Differences Between Shortcut Mode and Security Mode-DataWorks(DataWorks)-阿里云帮助中心

When you register an E-MapReduce (EMR) cluster to DataWorks, you select one of two registration modes: shortcut mode or security mode. The mode you choose determines how job code is executed on the cluster and whether per-user data permission isolation is enforced.

When to Choose Each Mode

Choose shortcut mode if your workspace does not require strict permission control between users and your priority is getting EMR tasks running quickly.
Choose security mode if different users or task owners must have isolated data permissions when running EMR tasks in DataWorks.

Mode Comparison

Dimension	Shortcut mode	Security mode
Primary use case	Rapid EMR task creation and execution	EMR task execution with strict per-user data permission management
Job execution identity	All jobs run as a Hadoop user on the EMR cluster	Jobs run as the cluster account mapped to the submitting Alibaba Cloud account or RAM user
Permission granularity	Fine-grained permission management is not supported. The hadoop user holds all permissions on the cluster.	You configure an account mapping that grants the cluster account's permissions to the DataWorks identity. EMR Ranger can be used to manage per-user permissions across the cluster.
Permission isolation	Not enforced — all task owners share the same hadoop identity	Enforced — different Alibaba Cloud accounts, task owners, and RAM users have distinct data permissions
Suitable for	Workspaces that do not require strict permission management for users who run tasks	Workspaces that require strict management and isolation of data permissions for users who run tasks

Shortcut Mode

When a DataWorks user (Alibaba Cloud account or RAM user) runs or schedules an EMR task to generate data, the task code is committed to the EMR cluster and run by a Hadoop user in the EMR cluster.

Limitations

Fine-grained permission management is not supported.
All jobs share the same Hadoop user identity. Data access controls are not enforced at the user level.

Because all task code runs under a single shared identity with full cluster permissions, proceed with caution when using shortcut mode in environments where multiple users or task owners operate on the same cluster.

Security Mode

When a DataWorks user (Alibaba Cloud account or RAM user) runs or schedules an EMR task, the task code is committed to the EMR cluster and executed as the cluster account to which that DataWorks identity is mapped.

You configure a Mapping Type during cluster registration. The available options depend on your cluster type:

Cluster type	Supported Mapping Type values
DataLake clusters	Mapping to System Account, Mapping to OpenLDAP Account
Hadoop clusters	Mapping to OpenLDAP Account only

Permission management

You configure a mapping between each Alibaba Cloud account or RAM user and a cluster account. This mapping grants the cluster account's permissions to that DataWorks identity and isolates permissions on task data.
EMR Ranger can be used to manage the permissions of each Hadoop user in the EMR cluster.
Different Alibaba Cloud accounts, task owners, and RAM users have different data permissions when running EMR tasks in DataWorks.