Configuring Agencies

Role of an Agency

Cloud services interwork with each other, and some cloud services are dependent on other services. You can create an agency to delegate cloud services to access other services and perform resource O&M on your behalf.

Agency Classification

Agencies are classified into workspace-level agencies and job-level agencies.

• Workspace-level agencies can be globally applied to all jobs in the workspace.
• Job-level agencies can only be applied to a single job.

The job-level agency has a higher priority than the workspace-level agency. If neither of them is configured, execute the job as the user who starts the job.

Constraints

• To create or modify an agency, you must have the Security Administrator permissions.
• To configure a workspace-level agency, you must have the DAYU Administrator or Tenant Administrator policy.
• To configure a job-level agency, you must have the permission to view the list of agencies.

Creating an Agency

1. Log in to the IAM console.
2. Choose Agencies. On the displayed page, click Create Agency.
3. Enter an agency name, for example, DataArts Studio_agency.
4. Set Agency Type to Cloud service and select DataArts Studio for Cloud Service so that DataArts Studio can perform resource O&M operations on behalf of you.
5. Set Validity Period to Unlimited.
   Figure 1 Creating an agency
   
6. Click Assign Permissions in the Permissions area.
7. On the displayed page, search for the Tenant Administrator policy, select it, and click OK. See Figure 2.
   • Users assigned the Tenant Administrator policy have all permissions on all services except on IAMIAM. Therefore, delegate the Tenant Administrator policy to DataArts Studio so that DataArts Studio can access all related services.
   • If you want to meet the security control requirements for fewer permissions, you only need to configure the OBS OperateAccess permissions (During job execution, execution log information needs to be written to OBS. Therefore, you need to add the OBS OperateAccess permissions.) . Then, configure different agency permissions based on the node type in the job. For example, if a job contains only the Import GES node, you can configure the GES Administrator and OBS OperateAccess permissions. For details, see Permissions Assignment.
     Figure 2 Assigning permissions
     
8. Click OK.

Permissions Assignment

After the operation permissions of an account are delegated to DataArts Studio, you must configure the permissions of the agency identity so that DataArts Studio can interact with other services.

For purposes of permissions minimization, you can configure the Admin permissions for services based on the node types in jobs. For details, see Table 1.

The Admin permissions can also be configured based on the operations, resources, and request conditions for a specific service. Based on the node types in jobs, permissions are defined by service APIs to allow for more fine-grained, secure access control of cloud resources. Configure the permissions according to Table 2. For example, for a job containing the Import GES node, you only need to create a custom policy and select ges:graph:getDetail (viewing graph details), ges:jobs:getDetail (querying task status), and ges:graph:access (using graphs).

• MRS-related nodes (MRS Presto SQL, MRS Spark, MRS Spark Python, MRS Flink Job, and MRS MapReduce) and directly connected nodes (MRS Spark SQL and MRS Hive SQL) do not support job submission in agency mode, therefore, jobs of these types cannot be configured with agencies.
• MRS clusters that support job submission in agency mode are as follows:
  • Non-security cluster
  • Security cluster whose version is later than 2.1.0 and which has MRS 2.1.0.1 or later

• Configure the service-level Admin permissions.

  During job execution, execution log information needs to be written to OBS. Therefore, the OBS OperateAccess permissions must be added for all jobs during coarse-grained authorization.

• Configure fine-grained permissions. (Create custom policies based on the actions supported by each service.)

  For details on how to create a custom policy, see Creating a Custom Policy.

• During job execution, you must write execution logs to OBS. When the fine-grained authorization mode is used, the following OBS permissions need to be added for all types of jobs:
  • obs:bucket:GetBucketLocation
  • obs:object:GetObject
  • obs:bucket:CreateBucket
  • obs:object:PutObject
  • obs:bucket:ListAllMyBuckets
  • obs:bucket:ListBucket
• CDM Job nodes belong to the DataArts Studio module. DataArts Studio does not support fine-grained authorization. Therefore, only the DataArts Studio Administrator policy can be configured for jobs containing these types of nodes.
• CSS does not support fine-grained authorization and requires a proxy. Therefore, the DataArts Studio Administrator and Elasticsearch Administrator policies can be configured for jobs containing these nodes.
• SMN does not support fine-grained authorization. Therefore, jobs containing these nodes require the SMN Administrator permissions.

Configuring a Workspace-Level Agency

A workspace-level agency impacts on all jobs. Some jobs contain nodes related to MRS. Exercise caution when performing this operation.

1. Log in to the DataArts Studio console. Locate an instance and click Access. On the displayed page, locate a workspace and click DataArts Factory.
2. In the navigation pane, choose Configuration > Configure.
3. Click Agency. On the displayed page, configure an agency.
4. You can select an agency from the agency list or create a new one. For details on how to create an agency and configure permissions, see Creating an Agency.
   Figure 3 Configuring a workspace-level agency
   
5. Click OK to return to the Agency Configuration page. Then, click to save the settings.

Configuring a Job-level Agency

You can create a job-level agency when creating a job. You can also modify the agency of an existing job.

Configuring an agency when creating a job

1. Log in to the DataArts Studio console. Locate an instance and click Access. On the displayed page, locate a workspace and click DataArts Factory.
2. In the navigation pane of the DataArts Factory homepage, choose Development > Develop Job.
3. Right-click the job directory and choose Create Job from the shortcut menu. The Create Job dialog box is displayed. If a workspace-level agency has been configured, it is used for the job by default. You can also select another agency from the agency list.
   Figure 4 Configuring an agency for a job
   

   Modifying the agency of an existing job

1. In the navigation pane of the DataArts Factory homepage, choose Development > Develop Job.
2. In the job directory, double-click an existing job. On the far right of the displayed page, click Basic Info. The dialog box of the job's basic settings is displayed. If a workspace-level agency has been configured, it is used by default. You can also select another agency from the agency list.