Appendix: Configure permissions for external data sources

Configure permissions for external data sources

An external data source is a resource at the MaxCompute tenant level. A tenant administrator controls whether a RAM user can perform operations on an external data source by configuring permissions in the RAM console under Permissions > Policies. For more information about how to create a permission policy, see Create a custom permission policy by using the script editor.

Example: Use an Alibaba Cloud account to create a permission policy named ForeignServerTest and grant it to a sub-account:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "odps:CreateForeignServer",
            "Resource": "acs:odps:*:12xxxxxxxx07:foreignservers/*"
        }
    ]
}

To add permissions for listing external data sources and retrieving details of a specific one, update the policy as follows:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "odps:CreateForeignServer",
                "odps:GetForeignServer",
                "odps:ListForeignServers"
            ],
            "Resource": "acs:odps:*:12xxxxxxxx07:foreignservers/*"
        }
    ]
}

The following table describes other actions.

After you grant this policy to a sub-account, the sub-account can perform the specified operations on the authorized external data sources.

Project-level access control for tenant-level resources

The external data source, introduced in Data Lakehouse 2.0, is a tenant-level resource whose permissions are controlled by a RAM policy. In contrast, permissions for project-level objects such as tables are managed by the project administrator. Two security models govern whether a project can use tenant-level resources and how permissions are assigned within the project.

• If you enable project-level access control for tenant-level resources, the creator of an external data source can mount it to specific projects. The project administrator can then use policies to grant users within the project permission to use the external data source.

• If project-level access control is not enabled for tenant-level resources, any user who creates an external project or external schema can use any external data source. Access to the external system is still controlled by the RAM role specified by the creator in the external data source. This setting also applies to other tenant-level resources such as network connections, custom images, and quota groups.

After you enable project-level access control for tenant-level resources, follow these steps to access a federated external table by using an external data source and an external schema:

1. Configure the mount relationship between a tenant-level resource and a project. To do this, click the tenant-level resource, such as an external data source, select the project to mount it to, and then confirm. After the resource is mounted, it appears in the project's list of mounted tenant-level resources.

2. Configure a policy for the tenant-level resources that are mounted to the project. For more information, see Policy-based access control.

   • Procedure

     1. Log in to the MaxCompute console and select a region in the upper-left corner.

     2. On the Projects page, click Manage in the Actions column for the target project.

     3. On the Project Settings page, click the Role Permissions tab.

     4. Select the target project-level role and click Edit Role in the Actions column.

     5. In the Edit Role dialog box, set Authorization Method to Policy.

     6. In the Policy-based Access Control script box, modify the role policy.

   • Example

     The following example shows how to configure a policy that grants User 'a' permission to use the external data source fs_hive:

     {
         "Statement":[
             {
                 "Action":[
                     "odps:Usage"
                 ],
                 "Effect":"Allow",
                 "Resource":[
                     "acs:odps:*:servers/fs_hive"
                 ]
             }
         ],
         "Version":"1"
     }

     A user must first have tenant-level permissions to use these resources. Then, with project-level access control enabled, you can configure more granular user-level or role-level permissions within the project.

3. Enable project-level access control for tenant-level resources for the project.

   This feature is currently in preview and cannot be enabled at this time.

   1. Log in to the MaxCompute console and select a region in the upper-left corner.

   2. On the Projects page, click Manage in the Actions column for the target project.

   3. On the Project Settings page, click the Parameter Configuration tab.

   4. In the Permission Properties section, click Edit.

   5. Enable Project-level Tenant Resource Access Control.

   Important

   • For more information about project-level access control for tenant-level resources, see Project-level access control for tenant-level resources.

   • After you enable this feature, the project immediately verifies permissions for all current and future use of tenant-level resources, including external data sources, network connections, custom images, and quota groups. Therefore, do not enable this feature until you have fully configured the required mount relationships and policies. Tasks that depend on these resources will fail if the required permissions are missing.