Help Center/ Data Lake Insight/ API Reference/ Permissions Policies and Supported Actions

Updated on 2024-09-29 GMT+08:00

View PDF

Permissions Policies and Supported Actions

This section describes fine-grained permissions management for your DLI. If your Huawei Cloud account does not need individual IAM users, then you may skip this section.

By default, new IAM users do not have permissions assigned. You need to add them to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups to which they are added After authorization, the user can perform specified operations on MRS based on the permissions.

Based on the authorization precision, permissions are classified into roles and policies.

Roles are a type of coarse-grained authorization mechanism that defines permissions related to user responsibilities.
Policies define API-based permissions for operations on specific resources under certain conditions, allowing for more fine-grained, secure access control of cloud resources.

Policy-based authorization is useful if you want to allow or deny the access to an API.

An account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions. The permissions required for calling an API are determined by the actions supported by the API. Only users who have been granted permissions allowing the actions can call the API successfully. For example, if an IAM user needs to create buckets using an API, the user must have been granted permissions that allow the dli:queue:create_queue action.

Supported Actions

VBS provides system-defined policies that can be directly used in IAM. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:

Permissions: Allow or deny operations on specified resources under specific conditions.
APIs: RESTful APIs that can be called in a custom policy.
Actions: added to a custom policy to control permissions for specific operations.
Related actions: Actions on which a specific action depends to take effect. When assigning permissions for the action to a user, you also need to assign permissions for the related actions.
IAM or enterprise projects: Type of projects for which an action will take effect. Policies that contain actions supporting both IAM and enterprise projects can be assigned to user groups and take effect in both IAM and Enterprise Management. Policies that only contain actions supporting IAM projects can be assigned to user groups and only take effect for IAM. Such policies will not take effect if they are assigned to user groups in Enterprise Project.
For details about the differences between IAM and enterprise projects, see Differences Between IAM and Enterprise Management.

The check mark (√) indicates that an action takes effect. The cross mark (x) indicates that an action does not take effect.

DLI supports the following actions that can be defined in custom policies:

**Table 1** Actions
Permission	API	Actions	IAM Project (Project)	Enterprise Project (Enterprise Project)
Creating a queue	POST /v1.0/{project_id}/queues	dli:queue:createQueue	√	√
Deleting a queue	DELETE /v1.0/{project_id}/queues/{queue_name}	dli:queue:dropQueue	√	√
Submitting a job	POST /v1.0/{project_id}/jobs/submit-job	dli:queue:submitJob	√	×
Canceling a job	DELETE /v1.0/{project_id}/jobs/{job_id}	dli:queue:cancelJob	√	×
Viewing queue permissions of other users	GET /v1.0/{project_id}/queues/{queue_name}/users	dli:queue:showPrivileges	√	×
Restarting a queue	PUT /v1.0/{project_id}/queues/{queue_name}/action	dli:queue:restart	√	×
Scaling out/in a queue	PUT /v1.0/{project_id}/queues/{queue_name}/action	dli:queue:scaleQueue	√	×
Granting elastic resource pool permissions	PUT /v1.0/{project_id}/user-authorization	dli:elasticresourcepool:grantPrivilege	√	×
Revoking elastic resource pool permissions	PUT /v1.0/{project_id}/user-authorization	dli:elasticresourcepool:revokePrivilege	√	×
Creating a database	POST /v1.0/{project_id}/databases	dli:database:createDatabase	√	×
Deleting a database	DELETE /v1.0/{project_id}/databases/{database_name}	dli:database:dropDatabase	√	×
Modifying database configuration	POST /v1.0/{project_id}/jobs/submit-job	dli:database:alterDatabaseProperties	√	×
Explaining the SQL statement as an execution plan	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:explain	√	×
Creating a table	POST /v1.0/{project_id}/databases/{database_name}/tables	dli:database:createTable	√	×
Creating a view	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:createView	√	×
Creating a function	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:createFunction	√	×
Describing a function	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:describeFunction	√	×
Deleting a function	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:dropFunction	√	×
Displaying a function	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:showFunctions	√	×
Creating a role	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:createRole	√	×
Deleting a role	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:dropRole	√	×
Displaying a role	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:showRoles	√	×
Displaying all roles	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:showAllRoles	√	×
Binding a role	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:grantRole	√	×
Unbinding a role	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:revokeRole	√	×
Displaying the binding relationships between all roles and users	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:database:showUsers	√	×
Viewing database permissions of other users	GET /v1.0/{project_id}/databases/{database_name}/users	dli:database:showPrivileges	√	×
Displaying a database	GET /v1.0/{project_id}/databases	dli:database:displayDatabase	√	×
Displaying all databases	GET /v1.0/{project_id}/databases	dli:database:displayAllDatabases	√	×
Displaying all tables	GET /v1.0/{project_id}/databases	dli:database:displayAllTables	√	×
Granting database permissions to a specified user	PUT /v1.0/{project_id}/user-authorization	dli:database:grantPrivilege	√	×
Removing database permissions of a specified user	PUT /v1.0/{project_id}/user-authorization	dli:database:revokePrivilege	√	×
Deleting a table	DELETE /v1.0/{project_id}/databases/{database_name}/tables/{table_name}	dli:table:dropTable	√	×
Displaying the table structure	GET /v1.0/{project_id}/databases/{database_name}/tables/{table_name}	dli:table:describeTable	√	×
Querying a table	GET /v1.0/{project_id}/databases/{database_name}/tables/{table_name}/preview	dli:table:select	√	×
Displaying table configuration	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:table:showTableProperties	√	×
Displaying the table creation statement	GET /v1.0/{project_id}/databases/{database_name}/tables/{table_name}/preview	dli:table:showCreateTable	√	×
Displaying all partitions	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:table:showPartitions	√	×
Setting table configuration	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:table:alterTableSetProperties	√	×
Adding a column	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:table:alterTableAddColumns	√	×
Adding partitions to a partitioned table	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:table:alterTableAddPartition	√	×
Renaming a table partition	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:table:alterTableRenamePartition	√	×
Deleting partitions from a partitioned table	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:table:alterTableDropPartition	√	×
Restoring a table partition	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:table:alterTableRecoverPartition	√	×
Renaming a table	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:table:alterTableRename	√	×
Setting the partition path	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:table:alterTableSetLocation	√	×
Inserting table data	POST /v1.0/{project_id}/jobs/submit-job, statement invoking	dli:table:insertIntoTable	√	×
Rewriting table data	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:table:insertOverwriteTable	√	×
Viewing table permissions of other users	GET /v1.0/{project_id}/databases/{database_name}/tables/{table_name}/users	dli:table:showPrivileges	√	×
Clearing a table	POST /v1.0/{project_id}/jobs/submit-job	dli:table:truncateTable	√	×
Updating a table	POST /v1.0/{project_id}/jobs/submit-job	dli:table:update	√	×
Deleting table data	POST /v1.0/{project_id}/jobs/submit-job	dli:table:delete	√	×
Modifying column information	POST /v1.0/{project_id}/jobs/submit-job	dli:table:alterTableChangeColumn	√	×
Deleting a column	POST /v1.0/{project_id}/jobs/submit-job	dli:table:alterTableDropColumns	√	×
Displaying data segments	POST /v1.0/{project_id}/jobs/submit-job	dli:table:showSegments	√	×
Merging data segments	POST /v1.0/{project_id}/jobs/submit-job	dli:table:compaction	√	×
Modifying a view	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:table:alterView	√	×
Displaying the table structure	POST /v1.0/{project_id}/jobs/submit-job, executing corresponding SQL statements	dli:table:describeTable	√	×
Granting data table permissions to a specified user	PUT /v1.0/{project_id}/user-authorization	dli:table:grantPrivilege	√	×
Removing data table permissions of a specified user	PUT /v1.0/{project_id}/user-authorization	dli:table:revokePrivilege	√	×
Viewing the security authentication information permission list of other users	GET /v1.0/{project_id}/datasource/auth-infos/{auth_name}/users	dli:datasourceauth:showPrivileges	√	×
Using security authentication information	POST /v1.0/{project_id}/jobs/submit-job	dli:datasourceauth:useAuth	√	×
Deleting security authentication information	DELETE /v2.0/{project_id}/datasource/auth-infos/{auth_info_name}	dli:datasourceauth:dropAuth	√	×
Updating security authentication information	PUT /v2.0/{project_id}/datasource/auth-infos	dli:datasourceauth:updateAuth	√	×
Granting security authentication permissions to a specified user	PUT /v1.0/{project_id}/user-authorization	dli:datasourceauth:grantPrivilege	√	×
Removing security authentication permissions of a specified user	PUT /v1.0/{project_id}/user-authorization	dli:datasourceauth:revokePrivilege	√	×
Removing job permissions of a specified user	PUT /v1.0/{{project_id}}/authorization	dli:jobs:revokePrivilege	√	×
Querying a Column	POST /v1.0/{project_id}/jobs/submit-job, SQL statement invoking	dli:column:select	√	×
Granting permissions to a specified user queue	PUT /v1.0/{project_id}/user-authorization	dli:column:grantPrivilege	√	×
Removing permissions of a specified user queue	PUT /v1.0/{project_id}/user-authorization	dli:column:revokePrivilege	√	×
Listing Flink jobs	GET /v1.0/{project_id}/streaming/jobs	dli:jobs:listAll	√	×
Querying Flink job details	GET /v1.0/{project_id}/streaming/jobs/{job_id}	dli:jobs:get	√	×
Creating a Flink SQL job	POST /v1.0/{project_id}/streaming/sql-jobs	dli:jobs:create	√	×
Creating a Flink Jar job	POST /v1.0/{project_id}/streaming/flink-jobs	dli:jobs:create	√	×
Updating a Flink SQL job	PUT /v1.0/{project_id}/streaming/sql-jobs/{job_id}	dli:jobs:update	√	×
Updating a Flink Jar job	PUT /v1.0/{project_id}/streaming/flink-jobs/{job_id}	dli:jobs:update	√	×
Deleting a Flink job	DELETE /v1.0/{project_id}/streaming/jobs/{job_id}	dli:jobs:delete	√	×
Running Flink jobs in batches	POST /v1.0/{project_id}/streaming/jobs/run	dli:jobs:start	√	×
Stopping a Flink job	POST /v1.0/{project_id}/streaming/jobs/stopob_id/stop	dli:jobs:stop	√	×