授权信息

访问控制(RAM)是阿里云提供的管理用户身份与资源访问权限的服务。使用 RAM 可以让您避免与其他用户共享阿里云账号密钥,并可按需为用户授予最小权限。RAM 中使用权限策略描述授权的具体内容。

本文为您介绍 开源大数据平台 E-MapReduce 为 RAM 权限策略定义的操作(Action)、资源(Resource)和条件(Condition)。 开源大数据平台 E-MapReduce 的 RAM 代码(RamCode)为 emr ,支持的授权粒度为 资源级

权限策略通用结构

权限策略支持 JSON 格式,其通用结构如下:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}        

各字段含义如下:

  • Effect:权限策略效果。取值:Allow(允许)、Deny(拒绝)。

  • Action:授予允许或拒绝权限的具体操作。具体信息,请参见操作(Action)

  • Resource:受操作影响的具体对象,您可以使用资源 ARN 来描述指定资源。具体信息,请参见资源(Resource)

  • Condition:指授权生效的条件。可选字段。具体信息,请参见条件(Condition)

    • Condition_operator:条件运算符,不同类型的条件对应不同的条件运算符。具体信息,请参见权限策略基本元素

    • Condition_key:条件关键字。

    • Condition_value:条件关键字对应的值。

操作(Action)

下表是开源大数据平台 E-MapReduce定义的操作,这些操作可以在 RAM 权限策略语句的Action元素中使用,用来授予执行该操作的权限。下面对表中的具体项提供说明:

  • 操作:是指具体的权限点。

  • API:是指操作对应的 API 接口。

  • 访问级别:是指每个操作的访问级别,取值为写入(Write)、读取(Read)或列出(List)。

  • 资源类型:是指操作中支持授权的资源类型。具体说明如下:

    • 对于必选的资源类型,用前面加 * 表示。

    • 对于不支持资源级授权的操作,用全部资源表示。

  • 条件关键字:是指云产品自身定义的条件关键字。该列不体现适用于任何操作的通用条件关键字

  • 关联操作:是指成功执行操作所需要的其他权限。操作者必须同时具备关联操作的权限,操作才能成功。

操作

API

访问级别

资源类型

条件关键字

关联操作

emr:ListComponentUrls ListComponentUrls list

*全部资源

*

emr:GetDoctorComputeSummary GetDoctorComputeSummary get

*全部资源

*

emr:ListScalingGroups ListScalingGroups list

*全部资源

*

emr:GetDoctorHiveTable GetDoctorHiveTable get

*全部资源

*

emr:GetScalingGroup GetScalingGroup get

*全部资源

*

emr:IncreaseNodesDiskSize IncreaseNodesDiskSize update

*全部资源

*

emr:DeleteDiagnoseReport DeleteDiagnoseReport delete

*全部资源

*

emr:GetClusterMetastore GetClusterMetastore get

*Cluster

acs:emr:{#regionId}:{#accountId}:cluster/{#ClusterId}

emr:UpdateApiTemplate UpdateApiTemplate update

*全部资源

*

emr:GetOperationTask GetOperationTask get

*全部资源

*

emr:ListDoctorHiveDatabases ListDoctorHiveDatabases list

*全部资源

*

emr:DeleteUsers DeleteUsers delete

*Cluster

acs:emr:{#regionId}:{#accountId}:cluster/{#Clusterld}

emr:ListClusterCosts ListClusterCosts list

*全部资源

*

emr:ListDependApplications ListDependApplications list

*Cluster

acs:emr:{#regionId}:{#accountId}:cluster/{#ClusterId}

emr:CreateNodeGroup CreateNodeGroup create

*全部资源

*

emr:ListUpgradeConfigDifferences ListUpgradeConfigDifferences list

*全部资源

*

emr:JoinResourceGroup JoinResourceGroup update

*全部资源

*

emr:GetDoctorJob GetDoctorJob get

*全部资源

*

emr:UpgradeAppList UpgradeAppList get

*Cluster

acs:emr:{#regionId}:{#accountId}:cluster/{#ClusterId}

emr:DeleteNodeGroup DeleteNodeGroup delete

*全部资源

*

emr:ListKMSKeys ListKMSKeys list

*全部资源

*

emr:GetAutoScalingAnalyzeReport GetAutoScalingAnalyzeReport get

*全部资源

*

emr:TerminateOperation TerminateOperation update

*全部资源

*

emr:ListComponentEffectActions ListComponentEffectActions list

*全部资源

*

emr:ListScripts ListScripts list

*全部资源

*

emr:GetDoctorHiveCluster GetDoctorHiveCluster get

*全部资源

*

emr:CreateOnKubeCluster CreateOnKubeCluster create

*全部资源

*

emr:ListDoctorJobs ListDoctorJobs list

*全部资源

*

emr:UpdateApmConfigs UpdateApmConfigs update

*全部资源

*

emr:ListApplicationConfigHistory ListApplicationConfigHistory list

*全部资源

*

emr:ListResourceEvents ListResourceEvents list

*全部资源

*

emr:GetPriceForCreateOnKubeCluster GetPriceForCreateOnKubeCluster get

*全部资源

*

emr:SaveReport SaveReport create

*全部资源

*

emr:DecreaseNodes DecreaseNodes update

*全部资源

*

emr:GetClusterCloneMeta GetClusterCloneMeta get

*全部资源

*

emr:ListResourceHealth ListResourceHealth list

*全部资源

*

emr:CreateClusterPreCheck CreateClusterPreCheck create

*全部资源

*

emr:ListOnKubeJobs ListOnKubeJobs list

*全部资源

*

emr:CreateClusterCost CreateClusterCost get

*全部资源

*

emr:ListApplicationLinks ListApplicationLinks list

*全部资源

*

emr:CreateUsers CreateUsers create

*全部资源

*

emr:GetDoctorHBaseCluster GetDoctorHBaseCluster get

*全部资源

*

emr:QueryApmSnapshot QueryApmSnapshot list

*全部资源

*

emr:UpdateUserAttribute UpdateUserAttribute update

*全部资源

*

emr:ListDisasterRecoveryPlans ListDisasterRecoveryPlans list

*全部资源

*

emr:RunApiTemplate RunApiTemplate update

*全部资源

*

emr:ListComponents ListComponents list

*全部资源

*

emr:GetClusterUpgradeMeta GetClusterUpgradeMeta none

*全部资源

*

emr:ListScalingActivities ListScalingActivities list

*全部资源

*

emr:ListApiTemplates ListApiTemplates list

*全部资源

*

emr:UpgradeShowStatus UpgradeShowStatus get

*Cluster

acs:emr:{#regionId}:{#accountId}:cluster/{#ClusterId}

emr:RemoveManagedScalingPolicy RemoveManagedScalingPolicy delete

*Cluster

acs:emr:{#regionId}:{#accountId}:cluster/{#ClusterId}

emr:DeleteCluster DeleteCluster delete

*全部资源

*

emr:GetCostUploadSignature GetCostUploadSignature get

*全部资源

*

emr:GetConsoleOperation GetConsoleOperation get

*全部资源

*

emr:GetNodeGroup GetNodeGroup get

*全部资源

*

emr:EnableApplication EnableApplication update

*全部资源

*

emr:ListClusters ListClusters list

*全部资源

*

emr:GetDoctorHDFSDirectory GetDoctorHDFSDirectory get

*全部资源

*

emr:GetOnKubeCluster GetOnKubeCluster get

*全部资源

*

emr:ListApplicationActions ListApplicationActions list

*全部资源

*

emr:UpdateNodeGroupAttributes UpdateNodeGroupAttributes update

*全部资源

*

emr:GetDoctorHBaseRegionServer GetDoctorHBaseRegionServer get

*全部资源

*

emr:QueryGrafanaData QueryGrafanaData list

*全部资源

*

emr:RunApplicationAction RunApplicationAction update

*全部资源

*

emr:ListTagResources ListTagResources list

*全部资源

*

emr:RunCluster RunCluster create

*全部资源

*

emr:UpdateClusterAttribute UpdateClusterAttribute update

*全部资源

*

emr:ListApplicationConfigLabels ListApplicationConfigLabels list

*全部资源

*

emr:ListDoctorComputeSummary ListDoctorComputeSummary list

*全部资源

*

emr:ListDoctorHBaseTables ListDoctorHBaseTables list

*全部资源

*

emr:GetCluster GetCluster get

*全部资源

*

emr:GetDoctorHiveDatabase GetDoctorHiveDatabase get

*全部资源

*

emr:UpdateNodeGroupPaymentType UpdateNodeGroupPaymentType update

*全部资源

*

emr:IncreaseClusterDisk IncreaseClusterDisk update

*全部资源

*

emr:RetryOperationActivity RetryOperationActivity update

*全部资源

*

emr:ListApplicationConfigVersions ListApplicationConfigVersions list

*全部资源

*

emr:UpdateAckClusterNodePools UpdateAckClusterNodePools update

*全部资源

*

emr:ListNodeDisks ListNodeDisks list

*全部资源

*

emr:UpdateNodeMaintenanceStatus UpdateNodeMaintenanceStatus update

*全部资源

*

emr:GetAutoScalingPolicy GetAutoScalingPolicy get

*全部资源

*

emr:ListDiagnoseDagEvents ListDiagnoseDagEvents get

*全部资源

*

emr:CreateGateway CreateGateway create

*全部资源

*

emr:UpdateClusterCost UpdateClusterCost get

*全部资源

*

emr:ListMetastoreTypes ListMetastoreTypes list

*全部资源

*

emr:ListPrivateZones ListPrivateZones list

*全部资源

*

emr:GetScriptExecutionResult GetScriptExecutionResult get

*全部资源

*

emr:ListReports ListReports list

*全部资源

*

emr:ListInspectionHistory ListInspectionHistory list

*全部资源

*

emr:GetDoctorApplication GetDoctorApplication get

*全部资源

*

emr:DeleteApiTemplate DeleteApiTemplate delete

*全部资源

*

emr:EditInspectionConfig EditInspectionConfig update

*全部资源

*

emr:GetApiTemplate GetApiTemplate get

*全部资源

*

emr:CreateScript CreateScript create

*全部资源

*

emr:ListAlarmRules ListAlarmRules list

*全部资源

*

emr:BindPrivateZoneVpc BindPrivateZoneVpc update

*全部资源

*

emr:ListDoctorApplications ListDoctorApplications list

*全部资源

*

emr:ListNodes ListNodes list

*全部资源

*

emr:DisableScalingPolicy DisableScalingPolicy get

*全部资源

*

emr:ListDoctorReports ListDoctorReports list

*全部资源

*

emr:ListDoctorHBaseRegionServers ListDoctorHBaseRegionServers list

*全部资源

*

emr:GetDisasterRecoveryPlan GetDisasterRecoveryPlan get

*全部资源

*

emr:GetOperation GetOperation get

*全部资源

*

emr:GetSupportApplications GetSupportApplications get

*全部资源

*

emr:GetApplicationActions GetApplicationActions get

*全部资源

*

emr:ListUsers ListUsers list

*全部资源

*

emr:UpdateAckClusterNodes UpdateAckClusterNodes update

*全部资源

*

emr:ListOnKubeClusterInspectionResults ListOnKubeClusterInspectionResults list

*全部资源

*

emr:GetClusterSupportApplication GetClusterSupportApplication get

*全部资源

*

emr:GetApmData GetApmData get

*全部资源

*

emr:ListClusterExceptionInstances ListClusterExceptionInstances list

*全部资源

*

emr:ListDisasterRecoveryRecords ListDisasterRecoveryRecords list

*全部资源

*

emr:ListComponentInstances ListComponentInstances list

*全部资源

*

emr:ListOperations ListOperations list

*全部资源

*

emr:SyncClusterSubscriptionInfo SyncClusterSubscriptionInfo none

*全部资源

*

emr:ListNodeSubscriptions ListNodeSubscriptions list

*全部资源

*

emr:ListApplicationConfigs ListApplicationConfigs list

*全部资源

*

emr:ListNodeGroups ListNodeGroups list

*全部资源

*

emr:ListOperationTasks ListOperationTasks list

*全部资源

*

emr:ListMetricsToDisplay ListMetricsToDisplay list

*全部资源

*

emr:QueryApmComponents QueryApmComponents list

*全部资源

*

emr:UpgradeStep UpgradeStep get

*Cluster

acs:emr:{#regionId}:{#accountId}:cluster/{#ClusterId}

emr:StartClusterInplaceUpgrade StartClusterInplaceUpgrade get

*全部资源

*

emr:GetReportData GetReportData get

*全部资源

*

emr:UpdateClusterAutoRenew UpdateClusterAutoRenew update

*全部资源

*

emr:GetDoctorReportComponentSummary GetDoctorReportComponentSummary get

*全部资源

*

emr:GetDiagnoseQuota GetDiagnoseQuota get

*全部资源

*

emr:ListOperationActivities ListOperationActivities list

*全部资源

*

emr:CreateUser CreateUser create

*全部资源

*

emr:ListResourceEventTracksCount ListResourceEventTracksCount list

*全部资源

*

emr:ReleaseOnKubeCluster ReleaseOnKubeCluster delete

*全部资源

*

emr:ListRequiredApplications ListRequiredApplications list

*Cluster

acs:emr:{#regionId}:{#accountId}:cluster/{#ClusterId}

emr:PutManagedScalingPolicy PutManagedScalingPolicy get

*全部资源

*

emr:RemoveAutoScalingPolicy RemoveAutoScalingPolicy delete

*全部资源

*

emr:PutAutoScalingPolicy PutAutoScalingPolicy create

*全部资源

*

emr:GetApplicationConfigFile GetApplicationConfigFile get

*全部资源

*

emr:ListDoctorHDFSUGI ListDoctorHDFSUGI list

*全部资源

*

emr:CreateReport CreateReport create

*全部资源

*

emr:GetDiagnoseEventDetail GetDiagnoseEventDetail get

*全部资源

*

emr:GetDoctorHBaseTable GetDoctorHBaseTable get

*全部资源

*

emr:ListResourceEventTracks ListResourceEventTracks list

*全部资源

*

emr:ListOnKubeClusters ListOnKubeClusters list

*全部资源

*

emr:ListResourceHealthInspections ListResourceHealthInspections list

*全部资源

*

emr:UntagResources UntagResources update

*全部资源

*

emr:ListDiagnoseEvents ListDiagnoseEvents get

*全部资源

*

emr:GetClusterClientMeta GetClusterClientMeta get

*全部资源

*

emr:ListAutoScalingActivities ListAutoScalingActivities list

*全部资源

*

emr:GetAutoScalingActivity GetAutoScalingActivity get

*全部资源

*

emr:ListAssociatedClusters ListAssociatedClusters list

*全部资源

*

emr:ListApplicationConfigFiles ListApplicationConfigFiles list

*全部资源

*

emr:CancelOperationOrders CancelOperationOrders update

*Cluster

acs:emr:{#regionId}:{#accountId}:cluster/{#ClusterId}

emr:ListEvents ListEvents list

*Cluster

acs:emr:{#regionId}:{#accountId}:cluster/{#ClusterId}

emr:DeleteUser DeleteUser delete

*全部资源

*

emr:UpdateClusterPaymentType UpdateClusterPaymentType update

*全部资源

*

emr:UpdateClusterMetaCollect UpdateClusterMetaCollect update

*全部资源

*

emr:ListSupportGatewayClusters ListSupportGatewayClusters list

*全部资源

*

emr:GetApplication GetApplication get

*全部资源

*

emr:GetReport GetReport get

*全部资源

*

emr:DisableResourceEvents DisableResourceEvents update

*全部资源

*

emr:ListResourceEventsCount ListResourceEventsCount list

*全部资源

*

emr:GetManagedScalingPolicy GetManagedScalingPolicy get

*全部资源

*

emr:IncreaseNodes IncreaseNodes update

*全部资源

*

emr:ListInspectionConfigs ListInspectionConfigs list

*全部资源

*

emr:ListDiagnoseReports ListDiagnoseReports list

*全部资源

*

emr:AddApplications AddApplications update

*全部资源

*

emr:CheckDLFCatalogAuth CheckDLFCatalogAuth get

*全部资源

*

emr:ListScalingMetrics ListScalingMetrics list

*全部资源

*

emr:GetDoctorHDFSCluster GetDoctorHDFSCluster get

*全部资源

*

emr:GetClusterMetaCollect GetClusterMetaCollect get

*全部资源

*

emr:ListDoctorHDFSDirectories ListDoctorHDFSDirectories list

*全部资源

*

emr:UpdateApplicationConfigs UpdateApplicationConfigs update

*全部资源

*

emr:GetDoctorHBaseRegion GetDoctorHBaseRegion get

*全部资源

*

emr:GetOnKubeClusterResourceQuota GetOnKubeClusterResourceQuota get

*全部资源

*

emr:QueryApmGrafanaData QueryApmGrafanaData list

*全部资源

*

emr:UpdateScalingGroup UpdateScalingGroup update

*全部资源

*

emr:DeleteApplication DeleteApplication delete

*全部资源

*

emr:CreateDiagnoseReport CreateDiagnoseReport create

*全部资源

*

emr:DeleteScript DeleteScript delete

*全部资源

*

emr:UploadCostBucket UploadCostBucket get

*全部资源

*

emr:ListDoctorHiveTables ListDoctorHiveTables list

*全部资源

*

emr:ListComponentDefaultTopologies ListComponentDefaultTopologies list

*全部资源

*

emr:ListDoctorJobsStats ListDoctorJobsStats list

*全部资源

*

emr:UpdateScript UpdateScript update

*全部资源

*

emr:ExportApplicationConfigs ExportApplicationConfigs list

*全部资源

*

emr:UpdateClusterSpec UpdateClusterSpec update

*全部资源

*

emr:SyncNodes SyncNodes update

*全部资源

*

emr:GetOnKubeClusterResourceUsage GetOnKubeClusterResourceUsage get

*全部资源

*

emr:RunScalingAction RunScalingAction update

*全部资源

*

emr:RenewCluster RenewCluster update

*全部资源

*

emr:ListRecommendApplicationConfigs ListRecommendApplicationConfigs list

*全部资源

*

emr:TagResources TagResources update

*全部资源

*

emr:CreateApiTemplate CreateApiTemplate create

*全部资源

*

emr:ListApplications ListApplications list

*全部资源

*

emr:CreateDiagnoseFeedback CreateDiagnoseFeedback none

*全部资源

*

emr:RetryOperation RetryOperation update

*全部资源

*

emr:GetClusterCost GetClusterCost get

*全部资源

*

emr:CreateScalingGroup CreateScalingGroup create

*全部资源

*

emr:CreateCluster CreateCluster create

*全部资源

*

emr:DeleteScalingGroup DeleteScalingGroup delete

*全部资源

*

emr:ListOnKubeComponents ListOnKubeComponents list

*全部资源

*

资源(Resource)

下表是开源大数据平台 E-MapReduce定义的资源,这些资源可以在 RAM 权限策略语句的Resource元素中使用,用来授予对该资源执行具体操作的权限。 其中,资源 ARN 是资源在阿里云上的唯一标识。具体说明如下:

  • {#}为变量标识,需要您替换为实际值。例如:{#ramcode}需要您替换为实际的云服务RAM代码。

  • *表示全部。例如:

    • {#resourceType}*时:表示全部资源。

    • {#regionId}*时:表示全部地域。

    • {#accountId}*时:表示全部阿里云账号。

资源类型

资源 ARN

Cluster
  • acs:emr:{#regionId}:{#accountId}:Cluster/*
  • acs:emr:{#regionId}:{#accountId}:cluster/{#ClusterId}
  • acs:emr:{#regionId}:{#accountId}:cluster/{#Clusterld}

条件(Condition)

开源大数据平台 E-MapReduce未定义产品级别的条件关键字。如需查看适用于所有云产品的通用条件关键字,请参见通用条件关键字

相关操作

您可以创建自定义权限策略,并将权限策略授予 RAM 用户、RAM 用户组或 RAM 角色。具体操作如下: