Sharing your Alibaba Cloud account for team collaboration poses significant security risks. Add RAM users as workspace members and assign them roles to enable fine-grained access control, secure data, and standardize development workflows.
How it works
DataWorks member management is based on Alibaba Cloud's RAM (Resource Access Management) and role-based access control (RBAC) models:
-
Member identity: Workspace members are essentially RAM users under your Alibaba Cloud account. DataWorks does not create or store user identities.
-
Role assignment: You grant permissions to members by assigning them roles, such as Workspace Manager, Development, or O&M.
-
Permission mapping: DataWorks role permissions map to permissions on the underlying compute engine. For example, granting a member the Development role in DataWorks automatically grants corresponding read and write permissions in the bound MaxCompute project.
For details about the DataWorks permission system, see DataWorks Permission Model.
Prerequisites
You must have the Workspace Administrator role for the workspace.
By default, the Alibaba Cloud account that creates a workspace is granted the Workspace Manager role for that workspace.
Add members and manage roles
-
Go to the DataWorks Management Center, select the target workspace, and click Go to Management Center.
-
In the left-side navigation pane, go to the Workspace Members and Roles tab and click Add Members in the upper-right corner. The Add Members dialog box appears.
-
(Optional) If you need to create a new RAM user, click RAM console in the prompt at the top of the dialog box to go to the RAM console and create a RAM user.
-
Select the accounts that you want to add, move them to the Selected Accounts list, and select Set Roles to grant permissions.
Important-
RAM users assigned different workspace roles have different permissions for DataWorks features. For details about predefined workspace roles, see Workspace-level access control.
-
The Workspace Manager role grants a RAM user all permissions in the workspace.
-
-
After adding members, you can view and manage their information in the Workspace Members list. You can change a member's role in the Role column and remove a member in the Operation column. The project owner cannot be removed.
Production recommendations
-
Principle of least privilege: Do not assign the Workspace Administrator role to regular developers or O&M engineers. Instead, assign specific roles such as Development, O&M, or Deploy based on job responsibilities.
-
Regular reviews: The project owner should regularly review the Workspace Members list to remove inactive members and clean up unnecessary permissions.
-
Administrator privilege risks: The Workspace Administrator role has full permissions to manage members, modify workspace configurations, and more. An operator error or compromised account can severely impact the entire project. Limit this role to one or two core project leads.
Next steps
After adding members and assigning roles, explore the following resources to learn the basics of DataWorks.
-
For a quick start tutorial, see Comprehensive tutorial: Analyze website user profiles.
-
For more tutorials, see Tutorials.
FAQ
-
Q: Why can't I find a specific RAM user when trying to add a member?
A: First, ensure the RAM user has been created in the Alibaba Cloud RAM console. Second, in the Add Members dialog box in DataWorks, click the Refresh button to load the latest list of RAM users. -
Q: Why can't I remove a workspace member?
A: You cannot remove the Workspace Owner of a workspace. The project owner is typically the Alibaba Cloud account that created the workspace and holds all permissions for that workspace. -
Q: I added a RAM user as a workspace member, but I still can't access the workspace after logging in. Why?
A: RAM users and RAM roles are two different types of identities. Workspace permissions granted to a RAM user do not apply to a RAM role. To troubleshoot:-
In the upper-right corner of the DataWorks console, check the identity type of the account you are currently logged in with.
-
Confirm whether that identity has been added as a member of the target workspace.
-
If it has not been added, go to the Workspace Members and Roles tab on the workspace management page, add the currently logged-in identity as a workspace member, and assign it the appropriate role.
-