How administrators govern data development-DataWorks(DataWorks)-阿里云帮助中心

Workspace administrators can use DataStudio to govern development activities, including managing development workflows, enforcing data security, and auditing operations.

Background information

Workspace administrators, including users with the Project Owner role and the Workspace Administrator role, can use all features in DataWorks. For more information about role permissions, see Permissions of workspace-level roles.

Governance categories

DataStudio provides the following development governance features:

Process governance and operational checks
Data security governance
Auditing operations

Note

Support for the governance features in this topic may vary by DataWorks edition. For more information, see the documentation for each feature. For details about DataWorks editions, see DataWorks editions.

Process governance and operational checks

Govern development workflows and apply process controls with the following features.

Feature	Description	Related documentation
Permission control for node development and deployment	Assign roles to control user access to specific features. Examples: To prevent a user from deploying nodes, grant them only the Developer role. To prevent a user from accessing data analysis features, do not grant them the Data Analyst role. To allow a user to create nodes, edit code, create tables, and create functions, grant them only the Developer role.	Manage permissions on workspace-level services
Mandatory Code Review	Ensures code quality. When enabled, code submitted by developers must be approved by reviewers before deployment. Note You can scope code review by baselines to enforce quality control on high-priority tasks and prevent failures that block dependent tasks.	Code review
Mandatory smoke testing	Performs smoke testing on a task before deployment to ensure it runs as expected after deployment. In scenarios that use scheduling parameters, smoke testing verifies that parameters are correctly substituted.	Smoke testing
Process gating and checks via extensions	Verifies extensions or check items before a task is committed or deployed. Open Platform extensions Implement custom validation logic for process control. Note To enable this control, a user with the `AliyunDataWorksFullAccess` policy must register a local service with DataWorks in Open Platform and publish the extension. Data governance check items Incorporate code checks into your governance framework and use the results for process control. Note This action must be performed in Data Governance Center > Setting > Check item by a user with the `AliyunDataWorksFullAccess` policy. Data Modeling Centralize table creation in Data Modeling, or define rules in DataStudio that allow or block the creation of tables based on specific naming conventions.	Open Platform extensions Overview of extensions Apply an extension Process control showcase Data governance check items Overview of Data Governance Center Configure check items Data Modeling: Data Modeling system management

Note

In a standard-mode workspace, nodes are deployed to the same workspace by default. For cross-workspace or cross-cloud deployments, you can use the Deployment Center. You can manage deployment tasks based on your scenarios. For more information, see Overview of Deployment Center.

Data security governance

Manage data security within your workspace with the following features.

Feature	Description	Related documentation
Data masking	Masks sensitive data by applying data masking rules to query results automatically. Note DataWorks provides built-in data masking rules. You can also create custom rules in Data Security Guard. Only users with the Workspace Administrator or Security Administrator role, or users with the `AliyunDataWorksFullAccess` policy, can create custom data masking rules in Data Security Guard.	Enable data masking for query results Data Security Guard
Data download	Controls whether developers can download query results from DataStudio.	--
Data source read/write permission control	Controls whether developers can modify the configurations of synchronization nodes.	Approval policies for Data Integration
Table permission approval policy	Defines custom approval workflows for MaxCompute table, resource, and function permissions. Note You can scope the approval workflow by MaxCompute projects or by data sensitivity classifications in Data Security Guard.	Approval policies for compute engines
Other	Controls other MaxCompute security settings, such as ACL-based authorization, allowing object creators to grant permissions, policy-based authorization, and column-level access control.	MaxCompute advanced configurations

Auditing operations

In DataStudio, you can view operation logs, restore data, and audit user activities.

View operation logs

Operation	Description	Related documentation
View DataStudio operation history	Track changes by viewing batch operations, commits, query result downloads, and node deletions.	Operation history
Get user behavior audit logs	Use ActionTrail to obtain logs for operations performed in the DataWorks console, such as downloading data. Note DataWorks is integrated with ActionTrail. You can view and search DataWorks event logs from the last 90 days in ActionTrail. You can also deliver event logs to a Simple Log Service (SLS) Logstore or a specified OSS bucket for event monitoring, alerting, auditing, and incident analysis.	Query event logs by using ActionTrail
Data masking and leaked data tracing	To prevent data leaks, configure data masking rules in Data Security Guard and use data watermarks to trace leaked data. Note Only users with the Workspace Administrator or Security Administrator role, or users with the `AliyunDataWorksFullAccess` policy, can create custom data masking rules in Data Security Guard.	Create a data masking rule Data tracing
MaxCompute table permission audit	In Security Center > Data Access Control, go to the Permission Audit tab to view a table's permission details, such as authorized users and their validity periods. This allows you to revoke permissions as needed. Note You can refer to the related documentation to grant the required table permissions to a RAM user and control the user's operation permissions on the table during authorization.	Control data access permissions in MaxCompute

Restore data

Operation	Description	Related documentation
Node restoration	Restore recently deleted nodes from the DataStudio recycle bin. Note When a node is restored, a new node ID is generated that is different from the original ID.	Recycle bin
Node version comparison and rollback	On the Versions panel in the right-side navigation pane of the node or workflow editor, compare versions and roll back to a previous version.	View node versions