RAM authorization-Data Lake Formation(DLF)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Data Lake Formation for RAM permission policies. The RAM code (RamCode) for Data Lake Formation is dlf , and the supported authorization granularity is OPERATION .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Data Lake Formation. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
dlf:Search	Search	get	All Resource ``	None	None
dlf:DeletePartitionColumnStatistics	DeletePartitionColumnStatistics	delete	All Resource ``	None	None
dlf:BatchDeletePartitions	BatchDeletePartitions	delete	All Resource ``	None	None
dlf:CreatePartition	CreatePartition	create	All Resource ``	None	None
dlf:RenamePartition	RenamePartition	update	All Resource ``	None	None
dlf:ListPartitionsByExpr	ListPartitionsByExpr	list	All Resource ``	None	None
dlf:DeleteDatabase	DeleteDatabase	delete	All Resource ``	None	None
dlf:BatchRevokePermissions	BatchRevokePermissions	update	All Resource ``	None	None
dlf:ListPartitionsByFilter	ListPartitionsByFilter	list	All Resource ``	None	None
dlf:GetTable	GetTable	get	All Resource ``	None	None
dlf:GetTableColumnStatistics	GetTableColumnStatistics	get	All Resource ``	None	None
dlf:UpdateDatabase	UpdateDatabase	update	All Resource ``	None	None
dlf:BatchDeleteTableVersions	BatchDeleteTableVersions	delete	All Resource ``	None	None
dlf:RenameTable	RenameTable	update	All Resource ``	None	None
dlf:GetDatabase	GetDatabase	get	All Resource ``	None	None
dlf:BatchCreateTables	BatchCreateTables	create	All Resource ``	None	None
dlf:RegisterLocation	RegisterLocation	create	All Resource ``	None	None
dlf:GetLifecycleRule	GetLifecycleRule	get	All Resource ``	None	None
dlf:UpdateRole	UpdateRole	update	All Resource ``	None	None
dlf:GetServiceStatus	GetServiceStatus	get	All Resource ``	None	None
dlf:CreateDatabase	CreateDatabase	create	All Resource ``	None	None
dlf:ListRoleUsers	ListRoleUsers	get	All Resource ``	None	None
dlf:DeleteCatalog	DeleteCatalog	delete	All Resource ``	None	None
dlf:BatchGetTables	BatchGetTables	get	All Resource ``	None	None
dlf:BatchGrantPermissions	BatchGrantPermissions	update	All Resource ``	None	None
dlf:RevokeRolesFromUser	RevokeRolesFromUser	delete	All Resource ``	None	None
dlf:ListTableNames	ListTableNames	list	All Resource ``	None	None
dlf:SearchAcrossCatalog	SearchAcrossCatalog	none	All Resource ``	None	None
dlf:GetLock	GetLock	get	All Resource ``	None	None
dlf:CreateTable	CreateTable	create	All Resource ``	None	None
dlf:UpdatePartitionColumnStatistics	UpdatePartitionColumnStatistics	update	All Resource ``	None	None
dlf:UpdatePermissions	UpdatePermissions	update	All Resource ``	None	None
dlf:GetAsyncTaskStatus	GetAsyncTaskStatus	get	All Resource ``	None	None
dlf:GetPartition	GetPartition	get	All Resource ``	None	None
dlf:ListTables	ListTables	list	All Resource ``	None	None
dlf:ListPartitions	ListPartitions	list	All Resource ``	None	None
dlf:GrantPermissions	GrantPermissions	create	All Resource ``	None	None
dlf:ListFunctions	ListFunctions	list	All Resource ``	None	None
dlf:BatchUpdatePartitions	BatchUpdatePartitions	update	All Resource ``	None	None
dlf:GetQueryResult	GetQueryResult	get	All Resource ``	None	None
dlf:ListTableVersions	ListTableVersions	list	All Resource ``	None	None
dlf:SubmitQuery	SubmitQuery	create	All Resource ``	None	None
dlf:GetRole	GetRole	get	All Resource ``	None	None
dlf:UpdateRoleUsers	UpdateRoleUsers	update	All Resource ``	None	None
dlf:DescribeRegions	DescribeRegions	get	All Resource ``	None	None
dlf:ListPermissions	ListPermissions	list	All Resource ``	None	None
dlf:GetFunction	GetFunction	get	All Resource ``	None	None
dlf:DeleteFunction	DeleteFunction	delete	All Resource ``	None	None
dlf:RunMigrationWorkflow	RunMigrationWorkflow	none	All Resource ``	None	None
dlf:ListCatalogs	ListCatalogs	list	All Resource ``	None	None
dlf:ListPartitionNames	ListPartitionNames	list	All Resource ``	None	None
dlf:ListRoles	ListRoles	get	All Resource ``	None	None
dlf:AbortLock	AbortLock	update	All Resource ``	None	None
dlf:DeletePartition	DeletePartition	delete	All Resource ``	None	None
dlf:CreateFunction	CreateFunction	create	All Resource ``	None	None
dlf:StopMigrationWorkflow	StopMigrationWorkflow	update	All Resource ``	None	None
dlf:DeleteTable	DeleteTable	delete	All Resource ``	None	None
dlf:UpdateTable	UpdateTable	update	All Resource ``	None	None
dlf:ListFunctionNames	ListFunctionNames	list	All Resource ``	None	None
dlf:ListPartitionsProfile	ListPartitionsProfile	list	All Resource ``	None	None
dlf:UpdateCatalogSettings	UpdateCatalogSettings	update	All Resource ``	None	None
dlf:UpdateRegisteredLocation	UpdateRegisteredLocation	update	All Resource ``	None	None
dlf:CheckPermissions	CheckPermissions	get	All Resource ``	None	None
dlf:GetTableVersion	GetTableVersion	get	All Resource ``	None	None
dlf:GrantRolesToUser	GrantRolesToUser	create	All Resource ``	None	None
dlf:GetCatalog	GetCatalog	get	All Resource ``	None	None
dlf:ListUserRoles	ListUserRoles	list	All Resource ``	None	None
dlf:BatchUpdateTables	BatchUpdateTables	update	All Resource ``	None	None
dlf:CreateRole	CreateRole	create	All Resource ``	None	None
dlf:GetTableProfile	GetTableProfile	get	All Resource ``	None	None
dlf:DeleteTableColumnStatistics	DeleteTableColumnStatistics	delete	All Resource ``	None	None
dlf:RefreshLock	RefreshLock	update	All Resource ``	None	None
dlf:BatchGetPartitions	BatchGetPartitions	get	All Resource ``	None	None
dlf:UpdateFunction	UpdateFunction	update	All Resource ``	None	None
dlf:UpdateCatalog	UpdateCatalog	update	All Resource ``	None	None
dlf:GetCatalogSettings	GetCatalogSettings	get	All Resource ``	None	None
dlf:BatchCreatePartitions	BatchCreatePartitions	create	All Resource ``	None	None
dlf:CancelQuery	CancelQuery	update	All Resource ``	None	None
dlf:GetPartitionColumnStatistics	GetPartitionColumnStatistics	get	All Resource ``	None	None
dlf:GetDatabaseProfile	GetDatabaseProfile	get	All Resource ``	None	None
dlf:GetRegionStatus	GetRegionStatus	get	All Resource ``	None	None
dlf:BatchDeleteTables	BatchDeleteTables	delete	All Resource ``	None	None
dlf:UpdateTableColumnStatistics	UpdateTableColumnStatistics	update	All Resource ``	None	None
dlf:ListDatabases	ListDatabases	list	All Resource ``	None	None
dlf:UnLock	UnLock	update	All Resource ``	None	None
dlf:DeleteTableVersion	DeleteTableVersion	delete	All Resource ``	None	None
dlf:CreateCatalog	CreateCatalog	create	All Resource ``	None	None
dlf:RevokeRoleFromUsers	RevokeRoleFromUsers	delete	All Resource ``	None	None
dlf:CreateLock	CreateLock	create	All Resource ``	None	None
dlf:DeregisterLocation	DeregisterLocation	delete	All Resource ``	None	None
dlf:DeleteRole	DeleteRole	delete	All Resource ``	None	None
dlf:GrantRoleToUsers	GrantRoleToUsers	create	All Resource ``	None	None
dlf:RevokePermissions	RevokePermissions	delete	All Resource ``	None	None
dlf:BatchGetPartitionColumnStatistics	BatchGetPartitionColumnStatistics	get	All Resource ``	None	None

Resource

The following table lists the resources defined by Data Lake Formation. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type

ARN

Condition

Data Lake Formation does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: