Dataphin service-linked role-Dataphin(Dataphin)-阿里云帮助中心

Sometimes, a cloud service needs to access other cloud services to function. Alibaba Cloud provides service-linked roles (SLRs) for this purpose. A service-linked role is a special type of RAM role that only an Alibaba Cloud service can assume. For more information, see RAM role overview, Service-linked roles.

Limitations

Only users with the ram:CreateServiceLinkedRole permission can create service-linked roles. You can ask an administrator to grant you the AliyunDataphinFullAccess RAM role or the required permissions.

Dataphin SLR use cases

Use case 1: Synchronize Alibaba Cloud account information.
Dataphin uses the AliyunServiceRoleForDataphinOnRAM SLR to synchronize RAM user information from your main account.
Use case 2: Create MaxCompute compute sources and data sources.
Dataphin uses the AliyunServiceRoleForDataphinOnOdps SLR to access MaxCompute projects in your main account. This role allows Dataphin to:
- Query all MaxCompute projects in your main account.
- Create a dp-project-schedule role in the selected MaxCompute project.
- Assign the dp-project-schedule role to the AliyunServiceRoleForDataphinOnOdps SLR.
Note
For MaxCompute projects that use this SLR, you can create Pyodps tasks only with Python 3.11.
Use case 3: Create Alibaba Cloud data sources.
Dataphin uses the AliyunServiceRoleForDataphinOnDataBase SLR to access specific types of Alibaba Cloud data sources in your main account. This role allows Dataphin to:
- Query instances of RDS for MySQL, AnalyticDB for MySQL, AnalyticDB for PostgreSQL, and PolarDB in your main account.
- Query basic information about a specified instance, such as its connection endpoint and instance ID.

Detailed SLR permissions

To view SLR permissions, go to the RAM console. In the left-side navigation pane, choose Identities > Roles to view details about the service-linked roles.

Important

Dataphin relies on the following SLRs for daily operations. You can delete these SLRs only after your Dataphin service expires.

Role name: AliyunServiceRoleForDataphinOnRAM

Role description: Allows Dataphin to query RAM user information.

Permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ram:ListUserBasicInfos",
      "Resource": "*"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "ram.dataphin.aliyuncs.com"
        }
      }
    }
  ]
}

Role name: AliyunServiceRoleForDataphinOnOdps

Role description: Allows Dataphin to access MaxCompute resources.

Permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "odps:CreateRole",
        "odps:UpdateUsersToRole",
        "odps:ListProjects"
      ],
      "Resource": "*"
    }
  ]
}

Role name: AliyunServiceRoleForDataphinOnDataBase

Role description: Allows Dataphin to access cloud database resources.

Permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "rds:DescribeDBInstanceAttribute",
        "rds:DescribeDBInstanceNetInfo",
        "rds:DescribeDBInstances",
        "rds:DescribeRegions",
        "rds:DescribeDatabases",
        "rds:DescribeSecurityGroupConfiguration",
        "rds:DescribeDBInstanceIPArrayList",
        "rds:ModifySecurityGroupConfiguration",
        "rds:ModifySecurityIps"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "gpdb:DescribeDBInstanceAttribute",
        "gpdb:DescribeDBInstances",
        "gpdb:DescribeResourceUsage",
        "gpdb:DescribeDBInstanceIPArrayList",
        "gpdb:DescribeDBClusterIPArrayList",
        "gpdb:DescribeDBInstancePerformance",
        "gpdb:DescribeDBInstanceNetInfo",
        "gpdb:DescribeRegions",
        "gpdb:ModifySecurityIps"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "polardb:DescribeClusterInfo",
        "polardb:DescribeDBClusterParameters",
        "polardb:DescribeDBClusterEndpoints",
        "polardb:ModifyDBClusterAccessWhitelist",
        "polardb:DescribeDBClusterAccessWhitelist",
        "polardb:DescribeRegions"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "adb:DescribeDBClusters",
        "adb:DescribeDBClusterAttribute",
        "adb:DescribeClusterAccessWhiteList",
        "adb:DescribeClusterNetInfo",
        "adb:ModifyClusterAccessWhiteList"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

Role name: AliyunServiceRoleForDataphinOnCs

Role description: Allows Dataphin to query basic information about other cloud services, such as EMR Serverless Spark, Data Lake Formation (DLF), and DataWorks.

Permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "emr-serverless-spark:AddMembers",
        "emr-serverless-spark:GrantRoleToUsers",
        "emr-serverless-spark:ListWorkspaces",
        "emr-serverless-spark:ListCatalogs",
        "emr-serverless-spark:ListKyuubiServices",
        "emr-serverless-spark:ListKyuubiToken",
        "emr-serverless-spark:GetKyuubiService",
        "dlf:ListDatabases",
        "dlf:ListCatalogs",
        "dataworks:GetProject",
        "dataworks:ListProjects",
        "dataworks:ListDataSources",
        "dataworks:ListCrawlerTypes",
        "dataworks:ListCatalogs",
        "dataworks:ListDatabases",
        "dataworks:ListSchemas",
        "dataworks:ListTables",
        "dataworks:GetTable",
        "dataworks:ListColumns",
        "dataworks:ListPartitions"
      ],
      "Resource": "*"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "cs.dataphin.aliyuncs.com"
        }
      }
    }
  ]
}