Permission Management

After purchasing DLI resources, you can use IAM to assign different access rights to employees, ensuring proper isolation between roles. IAM provides identity authentication, permission assignment, and access control, helping you securely manage access to cloud resources.

With IAM, you can create users under your account and apply policies to define their access scope. For example, developers may need permission to use DLI but should not be allowed to delete it. In this case, you can create IAM users for developers and assign a policy that grants usage rights while restricting deletion.

If your account already meets your needs, you can skip creating separate IAM users without affecting other DLI functions.

IAM is a Huawei Cloud service offered free of charge. You only pay for the resources in your account. For more information about IAM, see IAM Service Overview.

DLI Permissions

By default, newly created IAM users have no permissions. To enable access, you must add them to a user group and assign roles or policies. This process is called authorization. Once authorized, users can perform operations within the scope of their assigned permissions.

DLI is deployed by physical region and operates as a project-level service. When authorizing, select Region-specific projects for Scope, then assign permissions within the specific project. These permissions apply only to that project. If you assign permissions to All projects, they apply across all regions. To access DLI, users must first switch to the authorized region.

Permission types: Permissions are categorized into roles and policies.

Roles: A coarse-grained authorization mechanism based on job responsibilities. This strategy offers limited service-level roles for authorization. Granting a role may require assigning additional dependency roles. Roles cannot fully meet fine-grained authorization or strict least-privilege access.
Policies: A fine-grained authorization mechanism that defines permissions at the level of specific operations, resources, and conditions. Policies provide flexible control and support enterprise-level least-privilege security. For example, you can restrict IAM users to perform only certain management operations on specific DLI resources. For the actions supported by DLI APIs, Permissions Policies and Supported Actions.

**Table 1** DLI system permissions
Role/Policy Name	Description	Category	Dependency
DLI FullAccess	Full permissions for DLI.	System-defined policy	This role depends on other roles in the same project. Creating a datasource connection: VPC ReadOnlyAccess Creating yearly/monthly resources: BSS Administrator Creating a tag: TMS FullAccess and EPS EPS FullAccess Using OBS for storage: OBS OperateAccess Creating an agency: Security Administrator
DLI ReadOnlyAccess	Read-only permissions for DLI. With read-only permissions, you can use DLI resources and perform operations that do not require fine-grained permissions. For example, create global variables, create packages and package groups, submit jobs to the default queue, create tables in the default database, create datasource connections, and delete datasource connections.	System-defined policy	None
Tenant Administrator	Tenant administrator Job execution permissions for DLI resources. After a database or a queue is created, the user can use the ACL to assign rights to other users. Scope: project-level service	System-defined role	None
DLI Service Administrator	DLI administrator. Job execution permissions for DLI resources. After a database or a queue is created, the user can use the ACL to assign rights to other users. Scope: project-level service	System-defined role	None

Table 2 lists the common operations supported by each system policy. You can use this table to select appropriate system policies.

For details about how to grant permissions using SQL syntax, see Data Permissions List.

**Table 2** Common operations supported by each system permission
Resource	Operation	Description	DLI FullAccess	DLI ReadOnlyAccess	Tenant Administrator	DLI Service Administrator
Queue	DROP_QUEUE	Deleting a Queue	√	×	√	√
	SUBMIT_JOB	Submitting a job	√	×	√	√
	CANCEL_JOB	Terminating a Job	√	×	√	√
	RESTART	Restarting a queue	√	×	√	√
	GRANT_PRIVILEGE	Granting permissions to a queue	√	×	√	√
	REVOKE_PRIVILEGE	Revoking permissions from a queue	√	×	√	√
	SHOW_PRIVILEGES	Viewing the queue permissions of other users	√	×	√	√
Data catalog	GET_CATALOG	Showing data catalog binding details	√	√	√	√
	LIST_CATALOG	Querying the data catalog binding list	√	√	√	√
	BIND_CATALOG	Binding a data catalog	√	×	√	√
	UNBIND_CATALOG	Unbinding a data catalog	√	×	√	√
Database	DROP_DATABASE	Deleting a database	√	×	√	√
	CREATE_TABLE	Creating a table	√	×	√	√
	CREATE_VIEW	Creating a view	√	×	√	√
	EXPLAIN	Explaining SQL statements as an execution plan	√	×	√	√
	CREATE_ROLE	Creating a role	√	×	√	√
	DROP_ROLE	Deleting a role	√	×	√	√
	SHOW_ROLES	Showing a role	√	×	√	√
	GRANT_ROLE	Binding a role	√	×	√	√
	REVOKE_ROLE	Unbinding a role	√	×	√	√
	SHOW_USERS	Showing the binding relationships between all roles and users	√	×	√	√
	GRANT_PRIVILEGE	Granting permissions to the database	√	×	√	√
	REVOKE_PRIVILEGE	Revoking permissions from the database	√	×	√	√
	SHOW_PRIVILEGES	Viewing database permissions of other users	√	×	√	√
	DISPLAY_ALL_TABLES	Showing tables in a database	√	√	√	√
	DISPLAY_DATABASE	Showing a database	√	√	√	√
	CREATE_FUNCTION	Creating a function	√	×	√	√
	DROP_FUNCTION	Deleting a function	√	×	√	√
	SHOW_FUNCTIONS	Showing all functions	√	×	√	√
	DESCRIBE_FUNCTION	Showing function details	√	×	√	√
Table	DROP_TABLE	Dropping a table	√	×	√	√
	SELECT	Querying tables	√	×	√	√
	INSERT_INTO_TABLE	Inserting table data	√	×	√	√
	ALTER_TABLE_ADD_COLUMNS	Adding a column	√	×	√	√
	INSERT_OVERWRITE_TABLE	Overwriting a table	√	×	√	√
	ALTER_TABLE_RENAME	Renaming a table	√	×	√	√
	ALTER_TABLE_ADD_PARTITION	Adding partitions to a partitioned table	√	×	√	√
	ALTER_TABLE_RENAME_PARTITION	Renaming a table partition	√	×	√	√
	ALTER_TABLE_DROP_PARTITION	Deleting partitions from a partitioned table	√	×	√	√
	SHOW_PARTITIONS	Showing all partitions	√	×	√	√
	ALTER_TABLE_RECOVER_PARTITION	Restoring table partitions	√	×	√	√
	ALTER_TABLE_SET_LOCATION	Setting the partition path	√	×	√	√
	GRANT_PRIVILEGE	Granting table permissions	√	×	√	√
	REVOKE_PRIVILEGE	Revoking table permissions	√	×	√	√
	SHOW_PRIVILEGES	Viewing table permissions of other users	√	×	√	√
	DISPLAY_TABLE	Showing a table	√	√	√	√
	DESCRIBE_TABLE	Showing table information	√	×	√	√
Enhanced datasource connection	BIND_QUEUE	Binding an enhanced datasource connection to a queue It is only used to grant permissions across projects.	×	×	×	×

If system policies do not meet your requirements, you can create custom policies and assign them to user groups for more precise access control. For details about how to create a custom policy, see Creating a Custom Policy.

Previous topic: Billing

Next topic: Notes and Constraints

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.

The system is busy. Please try again later.