Use roles to authorize users-MaxCompute(MaxCompute)-阿里云帮助中心

Roles are collections of permissions that you can use to efficiently grant the same access rights to multiple users. Using roles simplifies authorization and reduces management costs. This topic describes the role types in MaxCompute and how to manage them.

Role types

MaxCompute provides two types of roles: administrator roles and resource roles.

Administrator role: You can grant administrative permissions to this role only by using a policy. You cannot grant it resource-related permissions, nor can you grant administrative permissions by using an access control list (ACL).
Resource role: You can grant resource-related permissions to this role by using a policy or an ACL, but you cannot grant it administrative permissions.

Built-in roles

MaxCompute provides two built-in administrator roles at the project level and two at the tenant level: Super_Administrator and Admin.

Role level	Role name	Role type	Description
Project	Super_Administrator	Admin	A built-in administrator role in MaxCompute. This role has permissions to operate on all resources and perform all administrative tasks within a project. For more information, see Permissions of project-level administrator roles. A project owner or a user with the Super_Administrator role can grant the Super_Administrator role to other users.
Project	Admin	Admin	A built-in administrator role in MaxCompute. This role has permissions to operate on all resources in a project and a subset of basic administrative permissions. For more information, see Permissions of project-level administrator roles. A project owner can grant the Admin role to other users. A user with the Admin role cannot grant the Admin role to other users, configure project security settings, modify the project's authorization model, or modify the permissions of the Admin role.
Tenant	Super_Administrator	Admin	A built-in administrator role in MaxCompute. This role has tenant-level permissions for user management and role management, and can grant built-in tenant-level administrator roles to other users. An Alibaba Cloud account or a user with the Super_Administrator role can grant the Super_Administrator role to other users.
Tenant	Admin	Admin	A built-in administrator role in MaxCompute. This role has tenant-level permissions for user management and role management, but can only grant tenant-level custom roles to other users. An Alibaba Cloud account or a user with the Super_Administrator role can grant the Admin role to other users.

At the project level, the project owner has all permissions for the project. Other users cannot access objects within the project unless authorized by the project owner.

Custom roles

MaxCompute allows you to create custom administrator and resource roles to classify and manage users based on your business requirements.

Role level	Role name	Role type	Description
Project	Custom role	Admin, Resource	A custom role that can be defined as an administrator role to manage a project or as a resource role to manage object resources in the project.
Tenant	Custom role	Resource	A custom role used to define permissions on resources such as quotas, network links, and projects.

Role management operations

The following table describes the role management operations supported by MaxCompute.

Role level	Actions	Description	Operator role	Tool
Project	Create a project-level role	Creates a new role at the project level.	A project owner or a user with a built-in MaxCompute role at the project level.	MaxCompute client Connect by using SQL Analysis MaxCompute Studio Connect using DataWorks
	View a list of project-level roles	Views the roles in a project.
	Drop a project-level role	Deletes a role from a project.
Tenant	Create a tenant-level role Manage tenant-level roles	Create, retrieve, update, and delete custom roles at the tenant level.	An Alibaba Cloud account or a user with the tenant-level Super_Administrator or Admin role.	MaxCompute console - Role Management

Permissions of project-level administrator roles

The following table describes the administrative permissions of project-level administrator roles.

Permission type	Object	Actions	Description	Project owner	Super_Administrator role	Admin role
Project security configuration	Project	SetSecurityConfiguration	Configure security properties for a project.
Project security configuration	Project	GetSecurityConfiguration	View the security configuration of a project.
Trusted project management	Project	AddTrustedProject	Add a trusted project.
	Project	RemoveTrustedProject	Remove a trusted project.
	Project	ListTrustedProjects	List trusted projects.
User management	Project	AddUser	Add a user.
	Project	RemoveUser	Remove a user.
	Project	ListUsers	View the user list.
	Project	ListUserRoles	View a user's roles.
Role management	Project	CreateRole	Create a role.
	Project	DescribeRole	View role permissions.
	Project	AlterRole	Modify role attributes.
	Project	DropRole	Delete a role.
	Project	ListRoles	View the role list.
Role assignment	Role	GrantRole	Assign a role to a user.
	Role	RevokeRole	Revoke a role from a user.
	Role	ListRolePrincipals	View users assigned to a role.
Package management	Project	CreatePackage	Create a package.
	Project	ShowPackages	View the package list.
	Package	DescribePackage	View package information.
	Package	DropPackage	Delete a package.
	Package	InstallPackage	Install a package.
	Package	UninstallPackage	Uninstall a package.
	Package	AllowInstallPackage	Allow other projects to use a package.
	Package	DisallowInstallPackage	Disallow other projects from using a package.
	Package	AddPackageResource	Add a resource to a package.
	Package	RemovePackageResource	Remove a resource from a package.
Label management	Table	GrantLabel	Grant label permissions.
	Table	RevokeLabel	Revoke label permissions.
	Table	ShowLabelGrants	View label authorization information.
	Table	SetDataLabel	Set labels for users and roles.
Clear expired permissions	Project	ClearExpiredGrants	Clear expired permissions.

Note

The icon indicates that the permission is granted. The icon indicates that the permission is not granted.

Create a project-level role

You can create a new role in a MaxCompute project.

Important

After you create a role, you must bind it to a user. This grants the user the corresponding permissions of the role. For more information, see Assign a role to a user.

Command syntax

create role <role_name> [privilegeproperties("type"="admin|resource")];

Parameters

Parameter

Required

Description

role_name

Yes

The name of the new role. The name must be unique within the project and meet the following requirements:

Starts with a letter.
Contains only letters and digits.
Is no more than 64 characters in length.

You can run the list roles; command in the MaxCompute client to view created roles.

privilegeproperties

Defines the role type:

"type"="admin": Creates an administrative role, which can be authorized only by using a policy.
"type"="resource": Creates a resource-type role. This is the default type if a type is not specified. This role type supports authorization by using ACLs and policies.

Examples
- Create a resource role named Worker.
```
create role Worker;
```
- Create an administrator role named sale_admin.
```
 create role sale_admin privilegeproperties("type"="admin");
```

View a list of project-level roles

You can view the list of roles that are created in a MaxCompute project.

Command syntax
```
list roles;
```
Example
View the roles in a MaxCompute project.
```
list roles;
```
The command returns the following output:
```
admin
Super_Administrator
worker
```

Drop a project-level role

You can delete an existing role from a MaxCompute project.

Command syntax
```
drop role <role_name>;
```
Usage notes
When you drop a role, MaxCompute checks whether the role is assigned to any users. If it is, the operation fails. You must revoke a role from all users before you can drop it. To revoke a role from a user, see Revoke a role from a user.
Parameters
Parameter
Required
Description
role_name
Yes
The name of the role to delete.
You can run the list roles; command in the MaxCompute client to get a list of created roles.
Example
Delete the Worker role.
```
drop role Worker;
```

Purge permission information

When you delete a role from a MaxCompute project, its associated permission data, such as access control lists (ACLs), policies, and labels, remains in the project. If you later create a new role with the same name, the new role inherits the permissions of the deleted one. To prevent this, you can purge the permissions of a deleted role. If a deleted role has residual permission information, the project owner or a user with the Admin or Super_Administrator role can run the following command to purge the information.

Command syntax
```
purge privs from role <role_name>;
```
Parameters
Parameter
Required
Description
role_name
Yes
The name of the deleted role.
You can run the list roles; command in the MaxCompute client to view the created roles.
Note
Before you purge role permissions, make sure that the role has been deleted. If you run this command on an existing role, the command returns the error message"Principal <role_name> still exist in the project".

Manage tenant-level roles

To create a tenant-level role in the MaxCompute console, follow these steps:

Log on to the MaxCompute console and select a region in the upper-left corner.
In the left-side navigation pane, click Tenants.
On the Tenants page, click Roles.

On the Roles tab, you can perform the following operations.

Add a tenant role.

Click Add Role. In the Add Role dialog box, set the following parameters.

Parameter

Description

Role name

The name of the new tenant-level role. The name must be unique within the Alibaba Cloud account and meet the following requirements:

Starts with a letter.
Contains only letters, underscores (_), and digits.
Is 6 to 64 characters in length.

Policy content

The permission policy for the role. You can edit the policy code in the console based on a policy template.

Click OK. The new role then appears in the role list. For information about role authorization, see Tenant-level role authorization.

Manage a tenant role.
In the Actions column for the target role, click Delete or Manage Permissions.

On the Tenants > Users page, you can manage tenant-level users, add new users (only RAM users of the current Alibaba Cloud account), and grant tenant-level roles to them.

Next steps

After you plan your roles, you can grant permissions based on your business requirements. For more information, see Project-level role authorization.
After you create a role, you must assign it to a user. This grants the user the permissions associated with the role. For more information, see Assign a role to a user.