Using IAM Identity Policies to Grant Access to DLI

Prerequisites

• Before granting permissions to a user group, familiarize yourself with the DLI permissions that can be added to the user group and select them as needed.

  Prior to executing any authorization actions, take the time to understand the range of DLI permissions that are applicable. Make informed selections based on your actual requirements.

  For details about the system permissions supported by DLI, see Role/Policy-based Permission Management.

Process Flow

Figure 1 Process for granting DLI permissions

1. On the IAM console, create an IAM user or create a user group.

   Log in to the IAM console and create a user or user group.

2. Attach a system-defined identity policy to the user or user group.

   Authorize the DLIReadOnlyPolicy system-defined policy to the user or user group.

3. Log in as the IAM user and verify permissions.

   Log in to the console as an authorized user and verify the permissions.

   • Click Service List and choose Analytics > Data Lake Insight. On the DLI console, click Buy Resource Pool to buy an elastic resource pool. If you are unable to do so (supposing that your current permissions only include DLIReadOnlyPolicy), the DLIReadOnlyPolicy permission is already in effect.
   • Choose another service from Service List. If a message appears indicating that you have insufficient permissions to access the service, the DLIReadOnlyPolicy policy is in effect.
4. (Optional) Create custom policies to supplement the system-defined policies of DLI.

   For details about the actions supported for custom policies, see Actions Supported by Identity Policy-based Authorization.

   You can create custom policies in either of the following ways:

   • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
   • JSON: Create a JSON policy or edit an existing one.

   For details, see Creating a Custom Identity Policy and Attaching It to a Principal.

Example Custom Policies

• Example 1: Grant all permissions for DLI.
  A custom policy can contain the actions of multiple services.

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "dli:*:*","iam:users:list",
  		"vpc:vpcs:list",
  		"vpc:vpcs:get",
  		"vpc:securityGroups:list",
  		"vpc:routeTables:list",
  		"vpc:subnets:list",
  		"vpc:subnets:get",
  		"tms:predefineTags:list"
              ]
          }
      ]
  }
  

• Example 2: Grant the read-only permission for DLI.

  {
      "Version": "5.0",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "dli:*:list*",
                  "dli:*:display*",
                  "dli:*:get*"
              ]
          }
      ]
  }