Help Center/ Data Warehouse Service/ User Guide/ Preparations/ RBAC Syntax of RBAC Policies
Updated on 2026-09-15 GMT+08:00
View PDF
Share

RBAC Syntax of RBAC Policies

When multiple teams in an enterprise want to use DWS, different roles require different operation permissions. Role-based access control (RBAC) policies can be used to assign different permissions to different user groups, achieving fine-grained access control. This section describes the syntax structure of DWS RBAC policies to help you understand and manage the policies.

Policy Structure

An RBAC policy consists of a Version, a Statement, and Depends.

Figure 1 RBAC policy structure
Table 1 RBAC policy structure

Parameter

Description

Value

Version

Policy version

The value is fixed at 1.0. An RBAC policy consists of permissions for an entire service. Users in a group with such a policy assigned are granted all of the permissions required for that service.

Statement (authorization statement of a policy)

Action

Operations to be performed on DWS

Format: Service name:Resource type:Operation.

dws:dws:*: permissions for performing all operations on all resource types in DWS. dws indicates the service name. The asterisk (*) is a wildcard.

Effect

Whether the operations defined in an action are allowed. The value can be Allow or Deny.

  • A preset policy contains only Allow statements.
  • A custom policy can contain both Allow and Deny statements.
  • If a policy contains both Allow and Deny statements, the Deny statements take precedence. For details about the check rules, see Authentication Logic.
  • Allow: The operations are allowed.
  • Deny: The operations are not allowed.

Depends

catalog

Name of the catalog to which dependencies of the policy belong

Service name

Example: BASE (basic service catalog, including basic server and tenant permissions)

display_name

Name of a dependency permission

Permission name

Example: Server Administrator

Policy Syntax

When selecting a policy for a user group, click below the policy to view the details of the policy. The DWS Administrator policy is used as an example to describe the syntax of RBAC policies.

When using RBAC for authentication, pay attention to the Depends parameter and grant other dependent permissions at the same time. For example, the DWS Administrator permission depends on the Server Administrator and Tenant Guest permissions. When granting the DWS Administrator permission to users, you also need to grant the two dependent permissions to the users. When a user requests to perform a DWS operation, the system first checks whether the Action in the Statement of the RBAC policy of the user group to which the user belongs contains the requested operation, and checks whether the required permissions declared in Depends have been granted to the user.

Figure 2 Syntax of RBAC Policies 

{
        "Version": "1.0",
        "Statement": [
                {
                        "Effect": "Allow",
                        "Action": [
                                "dws:dws:*"
                        ]
                }
        ],
        "Depends": [
                {
                        "catalog": "BASE",
                        "display_name": "Server Administrator"
                },
                {
                        "catalog": "BASE",
                        "display_name": "Tenant Guest"
                }
        ]
}

Documentation

Parent Topic: Preparations