How to handle the ODPS-0420095 error code-MaxCompute(MaxCompute)-阿里云帮助中心

How to read an access denied error

Most ODPS-0420095 errors encode the missing permission directly in the error message. Locate the two key fields:

Action — what operation was attempted (for example, odps:CreateInstance)
Resource — what object the action targeted (for example, acs:odps:*:projects/maxcompute_dev)

For example:

ODPS-0420095: Access Denied - You have no privilege 'odps:CreateInstance' on {acs:odps:*:projects/maxcompute_dev}

Here, CreateInstance is the action and maxcompute_dev is the project resource. Match the action and resource to identify who can grant the missing permission and which statement to run.

Permission layers in MaxCompute

Access denied errors span multiple permission layers. Use the table below to identify which layer your error belongs to, then jump to the relevant section.

Layer	What it controls	Relevant error
Project membership	Whether the user exists in a project	Error 3
Project-level ACL	Whether the user can perform a specific action on a project resource	Error 1, Error 2
Security admin role	Whether the user can manage roles and permissions within a project	Error 4
Quota/tenant	Whether the user is authorized to use a specific quota	Error 6
Quota type	Whether the quota supports the job type	Error 5

Error 1: You have no privilege to create external project

Sample error

ODPS-0420095: Access Denied - You have no privilege to create external project - you have to be owner,super admin or admin of the referred project.

Cause

The account does not have permission to create external projects. Only users assigned the Super_Administrator or admin role can create external projects.

Solution

Ask the project owner to grant the Super_Administrator or admin role to the account. Run one of the following statements:

grant Super_Administrator TO RAM$xxx;

grant admin TO RAM$xxx;

For more information, see Manage user permissions by using commands.

Error 2: You have no privilege 'odps:\<Action\>' on {acs:odps:\*:projects/\<project_name\>}

Sample error

ODPS-0420095: Access Denied - You have no privilege 'odps:CreateInstance' on {acs:odps:*:projects/maxcompute_dev}

Cause

The account lacks the specific action permission on the target project. In this example, the account does not have CreateInstance permission on the maxcompute_dev project.

Read the error message to identify the missing action (the part after no privilege) and the target project (the part after projects/). For a full list of supported actions and resources, see MaxCompute permissions.

Solution

Ask the owner of the target project to grant the required permission using a GRANT statement. For the example error above:

grant CreateInstance on project maxcompute_dev to USER RAM$xxx;

For syntax details, see Grant permissions to users in a project.

Error 3: You don't exist in project \<project_name\>

Sample error

ODPS-0420095: Access Denied - You don't exist in project <project_name>.

Cause

The account is not a member of the project. Before any project-level permissions can be granted, the account must be added to the project.

Solution

Ask the project owner to add the account as a project member. Run the appropriate command based on the account type:

Alibaba Cloud account:
```
add user ALIYUN$<account_name>;
```

RAM user:

add user RAM$[<account_name>:]<Name of the RAM user>;

RAM role:

Important
The grave accent (\`) in the RAM role command is required.
```
add user `RAM$<accout_name>:role/<Name of the RAM role>`;
```

Additional step for RAM roles: After adding a RAM role, assign it to DataWorks by attaching the following policy to the RAM role. This allows DataWorks to submit periodically scheduled jobs to MaxCompute on behalf of the role.

{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "dataworks.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}

For more information, see User planning and management.

Error 4: You have NO privilege to do the PROJECT SECURITY OPERATION for {\<resource\>}

Sample error

com.aliyun.odps.OdpsException: ODPS-0420095: Access Denied - Authorization Failed [4003], You have NO privilege to do the PROJECT SECURITY OPERATION for {acs:odps:*:projects/test_sx_0831006/authorization/roles}. Context ID:312d7f21-ae64-4a43-b558-e8712eb85291. (MC RequestID: 638DB6702EC9C84692F2F55A)

Cause

The account does not have permission to manage security settings (such as roles) within the project. The resource path in the error message identifies what the account tried to manage — in this example, authorization/roles in the project test_sx_0831006.

Solution

Ask the project owner or a user with the super_administrator role to grant management permissions using one of these two methods:

Method 1: Grant the admin or super_administrator role

Grant the admin or super_administrator role directly to the account. This gives the account full project management permissions.

Method 2: Create a custom administrative role

Create a custom role with only the required security management permissions and grant it to the account. Follow the "Manage roles" step in Configure a project, then attach a policy with the specific actions and resources needed.

For supported actions and resources for administrative permissions, see Permissions on project management. The following example policy grants permissions on roles within a project, using wildcards to cover sub-resources:

{
    "Statement": [{
            "Action": ["odps:*"],
            "Effect": "Allow",
            "Resource": ["acs:odps:*:projects/<project_name>/authorization/roles",
              "acs:odps:*:projects/<project_name>/authorization/roles/*/*"]}],
    "Version": "1"
}

Error 5: The task is not in release range: CUPID

Sample error

ODPS-0420095: Access Denied - The task is not in release range: CUPID

Cause

The quota used by the job — or the default quota of the project — does not support Spark on MaxCompute jobs. The pay-as-you-go Developer Edition only supports MaxCompute SQL jobs (including UDFs) and PyODPS jobs.

Solution

Purchase MaxCompute computing resources and bind them to a pay-as-you-go quota or a subscription quota to run Spark jobs. For more information, see Overview.

Error 6: You have no privilege 'odps:Usage' on {acs:odps:\*:tenants/\<tenant_id\>/regions/\<region_id\>/quotas/\<quotaname\>}

Sample error

ODPS-0420095: Access Denied - Authorization Failed [], You have NO privilege 'odps:Usage' on {acs: odps: *:tenants/111111/regions/cn-beijing/quotas/q_1}

Cause

The account is not authorized to use the job-level quota specified in the error message. Quota permissions are managed at the tenant level, separately from project-level permissions.

Solution

Go to the Tenants page in the MaxCompute console and verify that the account has the required permission to use the quota.