数据治理中心 DATAARTS STUDIO-权限管理:DataArts Studio控制台功能依赖的角色或策略
下载数据治理中心 DATAARTS STUDIO用户手册完整版
DataArts Studio 控制台功能依赖的角色或策略
DataArts Studio服务各组件功能所需依赖服务的权限如表2所示。在实际授权场景中，推荐为开发者用户配置DataArts Studio服务级别的依赖服务最小权限（可参考如何最小化授权 IAM 用户使用DataArts Studio，为用户配置最小权限），开发者用户的最小依赖服务权限如表3所示。
在实际授权场景中，DAYU Administrator和DAYU User系统角色已经预置了依赖服务的管理员权限。为了避免普通用户/用户组被授予DAYU User系统角色导致其拥有的依赖服务权限过大的风险，您可以在为用户组授权DAYU User系统角色后，手动删除用户组的周边依赖权限，再为用户组授予所需依赖服务的最小权限合集。
控制台功能 |
依赖服务 |
需配置角色/策略 |
具体功能 |
|---|---|---|---|
管理中心 |
BSS |
bss:coupon:view bss:renewal:update bss:discount:view bss:order:view bss:order:pay bss:order:update |
创建增量包或DataArts Studio实例 |
KMS |
kms:cmk:get kms:cmk:list kms:cmk:create kms:cmk:decrypt kms:cmk:encrypt kms:dek:create kms:dek:encrypt kms:dek:decrypt |
创建数据连接时，使用KMS加解密 |
|
DWS |
dws:cluster:list dws:cluster:getDetail dws:openAPICluster:getDetail |
创建DWS数据连接 |
|
mrs:cluster:get mrs:cluster:list |
创建MRS数据连接 |
||
VPC |
vpc:publicIps:get vpc:publicIps:list vpc:vpcs:get vpc:subnets:get |
创建MRS数据连接 |
|
RDS |
rds:*:get rds:*:list |
创建RDS数据连接 |
|
数据集成 |
VPC |
vpc:publicIps:get vpc:publicIps:list vpc:vpcs:get vpc:vpcs:list vpc:subnets:get vpc:securityGroups:get vpc:firewalls:list vpc:routeTables:list vpc:subNetworkInterfaces:list |
创建 CDM 集群或DataArts Studio实例 |
E CS |
ecs:flavors:get ecs:cloudServerFlavors:get ecs:availabilityZones:list |
创建CDM集群或DataArts Studio实例 |
|
CDM |
cdm:cluster:create |
创建CDM集群 |
|
KMS |
kms:cmk:get kms:cmk:list kms:cmk:create kms:cmk:decrypt kms:cmk:encrypt kms:dek:create kms:dek:encrypt kms:dek:decrypt |
创建数据连接时，使用KMS加解密 |
|
MRS |
mrs:cluster:get mrs:cluster:list mrs:job:get mrs:job:list |
创建MRS数据连接 |
|
DWS |
dws:cluster:list dws:cluster:getDetail dws:openAPICluster:getDetail |
创建DWS数据连接 |
|
CDM |
cdm:cluster:get cdm:cluster:list cdm:link:operate cdm:job:operate |
通过CDM控制台操作时，需要CDM服务权限 |
|
ces:*:get ces:*:list |
查看CES监控 |
||
css:*:get css:*:list |
创建CSS连接 |
||
CloudTable |
cloudtable:*:get cloudtable:*:list |
创建CloudTable连接 |
|
RDS |
rds:*:get rds:*:list |
创建RDS连接 |
|
rms:resources:list |
创建CDM集群 |
||
数据开发 |
OBS |
obs:object:GetObject obs:object:PutObject obs:bucket:GetBucketLocation obs:bucket:ListAllMyBuckets obs:bucket:ListBucket obs:bucket:CreateBucket |
运行脚本、运行作业以及备份作业 |
smn:topic:publish smn:topic:list |
作业通知 |
||
KMS |
kms:cmk:get kms:cmk:list kms:cmk:create kms:cmk:decrypt kms:cmk:encrypt kms:dek:create kms:dek:encrypt kms:dek:decrypt |
创建数据连接时，使用KMS加解密 |
|
MRS |
mrs:cluster:get mrs:cluster:list mrs:job:submit mrs:job:delete mrs:job:stop mrs:sql:execute mrs:sql:cancel mrs:job:get mrs:job:list |
MRS类型作业节点运行： MRS Presto SQL、MRS Spark、MRS Spark Python、MRS Flink Job、 MRS MapReduce MRS Spark SQL、MRS Hive SQL |
|
dli:queue:submitJob dli:jobs:create dli:jobs:update dli:jobs:get dli:jobs:list dli:jobs:listAll |
DLI类型作业节点运行： DLI SQL、DLI Spark |
||
OBS |
obs:object:GetObject obs:object:PutObject obs:object:DeleteObject obs:bucket:GetBucketLocation obs:bucket:ListAllMyBuckets obs:bucket:ListBucket obs:bucket:ListBucketVersions obs:bucket:CreateBucket obs:bucket:DeleteBucket |
OBS类型作业节点运行： Create OBS、Delete OBS、OBS Manager |
|
DWS |
dws:cluster:list dws:cluster:getDetail dws:openAPICluster:getDetail |
创建DWS数据连接 |
|
CDM |
cdm:cluster:get cdm:cluster:list cdm:job:operate |
数据连接需要Agent的相关脚本、作业，以及CDM作业运行： RDS SQL、DWS SQL、Hive SQL、SPARK SQL、Shell、Python |
|
CES |
ces:metricData:list |
运维概览，查询DLI队列CPU |
|
GES |
ges:graph:access ges:graph:operate ges:graph:list ges:graph:getDetail ges:metadata:create ges:metadata:operate ges:metadata:delete ges:metadata:list ges:metadata:getDetail ges:jobs:list ges:jobs:getDetail |
Import GES作业节点运行 |
|
ECS |
ecs:servers:list ecs:servers:get ecs:servers:stop ecs:servers:start ecs:cloudServers:list |
Open/Close Resource作业节点运行，创建主机连接 |
|
DLI |
dli:queue:submitJob dli:queue:cancelJob dli:group:useGroup dli:group:getGroup dli:group:updateGroup dli:group:deleteGroup dli:group:listAllGroup dli:database:createDatabase dli:database:dropDatabase dli:database:displayDatabase dli:database:displayAllDatabases dli:database:explain dli:database:createView dli:database:createTable dli:database:displayAllTables dli:database:createFunction dli:database:describeFunction dli:database:showFunctions dli:database:dropFunction dli:table:select dli:table:update dli:table:delete dli:table:dropTable dli:table:describeTable dli:table:showCreateTable dli:table:showPartitions dli:table:showSegments dli:table:showTableProperties dli:table:insertOverwriteTable dli:table:insertIntoTable dli:table:compaction dli:table:truncateTable dli:table:alterView dli:table:alterTableRename dli:table:alterTableAddColumns dli:table:alterTableDropColumns dli:table:alterTableChangeColumn dli:table:alterTableSetLocation dli:table:alterTableAddPartition dli:table:alterTableRenamePartition dli:table:alterTableSetProperties dli:table:alterTableRecoverPartition dli:table:alterTableDropPartition dli:column:select dli:jobs:create dli:jobs:delete dli:jobs:start dli:jobs:stop dli:jobs:update dli:jobs:export dli:jobs:get dli:jobs:list dli:jobs:listAll dli:resource:useResource dli:resource:updateResource dli:resource:deleteResource dli:resource:getResource dli:resource:listAllResource dli:variable:update dli:variable:delete |
DLI类型作业/脚本运行 |
|
IAM |
iam:agencies:listAgencies |
获取作业委托 |
|
DIS |
DIS Operator DIS User |
DIS类型作业节点运行： DIS Stream、DIS Dump、DIS Client |
|
SWR |
SWR Admin |
仅当在数据开发组件作业中使用DLI Spark节点选择 自定义镜像 时，需要 容器镜像服务 中的镜像读取权限。 推荐通过镜像授权管理，添加所需镜像的读取权限。不推荐直接为用户授予SWR Admin系统角色， 可能存在权限过大的风险。 |
|
数据目录 |
OBS |
obs:object:GetObject obs:bucket:GetBucketStorage obs:bucket:GetBucketLocation obs:bucket:ListAllMyBuckets obs:bucket:ListBucket |
OBS元数据采集 |
DIS |
dis:streams:list dis:transferTasks:list |
DIS元数据采集 |
|
CSS |
css:cluster:list |
CSS元数据采集 |
|
GES |
ges:graph:list ges:graph:getDetail ges:metadata:list ges:metadata:getDetail |
GES元数据采集 |
|
DLI |
dli:database:displayDatabase dli:database:displayAllDatabases dli:table:select dli:table:describeTable dli:table:showPartitions dli:table:showTableProperties dli:jobs:create dli:jobs:get |
DLI元数据采集&数据概要分析 |
|
CDM |
cdm:cluster:list |
CSS元数据采集 |
|
数据质量 |
SMN |
smn:topic:publish smn:topic:list |
配置作业通知 |
OBS |
obs:object:GetObject obs:object:PutObject obs:bucket:GetBucketLocation obs:bucket:ListAllMyBuckets obs:bucket:ListBucket obs:bucket:CreateBucket |
导出质量报告 |
|
MRS |
mrs:job:submit mrs:sql:execute mrs:sql:cancel mrs:job:get |
MRS质量作业运行 |
|
DLI |
dli:queue:submitJob dli:jobs:get dli:jobs:listAll |
DLI质量作业运行 |
|
数据安全 |
DLI |
dli:queue:submitJob dli:queue:cancelJob dli:database:displayDatabase dli:database:displayAllDatabases dli:database:displayAllTables dli:table:describeTable dli:jobs:create dli:jobs:stop dli:jobs:get dli:resource:deleteResource dli:resource:getResource dli:resource:listAllResource |
DLI权限管控 |
DWS |
dws:cluster:list dws:cluster:getDetail dws:openAPICluster:getDetail |
DWS权限管控 |
|
MRS |
mrs:cluster:list mrs:job:submit mrs:job:stop |
MRS权限管控 |
|
KMS |
kms:cmk:list kms:cmk:encrypt kms:cmk:decrypt |
使用KMS加解密 |
|
CDM |
任意cdm权限，例如cdm:cluster:get |
DWS和MRS权限管控 |
权限类型 |
角色与策略权限-系统角色 |
角色与策略权限-自定义策略 |
角色与策略权限-自定义策略 |
|---|---|---|---|
是否必配 |
必配 |
必配 |
必配 |
权限 |
|
依赖的全局级（global级）云服务的自定义策略DataArtsStudio_PermissionsOfDependentServices_global：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:object:GetObject",
"obs:object:PutObject",
"obs:object:DeleteObject",
"obs:bucket:GetBucketStorage",
"obs:bucket:GetBucketLocation",
"obs:bucket:ListAllMyBuckets",
"obs:bucket:ListBucket",
"obs:bucket:ListBucketVersions",
"obs:bucket:CreateBucket",
"obs:bucket:DeleteBucket",
"rms:resources:list",
"iam:agencies:listAgencies"
]
}
]
}
|
依赖的项目级（region级）云服务的自定义策略DataArtsStudio_PermissionsOfDependentServices_region：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cdm:cluster:get",
"cdm:cluster:list",
"cdm:cluster:create",
"cdm:link:operate",
"cdm:job:operate",
"ces:*:get",
"ces:*:list",
"cloudtable:*:get",
"cloudtable:*:list",
"css:*:get",
"css:*:list",
"dis:streams:list",
"dis:transferTasks:list",
"dli:queue:submitJob",
"dli:queue:cancelJob",
"dli:table:insertOverwriteTable",
"dli:table:insertIntoTable",
"dli:table:alterView",
"dli:table:alterTableRename",
"dli:table:compaction",
"dli:table:truncateTable",
"dli:table:alterTableDropColumns",
"dli:table:alterTableSetProperties",
"dli:table:alterTableChangeColumn",
"dli:table:showSegments",
"dli:table:alterTableRecoverPartition",
"dli:table:dropTable",
"dli:table:update",
"dli:table:alterTableDropPartition",
"dli:table:alterTableAddPartition",
"dli:table:alterTableAddColumns",
"dli:table:alterTableRenamePartition",
"dli:table:delete",
"dli:table:alterTableSetLocation",
"dli:table:describeTable",
"dli:table:showPartitions",
"dli:table:showCreateTable",
"dli:table:showTableProperties",
"dli:table:select",
"dli:resource:updateResource",
"dli:resource:useResource",
"dli:resource:getResource",
"dli:resource:listAllResource",
"dli:resource:deleteResource",
"dli:database:explain",
"dli:database:createDatabase",
"dli:database:dropFunction",
"dli:database:createFunction",
"dli:database:displayAllDatabases",
"dli:database:displayAllTables",
"dli:database:displayDatabase",
"dli:database:describeFunction",
"dli:database:createView",
"dli:database:createTable",
"dli:database:showFunctions",
"dli:database:dropDatabase",
"dli:group:useGroup",
"dli:group:updateGroup",
"dli:group:listAllGroup",
"dli:group:getGroup",
"dli:group:deleteGroup",
"dli:column:select",
"dli:jobs:start",
"dli:jobs:export",
"dli:jobs:update",
"dli:jobs:list",
"dli:jobs:listAll",
"dli:jobs:get",
"dli:jobs:delete",
"dli:jobs:create",
"dli:jobs:stop",
"dli:variable:update",
"dli:variable:delete",
"dws:cluster:list",
"dws:cluster:getDetail",
"dws:openAPICluster:getDetail",
"ecs:servers:get",
"ecs:servers:list",
"ecs:servers:stop",
"ecs:servers:start",
"ecs:flavors:get",
"ecs:cloudServerFlavors:get",
"ecs:cloudServers:list",
"ecs:availabilityZones:list",
"ges:graph:access",
"ges:metadata:create",
"ges:jobs:list",
"ges:graph:operate",
"ges:jobs:getDetail",
"ges:graph:getDetail",
"ges:graph:list",
"ges:metadata:list",
"ges:metadata:getDetail",
"ges:metadata:delete",
"ges:metadata:operate",
"kms:cmk:get",
"kms:cmk:list",
"kms:cmk:create",
"kms:cmk:decrypt",
"kms:cmk:encrypt",
"kms:dek:create",
"kms:dek:encrypt",
"kms:dek:decrypt",
"mrs:cluster:get",
"mrs:cluster:list",
"mrs:job:get",
"mrs:job:list",
"mrs:job:submit",
"mrs:job:stop",
"mrs:job:delete",
"mrs:sql:execute",
"mrs:sql:cancel",
"rds:*:get",
"rds:*:list",
"smn:topic:publish",
"smn:topic:list",
"vpc:publicIps:list",
"vpc:publicIps:get",
"vpc:vpcs:get",
"vpc:vpcs:list",
"vpc:subnets:get",
"vpc:securityGroups:get",
"vpc:firewalls:list",
"vpc:routeTables:list",
"vpc:subNetworkInterfaces:list"
]
}
]
}
|
