MaxCompute权限管理常见问题-MaxCompute(MaxCompute)-阿里云帮助中心

Frequently asked questions about MaxCompute permission management.

Category	FAQ
Authorization solutions	How do I read data across projects? Can the owner of a MaxCompute project be changed to a RAM user? What are the limitations of the Admin role compared to the project owner?
Granting permissions to users	When I request permissions on a production environment table for a RAM user, the authorization fails. How do I solve this issue? How do I grant a user permissions to operate a table? What are objects and actions in permission management? How can a RAM user access a project created by another Alibaba Cloud account? How do I obtain a tenant ID (tenant_id)? An error "FAILED: Invalid account Name xxxxxx" is reported when I grant permissions to a user. How do I solve this issue? An error "FAILED: lack of account provider, principalName xxxxxx" is reported when I grant permissions to a user. How do I solve this issue?
Permission errors	I have the permission to query a view in MaxCompute. Why is an error reported, indicating that another user does not have permissions, when I query the view? An error "You have NO privilege to do the restricted operation on xxx Access Mode is AllDenied" is reported when I run a job. How do I solve this issue? An error "failed to check policy format: invalid Action value - odps:" is reported when I create a custom role for the Resource type. How do I solve this issue?

How do I read data across projects?

Use packages to share data and resources across projects. A project administrator packages the required objects and grants permissions on them. Other projects install the package, and their administrators can then manage it and grant permissions to users within their own projects.

For more information, see Access resources across projects based on packages and Permission control for packages.

Can the owner of a MaxCompute project be changed to a RAM user?

No. The project creator is permanently the project owner, and ownership cannot be transferred. However, the project owner can grant the Admin role to a RAM user.

What are the limitations of the Admin role compared to the project owner?

Compared to the project owner, a user with the Admin role cannot perform the following operations:

Assign the Admin role to other users.
Modify the project security configuration.
Modify the project authorization model.
Modify the Admin role permissions.

When I request permissions on a production environment table for a RAM user, the authorization fails. How do I solve this issue?

Symptom
When you use an Alibaba Cloud account to grant permissions on a table in the production environment to a RAM user, the following error is returned.
```
class java.lang.IllegalArgumentException: AccessId should not be empty.
```
Cause

The AccessKey ID and AccessKey Secret of the Alibaba Cloud account or RAM user are not configured.
Solution

Log on to the RAM console by using your Alibaba Cloud account or as a RAM user. Verify that the AccessKey ID and AccessKey Secret are configured.

How do I grant a user permissions to operate a table?

The project owner or a user with the Super_Administrator or Admin role must perform the authorization. You can use the access control list (ACL) authorization method (grant) to grant a user the required permissions to operate a table. The following command is an example.

GRANT UPDATE ON TABLE project_name TO ram$bob@aliyun.com:Allen;

For more information about authorization, see MaxCompute permissions.

How do I grant permissions to a RAM user?

The authorization must be performed by an Alibaba Cloud account or a user with the Super_Administrator or Admin role. For more information about authorization, see MaxCompute permissions.

What are objects and actions in permission management?

MaxCompute authorization involves three elements:

Subject: The user or role to which permissions are granted.
Object: The target object on which a user or role is granted permissions, such as a project, table, model, function, resource, or instance.
Action: The operation that a user or role is granted permission to perform on the target object, such as reading, writing, or querying a table.

For more information, see ACL-based access control.

How can a RAM user access a project created by another Alibaba Cloud account?

Assume that there are two Alibaba Cloud accounts: Account A and Account B. Account A has a RAM user named C (ram_user_1). User C needs to access a MaxCompute project created by Account B.

Account B must add Account A to its project and grant the MaxCompute Super_Administrator role to Account A. Then, Account A can log on to Account B's project and run the add user ram$A:ram_user_1; command to add User C to the project.

How do I obtain a tenant ID (tenant_id)?

To scope authorized resources at the tenant level, specify the tenant in the access policy. First, obtain the tenant ID by following these steps:

Log in to the MaxCompute console and select a region in the upper-left corner.
In the left-side navigation pane, choose Manage Configurations > Tenants .
On the Tenants page, click the Tenant Property tab.
On the Tenant Property tab, find the Tenant ID:.

An error "FAILED: Invalid account Name xxxxxx" is reported when I grant permissions to a user. How do I solve this issue?

Symptom
When you grant permissions to a user, the following error is returned.
```
FAILED: Invalid account Name xxxxxx
```
Cause

The username in the authorization statement is invalid.
Solution

Verify that the username is correct. Run the list users; command to retrieve the user list for the current project, and copy the username directly from the list to avoid spelling errors.

An error "FAILED: lack of account provider, principalName xxxxxx" is reported when I grant permissions to a user. How do I solve this issue?

Symptom
When you grant permissions to a user, the following error is returned.
```
FAILED: lack of account provider, principalName xxxxxx
```
Cause

The username in the authorization statement is invalid, or the current project's account system does not support RAM.
Solution

Log on to the MaxCompute client and run the list accountproviders; command to check whether the project's account system supports RAM. If the output does not include RAM, run the add accountprovider ram; command to add support for the RAM account system. Then, run the list accountproviders; command again to confirm that RAM is supported. If the error persists after you confirm that the project supports RAM, verify that the username is correct. You can run the list users; command to retrieve the user list for the current project. When you grant permissions, copy the username directly from the list to prevent errors caused by incorrect spelling.

I have the permission to query a view in MaxCompute. Why is an error reported, indicating that another user does not have permissions, when I query the view?

Symptom

ViewA references Table B. User A has permission to query ViewA, but when User A runs the query, an error indicates that the view owner (User B) does not have permission to query Table B.
Cause

If the view owner lacks the SELECT permission on the referenced table, the view becomes unavailable. This typically happens when the view owner changes and the new owner is not granted the SELECT permission on the referenced table, or when the referenced table's owner revokes the SELECT permission from the view owner.
Solution
Check whether the view owner has lost the SELECT permission on the referenced table. The command is as follows.
```
show grants for <user_name>;  -- user_name is the username of the view owner
```
If the permission is lost, grant the SELECT permission on the referenced table to the view owner again. The view can then be used.

An error "You have NO privilege to do the restricted operation on xxx Access Mode is AllDenied" is reported when I run a job. How do I solve this issue?

Cause

The project is disabled.
Solution
- Check whether your account has an overdue payment or whether the subscription order for the subscription quota associated with the project has expired. If your account has an overdue payment or the order has expired, the project is automatically restored to the Normal state after you add funds to your account or renew the subscription. The restoration may take 2 to 30 minutes, depending on the number of your orders and projects.
- If the project was not disabled because of an overdue payment or an expired order, it may have been manually disabled. You can resume the project on the Projects page in the MaxCompute console. To navigate to the page, choose Manage Configurations in the navigation pane on the left. For more information, see Project management.

An error "failed to check policy format: invalid Action value - odps:<Action>" is reported when I create a custom role for the Resource type. How do I solve this issue?

Symptom

When you use the policy authorization feature to create a role named test_role for the Resource type and grant the CreatePackage permission to the role, you write the following policy:

{
    "Statement":[
        {
            "Action":[
                "odps:CreatePackage"
                ],
                "Effect":"Allow",
                "Resource":[
                    "acs:odps:*:projects/test_project/authorization",
                    "acs:odps:*:projects/test_project/authorization/packages/*",
                    "acs:odps:*:projects/test_project/authorization/packages/*/*/*" 
                    ]
        }
    ],
    "Version":"1"
}

The following error is returned.

Create role test_role error: [400] com.aliyun.odps.OdpsException: failed to check policy format: invalid Action value - odps:CreatePackage

Cause

MaxCompute does not support granting project management permissions to a Resource-type role. CreatePackage is a project management permission. For more information, see List of project management permissions.
Solution

When you create a custom role that includes project management permissions, set the role type to Admin (management type). For more information, see Role planning.