Realtime Compute for Apache Flink:Grant permissions on namespaces

Add a member

1. Log on to the development console of Realtime Compute for Apache Flink as a member who has the permissions to add members, such as a namespace owner.

2. In the top navigation bar, select the namespace that you want to manage from the drop-down list.

   

3. In the left-side navigation pane, choose security > Permissions. On the Permissions page, click the Members tab.

4. On the Members tab, click Add Member. In the Add Member dialog box, add a member and select a role for the member by configuring the following parameters.

   

   • Select RAM account: Select an existing Resource Access Management (RAM) user or RAM role in the current Alibaba Cloud account. You can select multiple RAM users and RAM roles.

   • Add account manually: Enter the ID of another Alibaba Cloud account, a RAM user, or a RAM role that you want to add.

     Note

     For more information about how to view the ID of an Alibaba Cloud account, a RAM user, or a RAM role, see the View the ID of an Alibaba Cloud account, a RAM user, or a RAM role section of this topic.

   • Role: Select a predefined or custom role from the drop-down list. To view the permissions of a role, find the role that you want to view on the Role Management tab and click View permissions in the Actions column.

5. Click OK.

6. The added member can log on to the development console of Realtime Compute for Apache Flink to access and use the namespace.

   Note

   If the member has already logged on, the member can refresh the page to access the namespace.

Modify and delete a member

• Modify a member

  Make sure that you have the permissions to modify members. On the Members tab, find the member who you want to modify and click Edit in the Actions column. You can assign another predefined or custom role to the member. For more information about how to view the permissions of an existing custom role, see the View permissions of and members associated with a role section of this topic.

• Delete a member

  Make sure that you have the permissions to delete members. On the Members tab, find the member who you want to delete and click Delete in the Actions column. After the member is deleted, the member immediately has no permission to access the namespace.

Roles and role permissions

Realtime Compute for Apache Flink supports the roles of the following types:

• Predefined roles: owner, editor, and viewer. Predefined roles cannot be deleted and their permissions cannot be modified.

• Custom roles: Custom roles can be created, modified, and deleted by members who are assigned the owner role or a role that has the related permissions. A custom role must have a larger scope of permissions than the viewer role. You can create up to 10 custom roles in a namespace.

The following table describes the permissions of different roles.

Create a custom role

1. Log on to the development console of Realtime Compute for Apache Flink as a member who is assigned the owner role or a role that has the permissions to manage roles.

2. In the top navigation bar, select the namespace that you want to manage from the drop-down list.

   

3. In the left-side navigation pane, choose security > Permissions. On the Permissions page, click the Role Management tab.

4. On the Role Management tab, click Add Role. In the Add a custom role panel, configure the parameters. The following table describes the parameters.

   Parameter	Description
   Role Name	The name of the custom role. The name can be up to 64 characters in length and can contain digits, letters, and hyphens (-). The name must start with a letter.
   Role Notes	The description or supplementary information of the role. For example, you can specify the purpose of the role or the scope of the permissions granted to the role. The description can be up to 256 characters.
   Role Permissions	Add permissions based on the viewer or editor role. A custom role must have a larger scope of permissions than the viewer role. When you add a permission, the associated permissions are automatically selected to ensure the integrity of access control. For more information about the associated permissions of a specific permission, see the "Roles and role permissions" section of this topic.

5. Click OK. The added role appears in the list.

View, modify, and delete a role

• View permissions of and members associated with a role

  On the Role Management tab, find the role that you want to manage and click View permissions in the Actions column to view the permissions of the role. Click View Members in the Actions column to view all members to which the role is assigned.

• Modify role permissions

  • Predefined roles: You cannot modify the permissions of a predefined role.

  • Custom roles: If you have the permissions to modify a role, click Edit in the Actions column to add or remove permissions based on your business requirements.

• Delete a role

  • Predefined roles: You cannot delete a predefined role.

  • Custom roles: Before you delete a custom role, find the associated members and assign different roles to the members or remove the members from the namespace. This operation requires the permissions to manage members and reduces security risks. For information about how to manage members, see the Modify and delete a member section of this topic. After you confirm that the role is not assigned to any members and you have the permissions to delete roles, click Delete in the Actions column to delete the role.