REVOKE

Prerequisites

Limitations

Usage notes

• Note the following when you use ACLs:

  • If you delete an object, MaxCompute automatically revokes all ACL permissions associated with that object.

  • When a user is removed from a project, their permissions are retained. If the user is added back to the project later, their previous permissions are automatically reactivated. To permanently clear a deleted user's permissions, see Permanently clear the permissions of a deleted user.

• Note the following when you use policies:

  • Policies let you grant permissions on objects that do not yet exist. If you delete an object, its policy-based permissions are not deleted. Be aware of the security risks if you delete and then re-create an object with the same name.

  • When a user is removed from a project, their permissions are retained. If the user is added back to the project later, their previous permissions are automatically reactivated. To permanently clear a deleted user's permissions, see Permanently clear the permissions of a deleted user.

Syntax

• Revoke ACL permissions

  revoke <actions> on <object_type> <object_name> 
  [(<column_list>)] from <subject_type> <subject_name>;

• Revoke policy-based permissions

  revoke <actions> on <object_type> <object_name> 
  from ROLE <role_name> 
  privilegeproperties ("policy" = "true", "allow"="{true|false}");

Parameters

Execution environment

Examples

Revoke permission to access a package

You can revoke permission from a user or role to access an installed package.

• Syntax

  revoke <actions> on package <project_name>.<package_name> from {USER|ROLE} <name>;

• Parameters

  Parameter	Required	Description
  actions	Yes	The action to revoke. The only valid value is Read.
  project_name	Yes	The name of the MaxCompute project to which the package belongs. Log on to the MaxCompute console. In the top navigation bar, select a region. The project name is on the Projects tab.
  package_name	Yes	The name of the package. You can run the show packages; command in the MaxCompute client to list created packages.
  name	Yes	The name of the user account or role from which to revoke the permission. You can specify only one user or role. You can run the list users; or list roles; command in the MaxCompute client to find user account or role names.

• Example

  Revoke permission to access the package from the user Bella. Sample command:

   -- Revoke permission from Bella to access the package.
  revoke Read on package test_project_a.datashare from user RAM$Amy@aliyun.com:Bella;

Revoke explicit Label permissions

A project owner or a user with the Admin role can revoke explicit Label permissions.

• Syntax

  revoke Label on table <table_name> [(<column_list>)] from {USER|ROLE} <name>;

• Usage notes

  • If you revoke a user's explicit Label permissions on a table, their explicit Label permissions on the columns of that table are also revoked.

  • Revoking explicit Label permissions does not affect the access level set for a user. For example, a user has an access level of 2 and is explicitly granted permission to access data with a sensitivity level of up to 3 in a table. After you revoke this explicit permission, the user can still access data in the table with a sensitivity level of 2 or lower.

• Parameters

  Parameter	Required	Description
  table_name	Yes	The name of the table or view. You can run the show tables; command in the MaxCompute client to get table or view names.
  column_list	No	The columns from which you want to revoke permission to access sensitive data. You can specify multiple columns. Separate multiple column names with commas (,).
  name	Yes	The name of the user or role. You can run the list users; or list roles; command in the MaxCompute client to find user account or role names.

• Example

  Assume that the test_project_a project contains a table named sale_detail with the columns shop_name, customer_id, and total_price. Bob@aliyun.com is the project owner of test_project_a. Allen is a RAM user that belongs to Bob and has been added to the project.

  Revoke permission from Allen to access highly sensitive data. Sample commands:

  -- Revoke permission from Allen to access data with a sensitivity level up to 3 in the shop_name, customer_id, and total_price columns of the sale_detail table.
  revoke Label on table sale_detail(shop_name, customer_id, total_price) from USER RAM$Bob@aliyun.com:Allen;
  -- Verify the result for Allen.
  show label grants on table sale_detail for USER RAM$Bob@aliyun.com:Allen;
  -- The following result is returned. The explicit grant is revoked.
  User Label: 1
  -- Revoke permission from Allen to access sensitive data in the sale_detail table.
  revoke Label on table sale_detail from USER RAM$Bob@aliyun.com:Allen; 
  -- Verify the result for Allen.
  show label grants on table sale_detail for USER RAM$Bob@aliyun.com:Allen;
  -- The following result is returned.
  User Label: 1

Remove a user from a role

Removes a user from a specified role.

• Syntax

  revoke <role_name> from <user_name>;

• Parameters

  • role_name: Required. The name of the role from which to remove the user.

  • user_name: Required. The account of the Alibaba Cloud user or RAM user to remove. The format for an Alibaba Cloud account is ALIYUN$<alibaba_cloud_account>, and the format for a RAM user is RAM$<alibaba_cloud_account>:<ram_user_name>.

• Example

  -- Remove the Alibaba Cloud user alice@aliyun.com from the player role.
  revoke player from ALIYUN$alice@aliyun.com;

Related commands

• CREATE PACKAGE: Creates a package.

• CREATE ROLE: Creates a role in a MaxCompute project.

• SET LABEL: MaxCompute supports label-based access control. You can set an access level for a user and a sensitivity level for a table or column at the project level.

• GRANT: Grants permissions to a user or role for specific operations on an object by using Access Control Lists (ACLs).