Grant permissions to other users
After you create a MaxCompute project, you can grant permissions to other Resource Access Management (RAM) users so they can assist with development. Once granted, RAM users can operate tables, resources, functions, or jobs in the project. This topic describes how to authorize RAM users.
Prerequisites
You have created a MaxCompute project.
If you have not created a MaxCompute project, create one first. For more information, see Create a MaxCompute project.
You have created a RAM user.
For more information about creating a RAM user, see Prepare a RAM user.
Authorization method: Using DataWorks
If you created your MaxCompute project by synchronizing it when you created a DataWorks workspace in the DataWorks console, and you plan to use DataWorks for MaxCompute job development and administration, you can directly grant permissions to users in the DataWorks console.
DataWorks provides a complete permission control solution for data development and administration. The following example uses DataWorks in standard mode to explain how to grant permissions when the development environment and production environment are isolated.
Development environment
Add members to your DataWorks workspace. After that, these members can develop MaxCompute jobs in DataWorks.
In the DataWorks Management Center, choose Members and Roles in the left-side navigation pane, click Add Member, select the target member from the list of accounts to be added, click > to move the member to the added accounts list, select Development in Batch Set Roles, and then click OK.
For more information about adding members in the DataWorks console, see Add workspace members.
After you add DataWorks members, see Permission mappings between MaxCompute and DataWorks for the MaxCompute permissions corresponding to each member role.
Production environment
You can find tables in the production environment in Data Map and request permissions on those tables.
For more information about requesting table permissions, see Request table permissions.
Authorization method: Using MaxCompute
You can also manage permissions directly in the MaxCompute console and grant them to other users. MaxCompute recommends using role-based authorization. Create a role for a group of users, assign permissions to the role, and then grant the role to the corresponding RAM users so they inherit the role's permissions.
As described above, when authorizing through MaxCompute, first plan user roles and assign permissions to those roles. Then grant the roles to RAM users to complete authorization.
Plan user roles and assign permissions to them.
MaxCompute provides two built-in administrator roles: admin and super_administrator. We recommend that you follow the principle of least privilege and create custom roles based on the actual permission needs of the users you want to authorize. To create a role, follow these steps.
Log in to the MaxCompute console and select a region in the upper-left corner.
In the left-side navigation pane, choose .
On the Projects page, click Manage in the Actions column for the target project.
On the Project Settings page, click the Role Permissions tab.
Click Create Project-level Role to create a project role with the required MaxCompute permissions.
In the Create Role dialog box, configure the parameters as prompted and click OK.
During preparation, we recommend that you set the Role Type to Resource so you can quickly grant operation permissions on specific projects or tables using the ACL method.
NoteYou can also create roles using the MaxCompute client. For more information, see Project-level role authorization.
MaxCompute provides two built-in administrator roles: admin and super_administrator. When creating a custom role, you can set the role type to Resource (for resource operations) or Admin (for administrative operations). For a comparison of these two types, see Role types.
Grant the role to a RAM user.
After you create a custom user role, grant it to a RAM user. The RAM user then has the permissions assigned to the role.
On the Project Settings page, select the Role Permissions tab. Find the target project-level role and click Manage Members in the Actions column.
Follow the on-screen instructions to select the user to authorize and click OK.
When the system confirms successful addition, the RAM user has the corresponding MaxCompute permissions.
MaxCompute offers multi-granularity permission control and rich authorization methods. Administrators can further plan and manage user permissions as needed. For more information, see Permission overview.
What to do next
Prepare your MaxCompute project development environment and install the required tools. For more information about environment setup and security tools, see Choose a connection tool.
FAQ
Q: When I access the logview of a MaxCompute job, I get "can't operate the joblnsght, error code NO_PERMISSION". What should I do?
A: MaxCompute project-level permissions and RAM global permissions are two independent systems. A RAM user may have the AliyunMaxComputeFullAccess or AliyunDataWorksFullAccess global permission, or may be a DataWorks workspace administrator. However, if the user has not been added to the corresponding MaxCompute project, the user still gets the NO_PERMISSION error when accessing logview. To resolve this issue, add the RAM user to the target MaxCompute project and grant a role:
Log on to the MaxCompute console and go to the target project.
On the Role Permissions tab, add the RAM user to the project through member management.
Assign a role to the user (for example, Developer or Operations).
Access the logview link again. The NO_PERMISSION error is resolved.