Access Tablestore from MaxCompute within the same account-Tablestore(Tablestore)-阿里云帮助中心

This topic describes how to use a Resource Access Management (RAM) role to allow MaxCompute to access Tablestore within the same Alibaba Cloud account.

Background information

A RAM role, like a Resource Access Management (RAM) user, is a type of RAM identity. A RAM role is a virtual user that does not have a specific identity authentication key. It must be assumed by a trusted entity.

Procedure

Log on to the RAM console.
Create the AliyunODPSDefaultRole role.
1. In the navigation pane on the left, choose Identity Management > Roles.
2. On the Roles page, click Create Role.
3. On the Create Role page, set Trusted Entity Type to Alibaba Cloud Account and set Trusted Entity Name to the current Alibaba Cloud account. Then, click OK.
4. In the Create Role dialog box, set Role Name to AliyunODPSDefaultRole, and then click OK.
Create an authorization policy.
1. In the navigation pane on the left, choose Permission Management > Access Policies.
2. On the Access Policies page, click Create Access Policy.
3. On the Create Access Policy page, click the Script Editor tab, enter the following policy content, and then click OK.
```
{
  "Version": "1",
  "Statement": [
  {
    "Action": [
    "ots:ListTable",
    "ots:DescribeTable",
    "ots:GetRow",
    "ots:PutRow",
    "ots:UpdateRow",
    "ots:DeleteRow",
    "ots:GetRange",
    "ots:BatchGetRow",
    "ots:BatchWriteRow",
    "ots:ComputeSplitPointsBySize"
    ],
    "Resource": "*",
    "Effect": "Allow"
  }
  ]
}
```
4. In the Create Access Policy dialog box, set Name to AliyunODPSRolePolicy, and then click OK.
Grant permissions to the RAM role.
1. In the navigation pane on the left, choose Identity Management > Roles.
2. Find the AliyunODPSDefaultRole role and click Grant Permission in the Actions column.
3. In the Add Authorization panel, in the Access Policy area, select the AliyunODPSRolePolicy custom policy.
4. Click Confirm Grant.
5. Click Close.
Assume the AliyunODPSDefaultRole role. For more information, see Use a RAM role.

After you complete these steps, the target RAM user can use MaxCompute to access Tablestore.