全部产品
Search

搜索本产品

    开源大数据平台E-MapReduce：RAM用户授权

    文档中心

    开源大数据平台E-MapReduce：RAM用户授权

    更新时间：Dec 10, 2024

    当RAM用户（子账号）进行EMR Serverless Spark操作，例如创建、查看或删除工作空间等操作时，必须具有相应的权限。本文为您介绍如何进行RAM授权。

    前提条件

    已创建RAM用户。具体操作，请参见创建RAM用户。

    操作步骤

    1. 使用RAM管理员登录RAM控制台。

    2. 在左侧导航栏，选择身份管理 > 用户。

    3. 在用户页面，单击目标RAM用户操作列的添加权限。

      image

      您也可以选中多个RAM用户，单击用户列表下方的添加权限，为RAM用户批量授权。

    4. 在新增授权面板，为RAM用户添加相应的权限。

      image.png

      参数

      说明

      授权范围

      选择所需的应用范围：

      • 账号级别：权限在当前阿里云账号内生效。

      • 资源组级别：权限在指定的资源组内生效。

      授权主体

      被授权主体，即需要授权的RAM用户，系统会自动填入当前的RAM用户，您也可以添加其他RAM用户。

      选择权限

      支持的系统策略如下：

      • AliyunEMRServerlessSparkFullAccess：EMR Serverless Spark管理员权限，包含创建、删除工作空间权限。

        AliyunEMRServerlessSparkFullAccess权限内容

        {
  "Version": "1",
  "Statement": [
    {
      "Action": "emr-serverless-spark:*",
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "oss:ListBuckets",
        "dlf:DescribeRegions",
        "dlf:GetRegionStatus",
        "dlf:ListCatalogs",
        "emr:GetApmData",
        "emr:QueryApmGrafanaData"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:CreateServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "spark.emr-serverless.aliyuncs.com"
        }
      }
    }
  ]
}

      • AliyunEMRServerlessSparkDeveloperAccess：EMR Serverless Spark的开发者权限，不包括创建、删除工作空间权限。

        AliyunEMRServerlessSparkDeveloperAccess权限内容

        {
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "emr-serverless-spark:AddMembers",
                "emr-serverless-spark:BindSessionCluster",
                "emr-serverless-spark:CancelJobRun",
                "emr-serverless-spark:CancelRun",
                "emr-serverless-spark:Check*",
                "emr-serverless-spark:CommitTask",
                "emr-serverless-spark:CreateArtifact",
                "emr-serverless-spark:CreateCatalog",
                "emr-serverless-spark:CreateCategory",
                "emr-serverless-spark:CreateComputeToken",
                "emr-serverless-spark:CreateEmrSparkServiceLinkedRole",
                "emr-serverless-spark:CreateEnvironment",
                "emr-serverless-spark:CreateJobRunDeployment",
                "emr-serverless-spark:CreateLivyCompute",
                "emr-serverless-spark:CreateLivyComputeToken",
                "emr-serverless-spark:CreateNetworkService",
                "emr-serverless-spark:CreateProcessDefinitionWithSchedule",
                "emr-serverless-spark:CreateRole",
                "emr-serverless-spark:CreateSessionCluster",
                "emr-serverless-spark:CreateSessionStatement",
                "emr-serverless-spark:CreateSqlStatement",
                "emr-serverless-spark:CreateTask",
                "emr-serverless-spark:CreateTaskInstance",
                "emr-serverless-spark:CreateTemplate",
                "emr-serverless-spark:CreateWorkspaceQueue",
                "emr-serverless-spark:DeleteArtifact",
                "emr-serverless-spark:DeleteCatalog",
                "emr-serverless-spark:DeleteCategory",
                "emr-serverless-spark:DeleteComputeToken",
                "emr-serverless-spark:DeleteEnvironment",
                "emr-serverless-spark:DeleteJobRunDeployment",
                "emr-serverless-spark:DeleteLivyCompute",
                "emr-serverless-spark:DeleteLivyComputeSession",
                "emr-serverless-spark:DeleteLivyComputeToken",
                "emr-serverless-spark:DeleteNetworkService",
                "emr-serverless-spark:DeleteProcessDefinitionByCode",
                "emr-serverless-spark:DeleteProcessDefinitionVersion",
                "emr-serverless-spark:DeleteRole",
                "emr-serverless-spark:DeleteSessionCluster",
                "emr-serverless-spark:DeleteTask",
                "emr-serverless-spark:DeleteWorkspaceQueue",
                "emr-serverless-spark:EditCatalog",
                "emr-serverless-spark:EditEnvironment",
                "emr-serverless-spark:EditSessionCluster",
                "emr-serverless-spark:EditWorkspaceQueue",
                "emr-serverless-spark:Execute",
                "emr-serverless-spark:ForceTaskInstanceSuccess",
                "emr-serverless-spark:GenerateComputeToken",
                "emr-serverless-spark:GenerateLivyComputeToken",
                "emr-serverless-spark:GenerateTaskCodes",
                "emr-serverless-spark:Get*",
                "emr-serverless-spark:GrantActionsToRole",
                "emr-serverless-spark:GrantRoleToUsers",
                "emr-serverless-spark:List*",
                "emr-serverless-spark:PublishWorkflowDefinition",
                "emr-serverless-spark:Query*",
                "emr-serverless-spark:RefreshLivyComputeToken",
                "emr-serverless-spark:ReleaseWorkflowAndSchedule",
                "emr-serverless-spark:RemoveMember",
                "emr-serverless-spark:RevokeActionsToRole",
                "emr-serverless-spark:RevokeRoleFromUsers",
                "emr-serverless-spark:StartHmsProxyServer",
                "emr-serverless-spark:StartJobRun",
                "emr-serverless-spark:StartJobRunDeployment",
                "emr-serverless-spark:StartLivyCompute",
                "emr-serverless-spark:StartProcessInstance",
                "emr-serverless-spark:StartRun",
                "emr-serverless-spark:StartSessionCluster",
                "emr-serverless-spark:StopJobRunDeployment",
                "emr-serverless-spark:StopLivyCompute",
                "emr-serverless-spark:StopSessionCluster",
                "emr-serverless-spark:SwitchProcessDefinitionVersion",
                "emr-serverless-spark:TearDownHmsProxyServer",
                "emr-serverless-spark:TerminateSessionStatement",
                "emr-serverless-spark:TerminateSqlStatement",
                "emr-serverless-spark:TestHmsConnection",
                "emr-serverless-spark:UnbindSessionCluster",
                "emr-serverless-spark:UpdateCategory",
                "emr-serverless-spark:UpdateComputeToken",
                "emr-serverless-spark:UpdateJobRunDeployment",
                "emr-serverless-spark:UpdateLivyCompute",
                "emr-serverless-spark:UpdateProcessDefinitionWithSchedule",
                "emr-serverless-spark:UpdateResourceAcl",
                "emr-serverless-spark:UpdateTask",
                "emr-serverless-spark:ValidateCode"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "dlf:DescribeRegions",
                "dlf:GetRegionStatus",
                "dlf:ListCatalogs",
                "dlf:ListDatabases",
                "dlf:ListTables",
                "emr:GetApmData",
                "emr:QueryApmGrafanaData"
            ],
            "Resource": "*"
        }
    ]
}

      • AliyunEmrServerlessSparkReadOnlyAccess：EMR Serverless Spark只读权限，包含了只读访问Spark服务的权限。

        AliyunEmrServerlessSparkReadOnlyAccess权限内容

        {
    "Statement": [
        {
            "Action": [
                "emr-serverless-spark:Get*",
                "emr-serverless-spark:List*",
                "emr-serverless-spark:Query*",
                "emr-serverless-spark:Is*",
                "emr-serverless-spark:Check*"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ],
    "Version": "1"
}

    5. 单击确认新增授权。

    6. 单击关闭。