View, modify, and delete a role

• View permissions and members associated with a role

  Click View permissions in the Actions column to view the permissions of the role. Click View Members to view all members to which the role is assigned.

• Modify role permissions

  • Predefined roles: You cannot modify the permissions of a predefined role.

  • Custom roles: If you have the permissions to modify a role, click Edit in the Actions column to add or remove permissions based on your business requirements.

• Delete a role

  • Predefined roles: You cannot delete a predefined role.

  • Custom roles: Before you delete a custom role, find the associated members and assign different roles to them or remove them from the namespace. This operation requires the permissions to manage members and reduces security risks. For information about how to manage members, see Modify and delete members. After you ensure that the role is not assigned to any members and you have the permissions to delete roles, click Delete in the Actions column to delete the role.