MaxCompute data permission control

By default, DataWorks built-in roles grant access to the development environment, but not the production environment. This means users can access tables, resources, and functions in the development environment, but not in production.

To protect production data in a workspace in standard mode, DataWorks controls how RAM users access MaxCompute tables.

• Obtain permissions on the development project (automatic):

  • When a workspace member is assigned a built-in role, the member automatically obtains permissions on the engine project. For more information, see Scenario 1: Authorization process for built-in workspace roles.

  • When a workspace member is assigned a custom role, the member also obtains permissions on the engine project. For more information, see Scenario 2: Authorization process for custom workspace roles.

• Obtain permissions on the production project (manual request required): You must request permissions in Security Center. The following table describes the use cases. For more information about how to use Security Center, see Control access to MaxCompute data.

  Scenario	Description
  A user in a development environment needs to access a table in the production environment within the same workspace.	By default, if a RAM user is not configured as the access identity for the production engine, the user cannot operate on production tables from DataStudio. To gain access, the RAM user must submit a request in Security Center. After the request is approved, the user can perform the required operations on the tables in DataStudio.
  A user needs to access a table in the development or production environment of another workspace.	By default, a RAM user cannot access tables in the development or production environment in other projects from DataStudio. To enable cross-project access, the RAM user must submit a request in Security Center. After the request is approved, the user can perform the required operations on the tables in DataStudio.

RAM users who need to access production data must follow an approval process, which allows administrators to control permissions on the production environment.

1. Security Center provides a built-in approval workflow for permissions on production tables.

2. Approval Center supports custom approval workflows.

You can run the following commands in a MaxCompute SQL task to query your permissions.

• show grants: View your own access permissions.

• show grants for <username>: View the access permissions of a specific user. Only workspace administrators can run this command.

Once added, the RAM user has specific permissions in both DataWorks and the MaxCompute engine, as detailed below.

• DataWorks permissions: With the Development role, the RAM user can develop and commit code in DataWorks but cannot deploy it to the production environment. Deploying to production requires O&M permissions, which are held by roles such as Project Owner, Administrator, and O&M.

• MaxCompute engine permissions: When the RAM user is granted the Development role, the user is also assigned the Role_Project_Dev role in the MaxCompute engine. This role grants permissions on objects like tables within the MaxCompute development project.

  Note

  • If you grant a RAM user the built-in Workspace Manager role, the user receives extensive permissions on DataWorks features but still cannot directly access production tables.

  • The RAM user described here refers to a user who is not designated as the scheduling engine's access identity for the production project.

Example: A user with the Workspace Manager role adds a RAM user as a workspace member and grants them a custom DataWorks workspace role.When you create a custom role in a DataWorks workspace, you can map it to a MaxCompute engine role. After the role is assigned to a member, the RAM user gains the corresponding permissions in both DataWorks and the MaxCompute engine. The details are as follows.

• DataWorks permissions: When a RAM user is granted a custom role in DataWorks, the user can access only the modules that the role permits.

• MaxCompute engine permissions:

  • If the custom DataWorks role is not mapped to an engine role, the RAM user has no permissions in the MaxCompute engine and cannot run commands to query the engine.

  • If the custom DataWorks role is mapped to an engine role, the RAM user inherits the permissions of the mapped MaxCompute engine role.