DocsICP FilingConsole
Documentation
Home Page MaxCompute User Guide Permission Management Grant permissions to a user Manage user permissions using commands

Manage user permissions using commands

Updated at:
Copy as MD
Product
My Favorites

After you add a user to a MaxCompute project, you must grant them permissions. A user can perform operations in the project only after they obtain the required permissions. In MaxCompute, you can grant permissions to users by assigning roles or by granting permissions directly. This topic describes the command syntax for user authorization and provides examples.

Grant permissions to a user by attaching a project-level role

MaxCompute recommends assigning project-level custom roles or built-in administrative roles to users. This approach gives users the same permissions as the role and simplifies the process of changing or revoking permissions for multiple users at once.

Note

Assign a MaxCompute project-level role to a user

You can assign a built-in or custom project-level role to a user. The user then inherits the permissions of that role.

  • Command format

    grant <role_name> to <user_name>;

  • Notes

    Multiple users can be assigned the same project-level role. A single user can also be assigned multiple project-level roles.

  • Parameters

    Parameter Name

    Required

    Description

    role_name

    Yes

    The name of the role to assign to the user.

    You can execute the list roles; command in the MaxCompute client to view role information.

    user_name

    Yes

    The name of the user who has been added to the MaxCompute project and to whom you want to assign the role. The format is as follows:

    You can execute the list users; command in the MaxCompute client to view user information.

  • Examples

    Attach the project-level role `Worker` to the Alibaba Cloud user Kate@aliyun.com, the RAM user RAM$Bob@aliyun.com:Allen, and the RAM role RAM$Bob@aliyun.com:role/ram_role in the MaxCompute project.

    --Bob enters the test_project_a project.
use test_project_a;
--Bob assigns the role to an Alibaba Cloud account.
grant Worker to ALIYUN$Kate@aliyun.com;
--Bob assigns the role to a RAM user.
grant Worker to RAM$Bob@aliyun.com:Allen;
--Bob assigns the role to a RAM role.
grant Worker to `RAM$Bob@aliyun.com:role/ram_role`;

Revoke a MaxCompute project-level role from a user

You can detach a role from a user. The user then loses the permissions associated with that role.

  • Command format

    revoke <role_name> from <user_name>;

  • Parameters

    Parameter name

    Required

    Description

    role_name

    Yes

    The name of the role to revoke.

    You can run the list roles; command in the MaxCompute client to obtain the role name.

    user_name

    Yes

    The name of the user from whom you want to revoke the role. The format is as follows:

    You can run the list users; command in the MaxCompute client to obtain the username.

  • Examples

    Revoke the `Worker` role from the users Kate@aliyun.com, RAM$Bob@aliyun.com:Allen, and RAM$Bob@aliyun.com:role/ram_role.

    --Bob enters the test_project_a project.
use test_project_a;
--Bob revokes the role from the Alibaba Cloud account.
revoke Worker from ALIYUN$Kate@aliyun.com;
--Bob revokes the role from the RAM user.
revoke Worker from RAM$Bob@aliyun.com:Allen;
--Bob revokes the role from the RAM role.
revoke Worker from `RAM$Bob@aliyun.com:role/ram_role`;

Common authorization scenarios and syntax examples

Authorization scenario

Authorization method

Authorizer

Authorization entry point

Grant a user operation permissions on an object using a role

First, grant permissions to the role using Access Control List (ACL)-based access control or policy-based access control. Then, assign the role to the user.

See the Supported Authorizers column in Permission summary.

Revoke operation permissions on an object that were granted to a user using a role

Grant a user the Download permission using a role

First, grant permissions to the role using download permission control. Then, assign the role to the user.

Revoke the Download permission that was granted to a user using a role

Grant a user permissions to access data with the same high sensitivity level using a role

First, grant permissions to the role using label-based access control. Then, assign the role to the user.

Revoke permissions to access data with the same high sensitivity level that were granted to a user using a role

Grant a user operation permissions on an object using a role

You can grant permissions to a role using the ACL-based or policy-based authorization mechanism. Then, you can assign the role to multiple users.

For more information about how to grant permissions to a role, see Grant operation permissions on an object to a role.

Assume that Bob@aliyun.com is the project owner of `test_project_a`. Allen, Alice, and Tom are RAM users of Bob@aliyun.com . You need to grant the three RAM users permissions to create tables, models, functions, and instances, and to view the list of all object types in the project. The following command provides an example.

--Bob enters the test_project_a project.
use test_project_a;
--Bob adds Allen, Alice, and Tom to the test_project_a project.
add user RAM$Bob@aliyun.com:Allen;
add user RAM$Bob@aliyun.com:Alice;
add user RAM$Bob@aliyun.com:Tom;
--Bob creates the Worker role.
create role Worker;
--Bob grants permissions to the Worker role.
   --Method 1: ACL-based authorization.
grant CreateTable, CreateModel, CreateFunction, CreateInstance, List on project test_project_a to ROLE Worker;
   --Method 2: Policy-based authorization.
grant CreateTable, CreateModel, CreateFunction, CreateInstance, List 
      on project test_project_a  
      to ROLE Worker privilegeproperties("policy" = "true", "allow"="true");
--Assign the Worker role to the users.
grant Worker to RAM$Bob@aliyun.com:Allen;
grant Worker to RAM$Bob@aliyun.com:Alice;
grant Worker to RAM$Bob@aliyun.com:Tom;

Revoke operation permissions on an object that were granted to a user using a role

You can revoke the authorization in the following ways:

  • Revoke the permissions from the role

    All users who are assigned this role will lose the corresponding permissions.

  • Revoke the role from a specific user

    Only the user from whom the role is revoked loses the permissions. The permissions of other users are not affected.

Assume that Bob@aliyun.com is the owner of the `test_project_a` project. Allen, Alice, and Tom are RAM users that belong to the Bob@aliyun.com account. The three RAM users have been granted permissions to create tables, models, functions, and instances, and to view the list of all object types in the project through the `Worker` role. The following examples show the commands that you can use to revoke operation permissions on objects.

  • Method 1: Revoke the permissions from the `Worker` role.

    --Enter the test_project_a project.
use test_project_a;
--Revoke the permissions from the Worker role. Allen, Alice, and Tom no longer have the CreateTable, CreateFunction, CreateInstance, and List permissions.
   --Revoke ACL-based authorization.
revoke CreateTable, CreateModel, CreateFunction, CreateInstance, List on project test_project_a from ROLE Worker;
   --Revoke Policy-based authorization.
revoke CreateTable, CreateModel, CreateFunction, CreateInstance, List 
      on project test_project_a  
      from ROLE Worker privilegeproperties("policy" = "true", "allow"="true");

  • Method 2: Revoke the `Worker` role from a user.

    --Enter the test_project_a project.
use test_project_a;
--Revoke the Worker role from the user. Only Allen no longer has the CreateTable, CreateFunction, CreateInstance, and List permissions.
revoke Worker from RAM$Bob@aliyun.com:Allen;

Grant a user the Download permission using a role

You can grant permissions to a role using the download authorization mechanism. Then, you can assign the role to the user.

For more information about how to grant permissions to a role, see Grant the Download permission to a role.

Assume that Bob@aliyun.com is the owner of the `test_project_a` project, and Allen, Alice, and Tom are RAM users that belong to Bob@aliyun.com. You need to grant the three RAM users permissions to download data from a specified table. The following command provides an example.

--Bob enters the test_project_a project.
use test_project_a;
--Bob adds Allen, Alice, and Tom to the test_project_a project.
add user RAM$Bob@aliyun.com:Allen;
add user RAM$Bob@aliyun.com:Alice;
add user RAM$Bob@aliyun.com:Tom;
--Bob creates the Worker role.
create role Worker;
--Bob grants permissions to the Worker role.
grant download on table sale_detail to ROLE Worker;
--Assign the Worker role to the users.
grant Worker to RAM$Bob@aliyun.com:Allen;
grant Worker to RAM$Bob@aliyun.com:Alice;
grant Worker to RAM$Bob@aliyun.com:Tom;

Revoke the Download permission that was granted to a user using a role

You can revoke the authorization in the following ways:

  • Revoke the permissions from the role

    All users who are assigned this role will lose the corresponding permissions.

  • Revoke the role from a specific user

    Only the user from whom the role is revoked loses the permissions. The permissions of other users are not affected.

Assume that Bob@aliyun.com is the owner of the `test_project_a` project. Allen, Alice, and Tom are RAM users under the Bob@aliyun.com account. You have granted the three RAM users permission to download all table data by assigning the `Worker` role to them. To revoke the Download permission from the RAM users, you can use one of the following methods:

  • Method 1: Revoke the permissions from the `Worker` role.

    --Enter the test_project_a project.
use test_project_a;
--Revoke the permissions from the Worker role. Allen, Alice, and Tom no longer have the Download permission.
revoke Download on table sale_detail from ROLE Worker;

  • Method 2: Revoke the `Worker` role from a user.

    --Enter the test_project_a project.
use test_project_a;
--Revoke the Worker role from the user. Only Allen no longer has the Download permission.
revoke Worker from RAM$Bob@aliyun.com:Allen;

Grant a user permissions to access data of the same high sensitivity level using a role

You can grant permissions to a role using the label-based or policy-based authorization mechanism. Then, you can assign the role to multiple users.

For more information about how to grant permissions to a role, see Grant permissions to access data with a high sensitivity level to a role.

Assume that Bob@aliyun.com is the owner of the `test_project_a` project, and Allen, Alice, and Tom are RAM users of Bob@aliyun.com. The data access level of these RAM users is 2. To grant them permissions to access data with a sensitivity level of 4 in a destination table within the project, you can use the following command.

--Bob enters the test_project_a project.
use test_project_a;
--Bob creates the Worker role.
create role Worker;
--Bob grants permissions to the Worker role.
grant Label 4 on table <table_name> to ROLE Worker;  --table_name is the name of the destination table.
--Assign the Worker role to the users.
grant Worker to RAM$Bob@aliyun.com:Allen;
grant Worker to RAM$Bob@aliyun.com:Alice;
grant Worker to RAM$Bob@aliyun.com:Tom;

Revoke permissions to access data of the same high sensitivity level that were granted to a user using a role

You can revoke the authorization in the following ways:

  • Revoke the permissions from the role

    All users who are assigned this role will lose the corresponding permissions.

  • Revoke the role from a specific user

    Only the user from whom the role is revoked loses the permissions. The permissions of other users are not affected.

Assume that Bob@aliyun.com is the owner of the `test_project_a` project. Allen, Alice, and Tom are RAM users that belong to Bob@aliyun.com. The three RAM users have been granted permissions to access data at sensitivity level 4 in a target table of the project. To revoke the permissions to access this highly sensitive data, you can use the following example commands.

  • Method 1: Revoke the permissions from the `Worker` role.

    --Enter the test_project_a project.
use test_project_a;
--Revoke the permissions from the Worker role. Allen, Alice, and Tom can now only access data with a maximum sensitivity level of 2.
revoke Label on table <table_name> from ROLE Worker;     --table_name is the name of the destination table.

  • Method 2: Revoke the `Worker` role from a user.

    --Enter the test_project_a project.
use test_project_a;
--Revoke the Worker role from the user. Allen can now only access data with a maximum sensitivity level of 2. Alice and Tom can still access data with a maximum sensitivity level of 4.
revoke Worker from RAM$Bob@aliyun.com:Allen;

Grant permissions to a user directly

MaxCompute also supports granting permissions directly to users. The following sections describe common authorization scenarios and provide syntax examples.

Note

Authorization scenario

Authorization method

Authorizer

Authorization entry point

Grant a user operation permissions on an object

ACL-based access control

See the Supported Authorizers column in Permission summary.

Revoke operation permissions on an object from a user

Grant the Download permission to a user

Download permission control

Revoke the Download permission from a user

Grant a user permissions to access data with a high sensitivity level

Label-based access control

Revoke permissions to access data with a high sensitivity level from a user

Grant a user operation permissions on an object

You can grant a user operation permissions on a project, table, model, resource, function, or instance using the ACL-based authorization mechanism.

  • Grant a user operation permissions on a project

    • Command format

      grant Read|Write|List|CreateTable|CreateInstance|CreateFunction|CreateResource|All 
      on project <project_name> 
      to USER <user_name> [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

    • Parameters

      Parameter Name

      Required

      Description

      project_name

      Yes

      The project name. You can log on to the MaxCompute console, switch the region in the upper-left corner, and then obtain the specific MaxCompute project name on the Project management tab.

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and to whom you want to assign the role. The format is as follows:

      You can execute the list users; command in the MaxCompute client to view user information.

      privilegeproperties

      conditions

      No

      The conditions used for policy-based access control, such as the source of a request message and the access method. The format is "<var_name> <Operation> constant" and "<var_name> <Operation> constant" and .... See Conditions for a list of supported var_name and Operation values.

      days

      No

      The expiration time of the permission, in days. If you do not specify this parameter, the permission is valid for a long term by default. If you specify this parameter, MaxCompute automatically clears the permission information after the permission expires.

  • Grant a user operation permissions on a table

    • Command format

      grant Describe|Select|Alter|Update|Drop|ShowHistory|All 
      on table <table_name> [(<column_list>)] 
      to USER <user_name> [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

    • Parameters

      Parameter name

      Required

      Description

      table_name

      Yes

      Table name: You can execute the show tables; command on the MaxCompute client to obtain the name of a table or view.

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and to whom you want to assign the role. The format is as follows:

      You can execute the list users; command in the MaxCompute client to view user information.

      privilegeproperties

      conditions

      No

      The conditions used for policy-based access control, such as the source of a request message and the access method. The format is "<var_name> <Operation> constant" and "<var_name> <Operation> constant" and .... For a list of supported var_name and Operation values, see Conditions.

      days

      No

      The expiration time of the permission, in days. If you do not specify this parameter, the permission is valid for a long term by default. If you specify this parameter, MaxCompute automatically clears the permission information after the permission expires.

  • Grant a user operation permissions on a model

    • Command format

      grant Describe|Execute|Alter|Drop|All
      on MODEL <model_name>
      to USER <user_name> [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

    • Parameters

      • model_name: Required. The name of the model. You can obtain the model name by running the list models; command in the MaxCompute client.

  • Grant a user operation permissions on a resource

    • Command format

      grant Read|Write|Delete|All 
      on resource <resource_name> 
      to USER <user_name> [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

    • Parameters

      Parameter name

      Required

      Description

      resource_name

      Yes

      Resource name: You can use the MaxCompute client to execute the list resources; command to obtain the resource name.

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and to whom you want to assign the role. The format is as follows:

      You can execute the list users; command in the MaxCompute client to view user information.

      privilegeproperties

      conditions

      No

      The conditions used for policy-based access control, such as the source of a request message and the access method. The format is "<var_name> <Operation> constant" and "<var_name> <Operation> constant" and .... For a list of supported var_name and Operation, see Conditions.

      days

      No

      The expiration time of the permission, in days. If you do not specify this parameter, the permission is valid for a long term by default. If you specify this parameter, MaxCompute automatically clears the permission information after the permission expires.

  • Grant a user operation permissions on a function

    • Command format

      grant Read|Write|Delete|Execute|All 
      on function <function_name> 
      to USER <user_name> [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

    • Parameters

      Parameter name

      Required

      Description

      function_name

      Yes

      Function name: You can obtain the function name by executing the list functions; command in the MaxCompute client.

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and to whom you want to assign the role. The format is as follows:

      You can execute the list users; command in the MaxCompute client to view user information.

      privilegeproperties

      conditions

      No

      The conditions used for policy-based access control, such as the source of a request message and the access method. The format is "<var_name> <Operation> constant" and "<var_name> <Operation> constant" and .... For a list of supported var_name and Operation values, see Conditions.

      days

      No

      The expiration time of the permission, in days. If you do not specify this parameter, the permission is valid for a long term by default. If you specify this parameter, MaxCompute automatically clears the permission information after the permission expires.

  • Grant a user operation permissions on an instance

    • Command format

      grant Read|Write|All 
      on instance <instance_id> 
      to USER <user_name> [privilegeproperties("conditions" = "<conditions>", "expires"="<days>")];

    • Parameters

      Parameter name

      Required

      Description

      instance_id

      Yes

      Instance ID: You can execute the show instances; command on the MaxCompute client to obtain the instance ID.

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and to whom you want to assign the role. The format is as follows:

      You can execute the list users; command in the MaxCompute client to view user information.

      privilegeproperties

      conditions

      No

      The conditions used for access control, such as the source of a request message and the access method. The format is "<var_name> <Operation> constant" and "<var_name> <Operation> constant" and .... For a list of supported var_name and Operation values, see Conditions.

      days

      No

      The expiration time of the permission, in days. If you do not specify this parameter, the permission is valid for a long term by default. If you specify this parameter, MaxCompute automatically clears the permission information after the permission expires.

  • Examples

    Assume that Bob@aliyun.com is the owner of the `test_project_a` project. Allen, Alice, and Tom are RAM users that belong to the Alibaba Cloud account Bob@aliyun.com. BI_Analyst is a RAM role that belongs to the Alibaba Cloud account Bob@aliyun.com. Kate@aliyun.com is another Alibaba Cloud account to be added to the `test_project_a` project.

    • Example 1: Grant the Alibaba Cloud account Kate permissions to create tables, functions, and instances, and to view the list of all object types in the project.

      --Bob enters the test_project_a project.
use test_project_a;
--Add Kate to the MaxCompute project.
add user ALIYUN$Kate@aliyun.com;
--Bob grants permissions to Kate.
grant CreateTable, CreateFunction, CreateInstance, List on project test_project_a to user ALIYUN$Kate@aliyun.com;

    • Example 2: Grant the RAM user Allen and a RAM role permissions to create tables, view all object types in the project, and read the metadata and data of a table.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob adds Allen to the test_project_a project.
add user RAM$Bob@aliyun.com:Allen;
--Bob adds the RAM role BI_Analyst to the test_project_a project.
add user `RAM$Bob@aliyun.com:role/BI_Analyst`;
--Bob grants permissions to the RAM user Allen.
grant CreateTable, List on project test_project_a to USER RAM$Bob@aliyun.com:Allen;
grant Describe, Select on table sale_detail to USER RAM$Bob@aliyun.com:Allen;
--Bob grants permissions to the RAM role BI_Analyst.
grant CreateTable, List on project test_project_a to USER `RAM$Bob@aliyun.com:role/BI_Analyst`;
grant Describe, Select on table sale_detail to USER `RAM$Bob@aliyun.com:role/BI_Analyst`;

    • Example 3: Grant the RAM user Alice permissions to read and update a resource.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob adds Alice to the test_project_a project.
add user RAM$Bob@aliyun.com:Alice;
--Bob grants permissions to Alice.
grant Read, Write on resource udtf.jar to USER RAM$Bob@aliyun.com:Alice;

    • Example 4: Grant the RAM user Tom permissions to read and update a function.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob adds Tom to the test_project_a project.
add user RAM$Bob@aliyun.com:Tom;
--Bob grants permissions to Tom.
grant Read, Write on function udf_test to USER RAM$Bob@aliyun.com:Tom;

    • Example 5: Grant the RAM user Tom all operation permissions on an instance.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob adds Tom to the test_project_a project.
add user RAM$Bob@aliyun.com:Tom;
--Bob grants permissions to Tom.
grant All on instance 202112300224**** to USER RAM$Bob@aliyun.com:Tom;

Revoke operation permissions on an object from a user

You can revoke operation permissions on a project, table, model, resource, function, or instance from a user.

  • Revoke operation permissions on a project from a user

    • Command format

      revoke Read|Write|List|CreateTable|CreateInstance|CreateFunction|CreateResource|All 
      on project <project_name> 
      from USER <user_name>;

    • Parameters

      Parameter

      Required

      Description

      project_name

      Yes

      The project name. You can log on to the MaxCompute console, switch the region in the upper-left corner, and then obtain the specific MaxCompute project name on the Project management tab.

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and from whom you want to revoke the role. The format is as follows:

      You can execute the list users; command in the MaxCompute client to view user information.

      privilegeproperties

      conditions

      No

      The conditions used for policy-based access control, such as the source of a request message and the access method. The format is "<var_name> <Operation> constant" and "<var_name> <Operation> constant" and .... For the list of supported var_name and Operation values, see Conditions.

      days

      No

      The expiration time of the permission, in days. If you do not specify this parameter, the permission is valid for a long term by default. If you specify this parameter, MaxCompute automatically clears the permission information after the permission expires.

  • Revoke operation permissions on a table from a user

    • Command format

      revoke Describe|Select|Alter|Update|Drop|ShowHistory|All 
      on table <table_name> [(<column_list>)] 
      from USER <user_name>;

    • Parameters

      Parameter name

      Required

      Description

      table_name

      Yes

      Table name: You can obtain the name of a table or view by executing the show tables; command in the MaxCompute client.

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and from whom you want to revoke the role. The format is as follows:

      You can execute the list users; command in the MaxCompute client to view user information.

      privilegeproperties

      conditions

      No

      The conditions used for policy-based access control, such as the source of a request message and the access method. The format is "<var_name> <Operation> constant" and "<var_name> <Operation> constant" and .... For a list of supported var_name and Operation values, see Conditions.

      days

      No

      The expiration time of the permission, in days. If you do not specify this parameter, the permission is valid for a long term by default. If you specify this parameter, MaxCompute automatically clears the permission information after the permission expires.

  • Revoke operation permissions on a model from a user

    • Command format

      revoke Describe|Execute|Alter|Drop|All
      on MODEL <model_name> 
      from USER <user_name>;

    • Parameters

      • model_name: Required. The name of the model. You can obtain the model name by running the list models; command in the MaxCompute client.

  • Revoke operation permissions on a resource from a user

    • Command format

      revoke Read|Write|Delete|All 
      on resource <resource_name> 
      from USER <user_name>;

    • Parameters

      Parameter Name

      Required

      Description

      resource_name

      Yes

      You can obtain the resource name by executing the list resources; command on the MaxCompute client.

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and from whom you want to revoke the role. The format is as follows:

      You can execute the list users; command in the MaxCompute client to view user information.

      privilegeproperties

      conditions

      No

      The conditions used for policy-based access control, such as the source of a request message and the access method. The format is "<var_name> <Operation> constant" and "<var_name> <Operation> constant" and .... For a list of supported var_name and Operation, see Conditions.

      days

      No

      The expiration time of the permission, in days. If you do not specify this parameter, the permission is valid for a long term by default. If you specify this parameter, MaxCompute automatically clears the permission information after the permission expires.

  • Revoke operation permissions on a function from a user

    • Command format

      revoke Read|Write|Delete|Execute|All 
      on function <function_name> 
      from USER <user_name>;

    • Parameters

      Parameter Name

      Required

      Description

      function_name

      Yes

      Function name: You can obtain the function name by executing the list functions; command in the MaxCompute client.

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and from whom you want to revoke the role. The format is as follows:

      You can execute the list users; command in the MaxCompute client to view user information.

      privilegeproperties

      conditions

      No

      The conditions used for policy-based access control, such as the source of a request message and the access method. The format is "<var_name> <Operation> constant" and "<var_name> <Operation> constant" and .... See Conditions for a list of supported var_name and Operation.

      days

      No

      The expiration time of the permission, in days. If you do not specify this parameter, the permission is valid for a long term by default. If you specify this parameter, MaxCompute automatically clears the permission information after the permission expires.

  • Revoke operation permissions on an instance from a user

    • Command format

      revoke Read|Write|All 
      on instance <instance_id> 
      from USER <user_name>;

    • Parameters

      Parameter Name

      Required

      Description

      instance_id

      Yes

      Instance ID: You can obtain the instance ID by executing the show instances; command in the MaxCompute client.

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and from whom you want to revoke the role. The format is as follows:

      You can use the MaxCompute client to execute the list users; command to view user information.

      privilegeproperties

      conditions

      No

      The conditions used for policy-based access control, such as the source of a request message and the access method. The format is "<var_name> <Operation> constant" and "<var_name> <Operation> constant" and .... For a list of supported var_name and Operation values, see Conditions.

      days

      No

      The expiration time of the permission, in days. If you do not specify this parameter, the permission is valid for a long term by default. If you specify this parameter, MaxCompute automatically clears the permission information after the permission expires.

  • Examples

    Revoke the operation permissions on objects that were granted to the user Kate and the RAM users Allen, Alice, and Tom. The following command provides an example.

    • Example 1: Revoke the permissions to create tables, functions, and instances, and to view the list of all object types in the project from Kate.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob revokes permissions from Kate.
revoke CreateTable, CreateFunction, CreateInstance, List on project test_project_a from user ALIYUN$Kate@aliyun.com;

    • Example 2: Revoke the permissions to read the metadata and data of a table from the RAM user Allen.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob revokes permissions from Allen.
revoke Describe, Select on table sale_detail from USER RAM$Bob@aliyun.com:Allen;

    • Example 3: Revoke the permissions to read and update a resource from the RAM user Alice.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob revokes permissions from Alice.
revoke Read, Write on resource udtf.jar from USER RAM$Bob@aliyun.com:Alice;

    • Example 4: Revoke the permissions to read and update a function from the RAM user Tom.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob revokes permissions from Tom.
revoke Read, Write on function udf_test from USER RAM$Bob@aliyun.com:Tom;

    • Example 5: Revoke all operation permissions on an instance from the RAM user Tom.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob revokes permissions from Tom.
revoke All on instance 202112300224**** from USER RAM$Bob@aliyun.com:Tom;

  • Grant the Download permission to a user

    You can grant a user permission to download the data of a table, resource, function, or instance.

    • Command format

      grant Download on {Table|Resource|Function|Instance} <object_name> to USER <user_name>;

    • Parameters

      Parameter Name

      Required

      Description

      object_name

      Yes

      The name of the object on which permissions are granted. You can obtain the name in the following ways:

      • Table name: You can execute the show tables; command on the MaxCompute client to obtain the table or view name.

      • Resource name: You can use the MaxCompute client to execute the list resources; command to obtain the resource name.

      • Function name: You can execute the list functions; command in the MaxCompute client to obtain the function name.

      • Instance name: In the MaxCompute client, you can execute the show instances; command to obtain the instance ID.

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and to whom you want to assign the role. The format is as follows:

      You can execute the list users; command in the MaxCompute client to view user information.

    • Examples

      Assume that download permission control is enabled for the `test_project_a` project. You need to grant the user Allen permission to download data from a specified table. The following command provides an example.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob grants permissions to Allen.
grant Download on table sale_detail to USER RAM$Bob@aliyun.com:Allen;

  • Revoke the Download permission from a user

    You can revoke the permission to download the data of a table, resource, function, or instance from a user.

    • Command format

      revoke Download on {Table|Resource|Function|Instance} <object_name> from USER <user_name>;

    • Parameters

      Parameter Name

      Required

      Description

      object_name

      Yes

      The name of the object from which permissions are revoked. You can obtain the name in the following ways:

      • Table name: You can execute the show tables; command in the MaxCompute client to obtain the table or view name.

      • Resource name: You can obtain the resource name by executing the list resources; command in the MaxCompute client.

      • Function name: You can use the MaxCompute client to execute the list functions; command to obtain the function name.

      • Instance name: You can execute the show instances; command in the MaxCompute client to obtain the instance ID.

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and from whom you want to revoke the role. The format is as follows:

      You can use the MaxCompute client to execute the list users; command to view user information.

    • Examples

      Revoke the permission to download data from a specified table from the user Allen. The following command provides an example.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob revokes permissions from Allen.
revoke Download on table sale_detail from USER RAM$Bob@aliyun.com:Allen;

  • Grant a user permissions to access data with a high sensitivity level

    You can grant a user permissions to access data with a high sensitivity level using the label-based authorization mechanism.

    • Command format

      grant Label <number> on table <table_name> [(<column_list>)] to USER <user_name> [with exp <days>];

    • Parameters

      Parameter name

      Required

      Description

      number

      Yes

      The highest data sensitivity level that the user or role can access.

      The value ranges from 0 to 9, corresponding to the data sensitivity level labels.

      table_name

      Yes

      The name of the destination table or view.

      You can execute the show tables; command in the MaxCompute client to obtain the name of a table or view.

      column_list

      No

      To grant access permissions on specified columns in the destination table or view, configure this parameter. You can specify multiple column names for a single authorization. Separate the column names with commas (,).

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and to whom you want to assign the role. The format is as follows:

      You can use the MaxCompute client to execute the list users; command to view user information.

      days

      No

      The expiration time of the permission, in days. The value can be from 0 to 263-1. If you do not specify this parameter, the default expiration time is 180 days.

    • Examples

      Assume that in the `test_project_a` project, the user Allen has a permitted access label level of 2. You need to grant this user permission to access data with a maximum sensitivity level of 4 in the `sale_detail` table. The following command provides an example.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob grants permissions to the user Allen.
grant Label 4 on table sale_detail to USER RAM$Bob@aliyun.com:Allen;

  • Revoke permissions to access data with a high sensitivity level from a user

    • Command format

      revoke Label <number> on table <table_name> [(<column_list>)] from USER <user_name>;

    • Parameters

      Parameter Name

      Required

      Description

      number

      Yes

      The highest data sensitivity level for which you want to revoke access permissions from the user or role.

      The value ranges from 0 to 9, corresponding to the data sensitivity level labels.

      table_name

      Yes

      The name of the destination table or view from which you want to revoke access permissions.

      You can execute the show tables; command in the MaxCompute client to obtain table or view names.

      column_list

      No

      To revoke access permissions on specified columns in the destination table or view, configure this parameter. You can specify multiple column names for a single authorization. Separate the column names with commas (,).

      user_name

      Yes

      The name of the user who has been added to the MaxCompute project and from whom you want to revoke the role. The format is as follows:

      You can use the MaxCompute client to execute the list users; command to view user information.

    • Examples

      Revoke the permission to access data with a maximum sensitivity level of 4 in the `sale_detail` table from the user Allen. The following command provides an example.

      --Bob enters the test_project_a project.
use test_project_a;
--Bob revokes permissions from the user Allen.
revoke Label 4 on table sale_detail from USER RAM$Bob@aliyun.com:Allen;

Completely purge the remaining permission information of a deleted user

After a user is removed from a project, their permission data, such as ACL, policy, and label permissions, remains in the project. If this user is added back to the project, they will automatically regain their original permissions. This feature is useful if a user is accidentally removed. However, it can also pose a security risk if a user is intentionally removed and then re-added with a different identity.

To address this, MaxCompute provides a feature to purge user permissions. If a user is no longer in a project but still has residual ACL, policy, or label permissions, the project owner or a user with the Admin or Super_Administrator role can run the following command to purge this information.

  • Command format

purge privs from user <user_name>;

  • Parameters

    Parameter Name

    Required

    Description

    user_name

    Yes

    The name of the user who has been removed from the MaxCompute project and whose remaining permission information you want to purge. The format is as follows:

Note

If you run this command for a user who has not been removed from the project, the "Principal <username> still exist in the project" error is returned. You must first run the remove user <user_name> command to remove the user from the project.

Next steps

After you grant permissions to a user, you can query their authorization information. For more information, see Query user permission information.

Previous：User planning and managementNext：Manage user permissions in the console