ODPS-0130013

Example error message

FAILED: ODPS-0130013:Authorization Failed [4011], You have NO privilege 'odps:Select' on {acs:odps:*:projects/<project_name>/tables/<table_name>}. Explicitly denied by policy. Context ID:<context ID>. --->Tips: CurrentProject:<project_name>; Pricipal:ALIYUN$<account_id>;

Cause

The user fails the policy check when accessing the project. If a policy is configured, all users except the project owner must pass this check.

Solution

Modify the project policy to grant the user the required privileges.

--Use the following command to view the current policy of the project:
get policy;
--The following output shows a policy that denies access to all users except the project owner.
{
"Version": "1",
"Statement":
 [{
    "Effect":"Deny",
    "Principal":"*",
    "Action":"odps:*",
    "Resource":"acs:odps:*:projects/*",
}]
}

--Modify the policy.
--Save the modified policy to a file named policy.txt.
--Change the value of Effect to "allow" to grant access to all users.
{
"Version": "1",
"Statement":
 [{
    "Effect":"allow",
    "Principal":"*",
    "Action":"odps:*",
    "Resource":"acs:odps:*:projects/*",
}]
}

Example error message

ODPS-0130013:Authorization exception - Authorization Failed [4021], You have NO privilege 'odps:Select' on {acs:odps:*:projects/<project_name>/tables/<table_name>}. project 'wego_data_center' is protected. You need to contact the project owner to set the exception policy for you. Context ID:<context ID>.   --->Tips: CurrentProject:wg_data_ops; Pricipal:ALIYUN$<account_id>; No permission 'odps:Select' on resource acs:odps:*:projects/projects/<project_name>/tables/<table_name>

Cause

The project has data protection enabled, which prevents cross-project data access requests.

Solution

1. Ask the project owner to disable data protection.

   Run the following command to disable data protection:

   --true enables protection and false disables it.
   set ProjectProtection={true|false};
   --Example
   set ProjectProtection=false;

2. Alternatively, run the operation within the target project to avoid a cross-project request.

Example error message

ODPS-0130013:Authorization exception - Authorization Failed [4031], You have NO privilege 'odps:Select' on {acs:odps:*:projects/<project_name>/tables/<table_name>}. CheckLabelSecurity failed. The sensitive label of column 'status_id' is 2, but your effective label is 0.

Cause

The user has insufficient label privileges.

Solution

The project owner or a user with the Admin role can grant the user a higher label privilege by running the following command:

GRANT Label <number> ON TABLE <table_name> [(<column_list>)] TO {USER|ROLE} <name> [WITH exp <days>];

For more information about label authorization, see Label-based access control.