使用资源组进行精细化资源控制

资源组授权的工作原理

您可以使用资源组（Resource Group）对阿里云账号内的资源进行分组管理。例如，为不同的项目创建对应的资源组，并将资源转移到对应的组中，以便集中管理各项目的资源。更多信息，请参见什么是资源组。

在完成资源分组后，您可以为不同的RAM授权主体（RAM用户、RAM用户组或RAM角色）授予指定资源组范围的权限，从而限定这个授权主体只能管理该资源组内的资源。更多信息，请参见资源分组和授权。

这种授权方式的优点有：

• 权限精细化：确保每个身份能获得最准确的资源访问权限，避免账号下的多个项目的资源混合管理。

• 良好的扩展性：后续新增资源时，只需将其加入该资源组，RAM身份便会自动获得新资源的相应权限，无需再次授权。

为RAM用户授予资源组级别的权限

下面以RAM用户为例，介绍授予指定资源组内大数据开发治理平台DataWorks资源权限的操作步骤。

支持资源组的资源类型

大数据开发治理平台DataWorks支持资源组的资源类型如下表所示：

不支持资源组级别授权的操作

大数据开发治理平台DataWorks中不支持资源组级别授权的操作（Action）如下：

对于不支持资源组授权的操作，授权时资源范围选择资源组级别将无效。如果仍需要RAM用户有上述操作权限，您需要创建自定义权限策略，授权时资源范围选择账号级别。

以下是两个自定义权限策略示例，您可以根据实际需要调整策略内容。

• 允许不支持资源组级别授权的全部只读操作：Action中列举不支持资源组级别授权的所有只读操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dataworks:ListAlarmResource",
          "dataworks:ListContacts",
          "dataworks:ListResourceGroup",
          "dataworks:ListUserResources",
          "dataworks:ShowResourceGroupDetail"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允许不支持资源组级别授权的全部操作：Action中列举不支持资源组级别授权的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dataworks:AddDpProjectSubUser",
          "dataworks:AddDpProjectUserRole",
          "dataworks:AddDpTenantSubUser",
          "dataworks:AddEntityIntoMetaCollection",
          "dataworks:AddRecognizeRule",
          "dataworks:AddTenantMemberToRole",
          "dataworks:BatchUpdateTasks",
          "dataworks:BindDpSubUserAk",
          "dataworks:BindDpUserAk",
          "dataworks:CheckAbTestFeatures",
          "dataworks:CheckCallback",
          "dataworks:CheckProjectIdentifier",
          "dataworks:CheckRamPermissions",
          "dataworks:CloneDataSource",
          "dataworks:CreateBusiness",
          "dataworks:CreateComponent",
          "dataworks:CreateComputeResource",
          "dataworks:CreateDIJob",
          "dataworks:CreateDataAssetTag",
          "dataworks:CreateDataQualityAlertRule",
          "dataworks:CreateDataQualityScan",
          "dataworks:CreateDataQualityScanRun",
          "dataworks:CreateDataQualityTemplate",
          "dataworks:CreateDataSource",
          "dataworks:CreateDataSourceSharedRule",
          "dataworks:CreateDataWorksPayAsYouGoService",
          "dataworks:CreateDataset",
          "dataworks:CreateDatasetVersion",
          "dataworks:CreateDpProject",
          "dataworks:CreateDpSubUser",
          "dataworks:CreateFile",
          "dataworks:CreateFolder",
          "dataworks:CreateIdentifyCredential",
          "dataworks:CreateLineageRelationship",
          "dataworks:CreateMetaCollection",
          "dataworks:CreateProjectRole",
          "dataworks:CreateResourceFile",
          "dataworks:CreateTenantRole",
          "dataworks:CreateUdfFile",
          "dataworks:CreateWorkflowInstances",
          "dataworks:DataWorksMember",
          "dataworks:DeleteBusiness",
          "dataworks:DeleteComponent",
          "dataworks:DeleteComputeResource",
          "dataworks:DeleteDataAssetTag",
          "dataworks:DeleteDataQualityAlertRule",
          "dataworks:DeleteDataQualityScan",
          "dataworks:DeleteDataQualityTemplate",
          "dataworks:DeleteDataSource",
          "dataworks:DeleteDataSourceSharedRule",
          "dataworks:DeleteDataset",
          "dataworks:DeleteDatasetVersion",
          "dataworks:DeleteDpProject",
          "dataworks:DeleteDpProjectSubUser",
          "dataworks:DeleteDpTenantSubUser",
          "dataworks:DeleteFile",
          "dataworks:DeleteFolder",
          "dataworks:DeleteLineageRelationship",
          "dataworks:DeleteMetaCollection",
          "dataworks:DeleteNetwork",
          "dataworks:DeleteProjectRole",
          "dataworks:DeleteRecognizeRule",
          "dataworks:DeleteTask",
          "dataworks:DeleteTenantRole",
          "dataworks:DeleteWorkflow",
          "dataworks:DeployFile",
          "dataworks:DsgDesensPlanAddOrUpdate",
          "dataworks:DsgDesensPlanDelete",
          "dataworks:DsgDesensPlanQueryList",
          "dataworks:DsgDesensPlanUpdateStatus",
          "dataworks:DsgPlatformQueryProjectsAndSchemaFromMeta",
          "dataworks:DsgQueryDesensStatusList",
          "dataworks:DsgQuerySensResult",
          "dataworks:DsgSceneAddOrUpdateScene",
          "dataworks:DsgSceneQuerySceneListByName",
          "dataworks:DsgScenedDeleteScene",
          "dataworks:DsgStopSensIdentify",
          "dataworks:DsgUpdateDesensStatusList",
          "dataworks:DsgUserGroupAddOrUpdate",
          "dataworks:DsgUserGroupDelete",
          "dataworks:DsgUserGroupGetOdpsRoleGroups",
          "dataworks:DsgUserGroupQueryList",
          "dataworks:DsgUserGroupQueryUserList",
          "dataworks:DsgWhiteListAddOrUpdate",
          "dataworks:DsgWhiteListDeleteList",
          "dataworks:DsgWhiteListQueryList",
          "dataworks:EditRecognizeRule",
          "dataworks:EstablishRelationTableToBusiness",
          "dataworks:ExecuteAdhocWorkflowInstance",
          "dataworks:GetBusiness",
          "dataworks:GetCatalog",
          "dataworks:GetCertificate",
          "dataworks:GetColumn",
          "dataworks:GetComponent",
          "dataworks:GetComputeResource",
          "dataworks:GetConfig",
          "dataworks:GetCreateWorkflowInstancesResult",
          "dataworks:GetDataQualityAlertRule",
          "dataworks:GetDataQualityScan",
          "dataworks:GetDataQualityScanRun",
          "dataworks:GetDataQualityScanRunLog",
          "dataworks:GetDataQualityTemplate",
          "dataworks:GetDataSource",
          "dataworks:GetDatabase",
          "dataworks:GetDataset",
          "dataworks:GetDatasetVersion",
          "dataworks:GetDeploymentPackage",
          "dataworks:GetDpProjectCreationInfo",
          "dataworks:GetFile",
          "dataworks:GetFileVersion",
          "dataworks:GetFolder",
          "dataworks:GetIDEEventDetail",
          "dataworks:GetJobStatus",
          "dataworks:GetLineageRelationship",
          "dataworks:GetMetaCollection",
          "dataworks:GetNetwork",
          "dataworks:GetPartition",
          "dataworks:GetRerunWorkflowInstancesResult",
          "dataworks:GetSchema",
          "dataworks:GetTable",
          "dataworks:GetTask",
          "dataworks:GetTaskInstance",
          "dataworks:GetTaskInstanceLog",
          "dataworks:GetTenantRole",
          "dataworks:GetUser",
          "dataworks:GetWorkflow",
          "dataworks:GetWorkflowInstance",
          "dataworks:ImportCertificate",
          "dataworks:ListAlarmResource",
          "dataworks:ListBusiness",
          "dataworks:ListCatalogs",
          "dataworks:ListColumns",
          "dataworks:ListComponents",
          "dataworks:ListComputeResources",
          "dataworks:ListContacts",
          "dataworks:ListCrawlerTypes",
          "dataworks:ListDataAssetTags",
          "dataworks:ListDataAssets",
          "dataworks:ListDataQualityAlertRules",
          "dataworks:ListDataQualityScanRuns",
          "dataworks:ListDataQualityScans",
          "dataworks:ListDataQualityTemplates",
          "dataworks:ListDataSourceSharedRules",
          "dataworks:ListDataSources",
          "dataworks:ListDataWorksPayAsYouGoServices",
          "dataworks:ListDatabases",
          "dataworks:ListDatasetVersions",
          "dataworks:ListDatasets",
          "dataworks:ListDeploymentPackages",
          "dataworks:ListDownstreamTaskInstances",
          "dataworks:ListDownstreamTasks",
          "dataworks:ListDpProject",
          "dataworks:ListDpProjectUser",
          "dataworks:ListDpTenantUser",
          "dataworks:ListEntitiesInMetaCollection",
          "dataworks:ListFileVersions",
          "dataworks:ListFiles",
          "dataworks:ListFolders",
          "dataworks:ListLineageRelationships",
          "dataworks:ListLineages",
          "dataworks:ListMeasureData",
          "dataworks:ListMeasuresGroupByModule",
          "dataworks:ListMetaCollections",
          "dataworks:ListPartitions",
          "dataworks:ListPermissions",
          "dataworks:ListProjectIds",
          "dataworks:ListProjectModules",
          "dataworks:ListProjectProcesses",
          "dataworks:ListRegions",
          "dataworks:ListResourceGroup",
          "dataworks:ListSchemas",
          "dataworks:ListTables",
          "dataworks:ListTaskInstanceOperationLogs",
          "dataworks:ListTaskInstances",
          "dataworks:ListTaskOperationLogs",
          "dataworks:ListTasks",
          "dataworks:ListTenantMembers",
          "dataworks:ListTenantRoles",
          "dataworks:ListUpstreamTaskInstances",
          "dataworks:ListUpstreamTasks",
          "dataworks:ListUserResources",
          "dataworks:ListWorkflowInstances",
          "dataworks:ListWorkflows",
          "dataworks:MetaListDpOuterResource",
          "dataworks:MetaListDpTable",
          "dataworks:ModifyContacts",
          "dataworks:ModifyResourceGroup",
          "dataworks:MoveComponent",
          "dataworks:OpenDataWorksStandardService",
          "dataworks:PreviewDatasetVersion",
          "dataworks:QueryDefaultTemplate",
          "dataworks:QueryDefaultTemplates",
          "dataworks:QueryRecognizeDataByRuleType",
          "dataworks:QueryRecognizeRuleDetail",
          "dataworks:QueryRecognizeRulesType",
          "dataworks:QuerySensClassification",
          "dataworks:QuerySensLevel",
          "dataworks:QuerySensNodeInfo",
          "dataworks:RemoveEntityFromMetaCollection",
          "dataworks:RemoveProjectMembers",
          "dataworks:RemoveTaskInstanceDependencies",
          "dataworks:RemoveTenantMemberFromRole",
          "dataworks:RerunTaskInstances",
          "dataworks:RerunWorkflowInstances",
          "dataworks:ResumeTaskInstances",
          "dataworks:RunIdentifyOpenapi",
          "dataworks:SetConfig",
          "dataworks:SetSuccessTaskInstances",
          "dataworks:ShowResourceGroupDetail",
          "dataworks:StartWorkflowInstances",
          "dataworks:StopTaskInstances",
          "dataworks:StopWorkflowInstances",
          "dataworks:SubmitFile",
          "dataworks:SuspendTaskInstances",
          "dataworks:SyncRAMContactInfo",
          "dataworks:TagDataAssets",
          "dataworks:TerminateDISyncInstance",
          "dataworks:TestDataSourceConnectivity",
          "dataworks:TriggerSchedulerTaskInstance",
          "dataworks:UnTagDataAssets",
          "dataworks:UpdateBusiness",
          "dataworks:UpdateColumnBusinessMetadata",
          "dataworks:UpdateComponent",
          "dataworks:UpdateComputeResource",
          "dataworks:UpdateContactInfo",
          "dataworks:UpdateDataAssetTag",
          "dataworks:UpdateDataQualityAlertRule",
          "dataworks:UpdateDataQualityEvaluationTask",
          "dataworks:UpdateDataQualityScan",
          "dataworks:UpdateDataQualityTemplate",
          "dataworks:UpdateDataSource",
          "dataworks:UpdateDataset",
          "dataworks:UpdateDatasetVersion",
          "dataworks:UpdateFile",
          "dataworks:UpdateFolder",
          "dataworks:UpdateIDEEventResult",
          "dataworks:UpdateMetaCollection",
          "dataworks:UpdateProjectRole",
          "dataworks:UpdateTableBusinessMetadata",
          "dataworks:UpdateTask",
          "dataworks:UpdateTaskInstances",
          "dataworks:UpdateTenantRole",
          "dataworks:UpdateUdfFile",
          "dataworks:UpdateWorkflow",
          "dataworks:createIdentifyCredential"
        ],
        "Resource": "*"
      }
    ]
  }
  

常见问题