What are data permissions and what permissions are available?-Data Lake Formation(DLF)-阿里云帮助中心

Permission management

Permission settings

You can enable or disable permissions for a data catalog. For more information, see Permission settings.

Background information

To configure permissions, specify the following three elements.

Element	Description
Principal	The user or role that is granted permissions. The user must be a RAM user or RAM role. The role must be created in the data lake with the role management feature. A principal can be specified in one of the following formats: Alibaba Cloud account: acs:ram::<Alibaba Cloud account ID>:root, for example, `acs:ram::123456:root`. RAM user: acs:ram::<Alibaba Cloud account ID>:user/<RAM username>, for example, `acs:ram::123456:user/user_a`. RAM role: acs:ram::<Alibaba Cloud account ID>:role/<RAM role name>, for example, `acs:ram::123456:role/role_a`.
Resource	Resources managed in the data lake include: Data catalog: The top-level container for metadata in a data lake. A data catalog can contain multiple databases. Database: A database managed in data lake metadata. Table: A table managed in data lake metadata. Column: A column managed in data lake metadata. Function: A function managed in data lake metadata.
Action	The available actions depend on the resource type. For example, a database supports CreateTable and List permissions, a table supports Select and Update permissions, and a column supports only the Select permission.

Permission overview

The following table describes the permissions supported by Data Lake Formation.

Resource	Action	Description
data catalog	Alter	Allows a principal to modify a data catalog. For example, by running the `alter catalog <catalog_name> set ...` command.
	Drop	Allows a principal to delete a data catalog. For example, by running the `drop catalog <catalog_name>` command.
	Grant	Allows a principal to grant permissions on a data catalog. For example, by running the `grant drop on catalog <catalog_name> to ...` command.
	Create Database	Allows a principal to create a database in a data catalog. For example, by running the `create database <catalog_name>.<database_name> ...` command.
database	Describe	Allows a principal to view the metadata of a database or switch to a database. For example, by running commands such as `desc database <database_name>` and `use <database_name>`.
	Alter	Allows a principal to modify a database. For example, by running the `alter database <database_name> set location '<path>'` command.
	Drop	Allows a principal to delete a database. For example, by running the `drop database <database>` command.
	Create Table	Allows a principal to create a table in a database. For example, by running the `create table <database_name>.<table_name> ...` command.
	List	Allows a principal to view the list of resources in a database. For example, by running the `show tables` command. Important The E-MapReduce Spark engine does not support permission verification for the List action. The resource list is not filtered by user permissions and displays all resources.
table	Describe	Allows a principal to view the metadata of a table. For example, by running the `desc formatted <table_name>` command.
	Alter	Allows a principal to modify a table. For example, by running commands such as `alter table <table_name> add columns ...` and `alter table <table_name> drop partition ...`.
	Drop	Allows a principal to delete a table. For example, by running the `drop table <table_name>` command.
	Select	Allows a principal to read data from a table. For example, by running the `select * from <table_name>` command.
	Update	Allows a principal to update data in a table. For example, by running commands such as `insert into table <table_name>` and `delete from <table_name> where ...`.
column	Select	Allows a principal to read data from a column. For example, by running the `select <column_name1>, <column_name2> from <table_name>` command.
function	Describe	Allows a principal to view the metadata of a function.
	Alter	Allows a principal to modify a function.
	Drop	Allows a principal to delete a function.
	Execute	Allows a principal to use or execute a function.

Owner permissions

Owner

The creator of a resource is its owner. You can view the owner of a database or table in its basic information.

If a RAM user creates a database or table in Data Lake Formation, that RAM user is the resource owner. The owner is identified by the user's principal format.
If a Linux or LDAP user creates a resource in an E-MapReduce engine by running an SQL command, that user becomes the resource owner.
The Databricks engine does not support resource owners.

Important

For integration with open-source big data systems, Data Lake Formation treats a RAM user and a Linux or LDAP user with the same username as equivalent owners. For example, an owner specified as acs:ram::<Alibaba Cloud account ID>:user/user_a is equivalent to an owner specified as user_a.
When an Alibaba Cloud account is a resource owner, it has no equivalent Linux or LDAP user. Note that an owner specified as acs:ram::<Alibaba Cloud account ID>:root is not equivalent to an owner specified as root.
In the Data Lake Formation console, you can view the username of a RAM user under Data permissions > User. When you use an E-MapReduce engine, add a Linux or LDAP user with the same name as the RAM user by using user management.

Permissions

A resource owner has all permissions on that resource. For example, if the owner of a database is the RAM user user_a, user_a can perform operations such as Alter Database and Drop Database.

Important

Owner permissions on a resource do not extend to its child resources. For example, the owner of a database has owner permissions only on the database itself, not on the tables within that database.

Verification

When you log on to the Data Lake Formation console as a RAM user, you have owner permissions for resources owned by that RAM user or its equivalent identity.
When using an E-MapReduce engine to access data lake metadata resources, you are identified as a Linux or LDAP user and have owner permissions for resources owned by that user or its equivalent identity.
The Databricks engine does not support the verification of owner permissions.

Supported compute engines

Data Lake Formation supports E-MapReduce. The following table describes the support details.

EMR major version		Hive	Spark	Presto	Impala
EMR 3.x	EMR-3.39.0 and earlier	Not supported	Not supported	Not supported	Not supported
	EMR-3.40.0	Supported	Supported	Supported	Not supported
	EMR-3.41.0 to EMR-3.43.1	Supported	Supported	Not supported	Not supported
	EMR-3.44.0 and later (planned)	Supported	Supported	Supported	Supported
EMR 5.x	EMR-5.5.0 and earlier	Not supported	Not supported	Not supported	Not supported
	EMR-5.6.0	Supported	Supported	Supported	Not supported
	EMR-5.7.0 to EMR-5.9.1	Supported	Supported	Not supported	Not supported
	EMR-5.10.0 and later (planned)	Supported	Supported	Supported	Supported