ApplyResourceAccessPermission-DataWorks(DataWorks)-阿里云帮助中心

Commits an access permissions request for specific resources.

Operation description

Reason: The reason for the request. This parameter is required.
ApplyContents: Contains multiple resource permission request entries. Each entry includes a resource description (Resource), a grantee description (Grantee), access types (AccessTypes), and a permission expiration time (ExpirationTime). A maximum of 400 entries can be submitted in a single request.
Resource: The resource description. You must specify the ResourceSchema.name and version on which the resource parsing depends, as well as the resource metadata (MetaData).
Grantee: The grantee description. You must specify the principal type (PrincipalType) and principal ID (PrincipalId).
AccessTypes: The list of access types. Multiple access type combinations are supported.
ExpirationTime: The permission expiration time, provided as a millisecond-level timestamp.
AuthMethod: Optional. Specifies the authorization method. The system uses the built-in default authorization method if this parameter is not specified.
ClientToken: The client token used to prevent duplicate requests. This parameter is optional.

Make sure that all required fields are correctly specified and meet the corresponding constraints. For example, the DefVersion and MetaData in Resource must match the selected DefSchema.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

dataworks:ApplyResourceAccessPermission

create

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
Reason	string	Yes	The reason for the request.	Business development needs
ApplyContents	array<object>	Yes	The list of resource permission request entries.
	array<object>	No
Resource	object	No	The resource description.
DefSchema	string	Yes	The resource type. Note: The resource types that can be requested are constrained by ResourceSchema.name. See also: ResourceSchema documentation (Chinese) Valid values: MaxCompute : MaxCompute LINDORM : LINDORM EMR_ON_ECS_HIVE : EMR_ON_ECS_HIVE DLF_V1 : DLF_V1 HOLOGRES : HOLOGRES SEVERLESS_STARROCKS : SEVERLESS_STARROCKS DATAWORKS_ENTITY : DATAWORKS_ENTITY DLF_NEXT : DLF_NEXT	MaxCompute
DefVersion	string	No	The resource parsing version, constrained by ResourceSchema.version. ResourceSchema documentation (Chinese)	v1.0.0
MetaData	object	No	The resource metadata declaration. Note: The metadata is constrained by ResourceSchema.resources. A valid resource declaration must include the full-path metadata declaration from level 0 to the validLeaf level. See also: ResourceSchema documentation (Chinese)
	any	No	Declares specific resources in Map<String,Object> format. The declaration must comply with the resource constraints for the specific resource type defined in ResourceSchema. Note: When requesting column-level permissions for MaxCompute, you must also declare the column security level (columnSensibleLevel) for label-based authorization to take effect. For MaxCompute permission requests with Schema enabled, pass the threeTierModel parameter and set it to true.	{ "workspace": "449656", "project": "sync_destination", "table": "order_table", "threeTierModel": false }
Grantee	object	Yes	The grantee description. Note: The supported principal types are constrained by ResourceSchema.authPrincipal. See also: ResourceSchema documentation (Chinese)
PrincipalType	string	Yes	The principal type. Valid values: RamRole RamUser DlfRole Valid values: DlfRole : DlfRole RamUser : RamUser RamRole : RamRole	RamRole
PrincipalId	string	Yes	The principal ID. The ID has different meanings depending on the principal type: RamUser: DataWorks UserId RamRole: DataWorks UserId prefixed with "ROLE_" DlfRole: DlfNext role name	ROLE_32237475848545
AccessTypes	array	Yes	The list of requested access types. Note: Different resource levels support different access types. All access types are constrained by ResourceSchema.isValidLeaf, accessTypeRestrictions, and authMethodAccessTypes. See also: ResourceSchema documentation (Chinese)
	string	No	The resource access type.	select
ExpirationTime	integer	No	The permission expiration time, in millisecond-level timestamp format.	1785835708000
AuthMethod	string	No	The authorization method. Currently, only SEVERLESS_STARROCKS supports specifying an authorization method: ranger or starrocksManager. Note: Different resources support different authorization methods. All authorization methods are constrained by ResourceSchema.authMethods. See also: ResourceSchema documentation (Chinese) Valid values: starrocksManager : Starrocks Manager ranger : Ranger	ranger
ClientToken	string	No	The idempotency token. Used to prevent duplicate operations caused by multiple calls.	ABFUOEUOTRTRJKE

Response elements

Element	Type	Description	Example
	object	The response parameters.
RequestId	string	The request ID. Used for log identification and troubleshooting.	0bc5df3a17***903790e8e8a
Data	array	The list of request order IDs.
	string	The request order or approval process ID.	332066440109224007

Examples

Success response

JSON format

{
  "RequestId": "0bc5df3a17***903790e8e8a",
  "Data": [
    "332066440109224007"
  ]
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.