Compute
Elastic Cloud Server
Huawei Cloud Flexus
Bare Metal Server
Auto Scaling
Image Management Service
Dedicated Host
FunctionGraph
Cloud Phone Host
Huawei Cloud EulerOS
Networking
Virtual Private Cloud
Elastic IP
Elastic Load Balance
NAT Gateway
Direct Connect
Virtual Private Network
VPC Endpoint
Cloud Connect
Enterprise Router
Enterprise Switch
Global Accelerator
Management & Governance
Cloud Eye
Identity and Access Management
Cloud Trace Service
Resource Formation Service
Tag Management Service
Log Tank Service
Config
OneAccess
Resource Access Manager
Simple Message Notification
Application Performance Management
Application Operations Management
Organizations
Optimization Advisor
IAM Identity Center
Cloud Operations Center
Resource Governance Center
Migration
Server Migration Service
Object Storage Migration Service
Cloud Data Migration
Migration Center
Cloud Ecosystem
KooGallery
Partner Center
User Support
My Account
Billing Center
Cost Center
Resource Center
Enterprise Management
Service Tickets
HUAWEI CLOUD (International) FAQs
ICP Filing
Support Plans
My Credentials
Customer Operation Capabilities
Partner Support Plans
Professional Services
Analytics
MapReduce Service
Data Lake Insight
CloudTable Service
Cloud Search Service
Data Lake Visualization
Data Ingestion Service
GaussDB(DWS)
DataArts Studio
Data Lake Factory
DataArts Lake Formation
IoT
IoT Device Access
Others
Product Pricing Details
System Permissions
Console Quick Start
Common FAQs
Instructions for Associating with a HUAWEI CLOUD Partner
Message Center
Security & Compliance
Security Technologies and Applications
Web Application Firewall
Host Security Service
Cloud Firewall
SecMaster
Anti-DDoS Service
Data Encryption Workshop
Database Security Service
Cloud Bastion Host
Data Security Center
Cloud Certificate Manager
Edge Security
Situation Awareness
Managed Threat Detection
Blockchain
Blockchain Service
Web3 Node Engine Service
Media Services
Media Processing Center
Video On Demand
Live
SparkRTC
MetaStudio
Storage
Object Storage Service
Elastic Volume Service
Cloud Backup and Recovery
Storage Disaster Recovery Service
Scalable File Service Turbo
Scalable File Service
Volume Backup Service
Cloud Server Backup Service
Data Express Service
Dedicated Distributed Storage Service
Containers
Cloud Container Engine
SoftWare Repository for Container
Application Service Mesh
Ubiquitous Cloud Native Service
Cloud Container Instance
Databases
Relational Database Service
Document Database Service
Data Admin Service
Data Replication Service
GeminiDB
GaussDB
Distributed Database Middleware
Database and Application Migration UGO
TaurusDB
Middleware
Distributed Cache Service
API Gateway
Distributed Message Service for Kafka
Distributed Message Service for RabbitMQ
Distributed Message Service for RocketMQ
Cloud Service Engine
Multi-Site High Availability Service
EventGrid
Dedicated Cloud
Dedicated Computing Cluster
Business Applications
Workspace
ROMA Connect
Message & SMS
Domain Name Service
Edge Data Center Management
Meeting
AI
Face Recognition Service
Graph Engine Service
Content Moderation
Image Recognition
Optical Character Recognition
ModelArts
ImageSearch
Conversational Bot Service
Speech Interaction Service
Huawei HiLens
Video Intelligent Analysis Service
Developer Tools
SDK Developer Guide
API Request Signing Guide
Terraform
Koo Command Line Interface
Content Delivery & Edge Computing
Content Delivery Network
Intelligent EdgeFabric
CloudPond
Intelligent EdgeCloud
Solutions
SAP Cloud
High Performance Computing
Developer Services
ServiceStage
CodeArts
CodeArts PerfTest
CodeArts Req
CodeArts Pipeline
CodeArts Build
CodeArts Deploy
CodeArts Artifact
CodeArts TestPlan
CodeArts Check
CodeArts Repo
Cloud Application Engine
MacroVerse aPaaS
KooMessage
KooPhone
KooDrive
Help Center/ DataArts Studio/ Service Overview/ Permission Management

Permission Management

Updated on 2024-11-05 GMT+08:00

If you need to assign different permissions to employees in your enterprise to access your DataArts Studio resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your Huawei Cloud resources.

With IAM, you can use your Huawei Cloud account to create IAM users for your employees, and assign permissions to the users to control their access to specific resource types. For example, if you want to allow some software developers in your enterprise to use DataArts Studio resources but disallow them to delete workspaces or perform any high-risk operations, you can create IAM users for the software developers and grant them only the permissions required for using DataArts Studio resources.

IAM is a free service. You only pay for the resources in your account. For more information about IAM, see IAM Service Overview.

DataArts Studio Permissions

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and then attach policies or roles to these groups. After authorization, the users can perform specified operations.

DataArts Studio is a project-level service deployed in specific physical regions. To assign permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing DataArts Studio, users need to switch to a region where they are authorized to use cloud services.

DataArts Studio supports only system role-based authorization and does not support policy-based authorization. To implement fine-grained permission control, DataArts Studio provides the capability of granting permissions to system roles and workspace roles. Specific operation permissions are granted to workspace roles, and workspace roles with different permissions can be customized.

NOTE:
IAM provides the following two authorization mechanisms: Note that DataArts Studio supports only the IAM role-based authorization and does not support the IAM policy-based authorization.
  • IAM Roles: IAM initially provides a coarse-grained authorization mechanism to define permissions based on users' job responsibilities. Only a limited number of service-level roles are available. However, traditional IAM roles are not an ideal choice for fine-grained authorization and secure access control.
  • IAM Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for least privilege access.
As shown in Figure 1 and Table 1, the system-defined roles supported by DataArts Studio include DAYU Administrator and DAYU User. Workspace roles are based on the DAYU User. Permissions lists the common operations supported by DataArts Studio and the permissions granted to each role. You can select roles as required.
Figure 1 Permission system
Table 1 DataArts Studio system-defined roles

Role

Description

Type

DAYU Administrator

Instance administrator who has all management permissions on a DataArts Studio instance and its workspaces, permissions of dependent services, and service operation permissions in all workspaces.

NOTE:

Users assigned the Tenant Administrator role have all permissions for all services except IAM. In other words, users with the Tenant Administrator role can perform all operations in DataArts Studio.

System-defined role

DAYU User

Common user who has permissions to view a DataArts Studio instance and its workspaces, and the permissions of dependent services. After assigned a role, a common user has permissions of the role to perform service operations.

Workspace roles include the preset admin, developer, deployer, operator, and viewer. For details about the operation permissions of each role, see Permissions.
  • Admin: This role has all operation permissions in a workspace. You are advised to assign the admin role to the project owner, development owner, and O&M administrator.
  • Developer: This role has permissions to create and manage resources in a workspace. You are advised to assign this role to users who develop and process tasks.
  • Operator: This role has the operation permissions of services such as O&M and scheduling in a workspace, but cannot modify resources or configurations. You are advised to assign this role to users responsible for O&M management and status monitoring.
  • Viewer: This role can view data in a workspace but cannot perform any other operation. You are advised to assign this role to users who only need to view data in a workspace but do not need to perform operations.
  • Deployer: This role is unique to the enterprise mode and has permissions to release task packages in a workspace. In enterprise mode, when a developer submits a script or job version, the system generates a release task. After the developer confirms the release and the deployer approves the release request, the modified job is synchronized to the production environment.

System-defined role

Roles or Policies for DataArts Studio Console

Table 2 lists the permissions for the services on which DataArts Studio components depend. You are advised to configure the minimum DataArts Studio-level permissions of dependent services for developers. (For details, see Authorizing IAM Users to Use DataArts Studio by Complying with the Principle of Least Privilege.) Table 3 lists the minimum permissions for developers on the services on which DataArts Studio depends.

NOTE:

The DAYU Administrator and DAYU User already have the administrator permissions of dependent services. If the DAYU User role is assigned to a common user or user group, the common user or user group may have more permissions of dependent services than required. To prevent this risk, you can manually delete the permissions of dependent services from the user group after assigning the DAYU User role to the user group, and then assign the minimum permissions of dependent services to the user group.

Table 2 Roles or policies for the services on which the DataArts Studio console depends on

Console Function

Dependent Service

Role/Policy Required

Function

Management Center

BSS

bss:coupon:view

bss:renewal:update

bss:discount:view

bss:order:view

bss:order:pay

bss:order:update

Create incremental packages or DataArts Studio instances.

KMS

kms:cmk:get

kms:cmk:list

kms:cmk:create

kms:cmk:decrypt

kms:cmk:encrypt

kms:dek:create

kms:dek:encrypt

kms:dek:decrypt

Encrypt and decrypt data during data connection creation.

DWS

dws:cluster:list

dws:cluster:getDetail

dws:openAPICluster:getDetail

Create DWS connections.

MRS

mrs:cluster:get

mrs:cluster:list

Create MRS connections.

VPC

vpc:publicIps:get

vpc:publicIps:list

vpc:vpcs:get

vpc:subnets:get

Create MRS connections.

RDS

rds:*:get

rds:*:list

Create RDS connections.

DataArts Migration

VPC

vpc:publicIps:get

vpc:publicIps:list

vpc:vpcs:get

vpc:vpcs:list

vpc:subnets:get

vpc:securityGroups:get

vpc:firewalls:list

vpc:routeTables:list

vpc:subNetworkInterfaces:list

Create CDM clusters or DataArts Studio instances.

ECS

ecs:flavors:get

ecs:cloudServerFlavors:get

ecs:availabilityZones:list

Create CDM clusters or DataArts Studio instances.

CDM

cdm:cluster:create

Create CDM clusters.

KMS

kms:cmk:get

kms:cmk:list

kms:cmk:create

kms:cmk:decrypt

kms:cmk:encrypt

kms:dek:create

kms:dek:encrypt

kms:dek:decrypt

Encrypt and decrypt data during data connection creation.

MRS

mrs:cluster:get

mrs:cluster:list

mrs:job:get

mrs:job:list

Create MRS connections.

DWS

dws:cluster:list

dws:cluster:getDetail

dws:openAPICluster:getDetail

Create DWS connections.

CDM

cdm:cluster:get

cdm:cluster:list

cdm:link:operate

cdm:job:operate

Perform operations on the CDM console.

CES

ces:*:get

ces:*:list

View monitoring data in Cloud Eye.

CSS

css:*:get

css:*:list

Create CSS connections.

CloudTable

cloudtable:*:get

cloudtable:*:list

Create CloudTable connections.

RDS

rds:*:get

rds:*:list

Create RDS connections.

Config

rms:resources:list

Create CDM clusters.

DataArts Factory

OBS

obs:object:GetObject

obs:object:PutObject

obs:bucket:GetBucketLocation

obs:bucket:ListAllMyBuckets

obs:bucket:ListBucket

obs:bucket:CreateBucket

Run scripts, run jobs, and back up jobs.

SMN

smn:topic:publish

smn:topic:list

Send job notifications.

KMS

kms:cmk:get

kms:cmk:list

kms:cmk:create

kms:cmk:decrypt

kms:cmk:encrypt

kms:dek:create

kms:dek:encrypt

kms:dek:decrypt

Encrypt and decrypt data during data connection creation.

MRS

mrs:cluster:get

mrs:cluster:list

mrs:job:submit

mrs:job:delete

mrs:job:stop

mrs:sql:execute

mrs:sql:cancel

mrs:job:get

mrs:job:list

Run the following MRS job nodes:

MRS Presto SQL, MRS Spark, MRS Spark Python, MRS Flink Job, and MRS MapReduce

MRS Spark SQL and MRS Hive SQL

DLI

dli:queue:submitJob

dli:jobs:create

dli:jobs:update

dli:jobs:get

dli:jobs:list

dli:jobs:listAll

Run the following DLI job nodes:

DLI SQL and DLI Spark

OBS

obs:object:GetObject

obs:object:PutObject

obs:object:DeleteObject

obs:bucket:GetBucketLocation

obs:bucket:ListAllMyBuckets

obs:bucket:ListBucket

obs:bucket:ListBucketVersions

obs:bucket:CreateBucket

obs:bucket:DeleteBucket

Run the following OBS job nodes:

Create OBS, Delete OBS, and OBS Manager

DWS

dws:cluster:list

dws:cluster:getDetail

dws:openAPICluster:getDetail

Create DWS connections.

CDM

cdm:cluster:get

cdm:cluster:list

cdm:job:operate

Run the Agent-related scripts and jobs required by data connections and run CDM jobs:

RDS SQL, DWS SQL, Hive SQL, SPARK SQL, Shell, and Python

CES

ces:metricData:list

Query the CPU usage of the DLI queue on the Overview page.

GES

ges:graph:access

ges:graph:operate

ges:graph:list

ges:graph:getDetail

ges:metadata:create

ges:metadata:operate

ges:metadata:delete

ges:metadata:list

ges:metadata:getDetail

ges:jobs:list

ges:jobs:getDetail

Run the Import GES job node.

ECS

ecs:servers:list

ecs:servers:get

ecs:servers:stop

ecs:servers:start

ecs:cloudServers:list

Run the Open/Close Resource job node and create host connections.

DLI

dli:queue:submitJob

dli:queue:cancelJob

dli:group:useGroup

dli:group:getGroup

dli:group:updateGroup

dli:group:deleteGroup

dli:group:listAllGroup

dli:database:createDatabase

dli:database:dropDatabase

dli:database:displayDatabase

dli:database:displayAllDatabases

dli:database:explain

dli:database:createView

dli:database:createTable

dli:database:displayAllTables

dli:database:createFunction

dli:database:describeFunction

dli:database:showFunctions

dli:database:dropFunction

dli:table:select

dli:table:update

dli:table:delete

dli:table:dropTable

dli:table:describeTable

dli:table:showCreateTable

dli:table:showPartitions

dli:table:showSegments

dli:table:showTableProperties

dli:table:insertOverwriteTable

dli:table:insertIntoTable

dli:table:compaction

dli:table:truncateTable

dli:table:alterView

dli:table:alterTableRename

dli:table:alterTableAddColumns

dli:table:alterTableDropColumns

dli:table:alterTableChangeColumn

dli:table:alterTableSetLocation

dli:table:alterTableAddPartition

dli:table:alterTableRenamePartition

dli:table:alterTableSetProperties

dli:table:alterTableRecoverPartition

dli:table:alterTableDropPartition

dli:column:select

dli:jobs:create

dli:jobs:delete

dli:jobs:start

dli:jobs:stop

dli:jobs:update

dli:jobs:export

dli:jobs:get

dli:jobs:list

dli:jobs:listAll

dli:resource:useResource

dli:resource:updateResource

dli:resource:deleteResource

dli:resource:getResource

dli:resource:listAllResource

dli:variable:update

dli:variable:delete

Run DLI jobs/scripts.

IAM

iam:agencies:listAgencies

Obtain job agencies.

DIS

DIS Operator

DIS User

Run the following DIS job nodes:

DIS Stream, DIS Dump, and DIS Client

SWR

SWR Admin

The image read permission in SWR is required only when a custom image is selected for a DLI Spark node of a job in DataArts Factory.

You are advised to add the read permission of the image by referring to User Permissions. You are not advised to directly assign the SWR Admin system role to users because this may result in excessive permissions.

DataArts Catalog

OBS

obs:object:GetObject

obs:bucket:GetBucketStorage

obs:bucket:GetBucketLocation

obs:bucket:ListAllMyBuckets

obs:bucket:ListBucket

Collect OBS metadata.

DIS

dis:streams:list

dis:transferTasks:list

Collect DIS metadata.

CSS

css:cluster:list

Collect CSS metadata.

GES

ges:graph:list

ges:graph:getDetail

ges:metadata:list

ges:metadata:getDetail

Collect GES metadata.

DLI

dli:database:displayDatabase

dli:database:displayAllDatabases

dli:table:select

dli:table:describeTable

dli:table:showPartitions

dli:table:showTableProperties

dli:jobs:create

dli:jobs:get

Collect DLI metadata and analyze data in summary.

CDM

cdm:cluster:list

Collect CSS metadata.

DataArts Quality

SMN

smn:topic:publish

smn:topic:list

Configure job notifications.

OBS

obs:object:GetObject

obs:object:PutObject

obs:bucket:GetBucketLocation

obs:bucket:ListAllMyBuckets

obs:bucket:ListBucket

obs:bucket:CreateBucket

Export quality reports.

MRS

mrs:job:submit

mrs:sql:execute

mrs:sql:cancel

mrs:job:get

Run MRS quality jobs.

DLI

dli:queue:submitJob

dli:jobs:get

dli:jobs:listAll

Run DLI quality jobs.

DataArts Security

DLI

dli:queue:submitJob

dli:queue:cancelJob

dli:database:displayDatabase

dli:database:displayAllDatabases

dli:database:displayAllTables

dli:table:describeTable

dli:jobs:create

dli:jobs:stop

dli:jobs:get

dli:resource:deleteResource

dli:resource:getResource

dli:resource:listAllResource

Manage DLI permissions.

DWS

dws:cluster:list

dws:cluster:getDetail

dws:openAPICluster:getDetail

Manage DWS permissions.

MRS

mrs:cluster:list

mrs:job:submit

mrs:job:stop

Manage MRS permissions.

KMS

kms:cmk:list

kms:cmk:encrypt

kms:cmk:decrypt

Encrypt and decrypt data using KMS.

CDM

Any CDM permission, for example, cdm:cluster:get

Manage DWS and MRS permissions.

Table 3 Minimum permissions for developers on the services on which DataArts Studio depends

Permission Type

Role/Policy-based permissions–system role

Role/Policy-based permissions–custom policy

Role/Policy-based permissions–custom policy

Mandatory

Mandatory

Mandatory

Mandatory

Permission

  • DIS Operator
  • DIS User
  • (Optional and not recommended) SWR Admin
    NOTE:

    The image read permission in SWR is required only when a custom image is selected for a DLI Spark node of a job in DataArts Factory.

    You are advised to add the read permission of the image by referring to User Permissions. You are not advised to directly assign the SWR Admin system role to users because this may result in excessive permissions.

DataArtsStudio_PermissionsOfDependentServices_global: custom policy for a global dependent cloud service
{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "obs:object:GetObject",
                "obs:object:PutObject",
                "obs:object:DeleteObject",
                "obs:bucket:GetBucketStorage",
                "obs:bucket:GetBucketLocation",
                "obs:bucket:ListAllMyBuckets",
                "obs:bucket:ListBucket",
                "obs:bucket:ListBucketVersions",
                "obs:bucket:CreateBucket",
                "obs:bucket:DeleteBucket",
                "rms:resources:list",
                "iam:agencies:listAgencies"
            ]
        }
    ]
}
DataArtsStudio_PermissionsOfDependentServices_region: custom policy for a regional dependent cloud service
{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cdm:cluster:get",
                "cdm:cluster:list",
                "cdm:cluster:create",
                "cdm:link:operate",
                "cdm:job:operate",
                "ces:*:get",
                "ces:*:list",
                "cloudtable:*:get",
                "cloudtable:*:list",
		"css:*:get",
                "css:*:list",
                "dis:streams:list",
                "dis:transferTasks:list",
                "dli:queue:submitJob",
                "dli:queue:cancelJob",
                "dli:table:insertOverwriteTable",
                "dli:table:insertIntoTable",
                "dli:table:alterView",
                "dli:table:alterTableRename",
                "dli:table:compaction",
                "dli:table:truncateTable",
                "dli:table:alterTableDropColumns",
                "dli:table:alterTableSetProperties",
                "dli:table:alterTableChangeColumn",
                "dli:table:showSegments",
                "dli:table:alterTableRecoverPartition",
                "dli:table:dropTable",
                "dli:table:update",
                "dli:table:alterTableDropPartition",
                "dli:table:alterTableAddPartition",
                "dli:table:alterTableAddColumns",
                "dli:table:alterTableRenamePartition",
                "dli:table:delete",
                "dli:table:alterTableSetLocation",
                "dli:table:describeTable",
                "dli:table:showPartitions",
                "dli:table:showCreateTable",
                "dli:table:showTableProperties",
                "dli:table:select",
                "dli:resource:updateResource",
                "dli:resource:useResource",
                "dli:resource:getResource",
                "dli:resource:listAllResource",
                "dli:resource:deleteResource",
                "dli:database:explain",
                "dli:database:createDatabase",
                "dli:database:dropFunction",
                "dli:database:createFunction",
                "dli:database:displayAllDatabases",
		"dli:database:displayAllTables",
                "dli:database:displayDatabase",
                "dli:database:describeFunction",
                "dli:database:createView",
                "dli:database:createTable",
                "dli:database:showFunctions",
                "dli:database:dropDatabase",
                "dli:group:useGroup",
                "dli:group:updateGroup",
                "dli:group:listAllGroup",
                "dli:group:getGroup",
                "dli:group:deleteGroup",
                "dli:column:select",
                "dli:jobs:start",
                "dli:jobs:export",
                "dli:jobs:update",
                "dli:jobs:list",
                "dli:jobs:listAll",
                "dli:jobs:get",
                "dli:jobs:delete",
                "dli:jobs:create",
                "dli:jobs:stop",
		"dli:variable:update",
		"dli:variable:delete",
                "dws:cluster:list",
                "dws:cluster:getDetail",
                "dws:openAPICluster:getDetail",
                "ecs:servers:get",
		"ecs:servers:list",	
                "ecs:servers:stop",
                "ecs:servers:start",
		"ecs:flavors:get",
                "ecs:cloudServerFlavors:get",
                "ecs:cloudServers:list",
                "ecs:availabilityZones:list", 
                "ges:graph:access",
                "ges:metadata:create",
                "ges:jobs:list",
                "ges:graph:operate",
                "ges:jobs:getDetail",
                "ges:graph:getDetail",
                "ges:graph:list",
                "ges:metadata:list",
                "ges:metadata:getDetail",
                "ges:metadata:delete",
                "ges:metadata:operate",
                "kms:cmk:get",
                "kms:cmk:list",
                "kms:cmk:create",
                "kms:cmk:decrypt",
                "kms:cmk:encrypt",
                "kms:dek:create",
                "kms:dek:encrypt",
                "kms:dek:decrypt",
                "mrs:cluster:get",
                "mrs:cluster:list",
                "mrs:job:get",
                "mrs:job:list",
                "mrs:job:submit",
                "mrs:job:stop",
                "mrs:job:delete",
                "mrs:sql:execute",
                "mrs:sql:cancel",
                "rds:*:get",
                "rds:*:list",
                "smn:topic:publish",
                "smn:topic:list",
		"vpc:publicIps:list",
                "vpc:publicIps:get",
                "vpc:vpcs:get",
                "vpc:vpcs:list",
                "vpc:subnets:get",
                "vpc:securityGroups:get",
                "vpc:firewalls:list",
                "vpc:routeTables:list",
                "vpc:subNetworkInterfaces:list"
            ]
        }
    ]
}

We use cookies to improve our site and your experience. By continuing to browse our site you accept our cookie policy. Find out more

Feedback

Feedback

Feedback

0/500

Selected Content

Submit selected content with the feedback