权限控制

DataHub采用阿里云RAM进行访问控制。用户对DataHub资源的访问，通过RAM进行鉴权。阿里云主账号拥有所属资源的所有权限，子用户在创建时并没有任何权限，不能访问任何资源，用户需要在RAM中对该子用户进行授权操作。关于如何创建RAM子用户与创建授权策略并进行授权可参见RAM使用文档。以下将介绍DataHub在RAM下的访问控制体系。

DataHub RAM权限控制

DataHub资源

DataHub在RAM的访问控制中的资源体系包含Project、Topic和Subscription。目前支持Project、Topic和Subscription级别的鉴权，并不支持Shard的访问控制。其中Subscription是指对某个特定Project下的Topic的一次订阅。

资源	RAM中的资源描述
Project	acs:dhs:$region:$accountid:projects/$projectName
Topic	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
Subscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId

DataHub API及对应在RAM中的授权策略

Project

API	Action	Resource
CreateProject	dhs:CreateProject	acs:dhs:$region:$accountid:projects/*
ListProject	dhs:ListProject	acs:dhs:$region:$accountid:projects/*
DeleteProject	dhs:DeleteProject	acs:dhs:$region:$accountid:projects/$projectName
GetProject	dhs:GetProject	acs:dhs:$region:$accountid:projects/$projectName

Topic

API	Action	Resource
CreateTopic	dhs:CreateTopic	acs:dhs:$region:$accountid:projects/$projectName/topics/*
ListTopic	dhs:ListTopic	acs:dhs:$region:$accountid:projects/$projectName/topics/*
DeleteTopic	dhs:DeleteTopic	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
GetTopic	dhs:GetTopic	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
UpdateTopic	dhs:UpdateTopic	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

Subscription

API	Action	Resource
CreateSubscription	dhs:CreateSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/*
DeleteSubscription	dhs:DeleteSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId
GetSubscription	dhs:GetSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId
UpdateSubscription	dhs:UpdateSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId
ListSubscription	dhs:ListSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/*
CommitOffset	dhs:GetSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId
GetOffset	dhs:GetSubscription	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/subscriptions/$subId

Connector

API	Action	Resource
CreateConnector	dhs:CreateConnector	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*
DeleteConnector	dhs:DeleteConnector	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*
GetConnector	dhs:GetConnector	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*
UpdateConnector	dhs:UpdateConnector	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*
ListConnector	dhs:ListConnector	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName/connectors/*

Shard

API	Action	Resource
ListShard	dhs:ListShard	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
MergeShard	dhs:UpdateShard	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
SplitShard	dhs:UpdateShard	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

PubSub

API	Action	Resource
PutRecords	dhs:PutRecords	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
GetRecords	dhs:GetRecords	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName
GetCursor	dhs:GetRecords	acs:dhs:$region:$accountid:projects/$projectName/topics/$topicName

DataHub支持的Condition

Condition	功能	合法取值
acs:SourceIp	指定ip网段	普通ip, 支持*通配
acs:SecureTransport	是否是https协议	true/false
acs:MFAPresent	是否多设备认证	true/false
acs:CurrentTime	指定访问时间	ISO8601格式

DataHub系统授权策略

DataHub授权策略在RAM系统中已有系统策略，用户可以根据需求直接添加系统策略。

AliyunDataHubFullAccess

包含DataHub相关的所有权限，一般用于管理DataHub资源。

AliyunDataHubReadOnlyAccess

只读访问DataHub服务的权限，可以查看DataHub所有的资源情况，例如查看project详细信息，列出project列表，读数据等等，但是不能更新、创建以及写数据。

AliyunDataHubSubscribeAccess

向DataHub订阅数据的权限，只包含和读数据相关的必要操作，包括GetTopic,ListShard,GetRecords以及订阅和点位相关的所有接口。

AliyunDataHubPublishAccess

向DataHub发布数据的权限，只包含和写数据相关的必要操作，包括GetTopic,ListShard以及PutRecords。

DataHub自定义授权策略

DataHub目前只有上述四种系统权限策略，如果无法满足需求，用户可以添加自定义权限策略。具体操作路径在RAM系统中：策略管理->自定义授权策略->新建授权策略。下面给出几个自定义策略示例：

WebConsole中显示

// 为了在WebConsole中能够显示拥有权限的project，需要在Statement中增加如下配置
// 因为WebConsole需要ListProject和GetProject，才能在页面展示project
{
  "Action": ["dhs:ListProject","dhs:GetProject"]，
  "Resource": "acs:dhs:*:*:projects/*",
  "Effect": "Allow"
}

WebConsole中创建topic

// 在WebConsole的project页面中显示topic需要ListTopic和GetTopic权限
// 如希望能够在WebConsole中的project：test下能够创建topic，可以使用如下配置
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:ListProject", "dhs:GetProject"],
      "Resource": "acs:dhs:*:*:projects/*",
      "Effect": "Allow"
    },
    {
      "Action": ["dhs:ListTopic", "dhs:GetTopic", "dhs:CreateTopic"],
      "Resource": "acs:dhs:*:*:projects/test/topics/*",
      "Effect": "Allow"
    }
  ]
}

其他自定义授权策略

//只允许用户获取指定Project下topic的信息
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:ListTopic", "dhs:GetTopic"],
      "Resource": "acs:dhs:cn-hangzhou:12121312:projects/foo/topics/*",
      "Effect": "Allow"
    }
  ]
}
// 新订阅功能授权Policy样例1: 给用户授权具有project foo下topic的所有订阅权限
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:*Subscription"],
      "Resource": "acs:dhs:cn-hangzhou:*:projects/foo/topics/*/subscriptions/*",
      "Effect": "Allow"
    }
  ]
}
// 新订阅功能授权Policy样例2: 给用户授权仅具有project foo下查询订阅的权限
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:ListSubscription"],
      "Resource": "acs:dhs:cn-hangzhou:*:projects/foo/topics/*/subscriptions/*",
      "Effect": "Allow"
    }
  ]
}
// 新订阅功能授权Policy样例3: 给用户授权仅具有project foo下的topic t1特定订阅'14985645198374IoCK'的提交点位权限
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:GetSubscription"],
      "Resource": "acs:dhs:cn-hangzhou:*:projects/foo/topics/t1/subscriptions/14985645198374IoCK",
      "Effect": "Allow"
    }
  ]
}
// 对指定Topic进行 Split/Merge shard, 包括ListShard, SplitShard, MergeShard
{
  "Version": "1",
  "Statement": [
    {
      "Action": ["dhs:*Shard"],
      "Resource": "acs:dhs:cn-hangzhou:12121312:projects/foo/topics/bar",
      "Effect": "Allow"
    }
  ]
}