# FlinkJob场景的LakeFormation授权 提交FlinkJob作业前，需通过委托完成LakeFormation的IAM细粒度授权和SQL资源授权（包括元数据、数据库、表、列和函数），以确保作业在Flink集群后台运行时能够正常访问所需数据。本节介绍FlinkJob场景的LakeFormation授权的具体操作。 #### 授权操作 在使用LakeFormation资源前需要分别完成LakeFormation API的授权和LakeFormation SQL资源授权。各SQL语句的权限请参考[Paimon]和[Iceberg]。 1. 通过委托，授权使用LakeFormation API。 使用FlinkJob执行作业时，需要您先在IAM页面创建相关委托，并在配置作业时添加新建的委托信息。委托权限示例请参考[创建自定义委托](https://support.huaweicloud.com/usermanual-aidatalake/aidatalake_01_0078.html)。 2. **LakeFormation SQL资源授权：授权使用LakeFormation具体资源。** LakeFormation资源授权是指允许用户对特定资源（元数据、数据库、表、列和函数等）的访问权限，以此来控制对LakeFormation的数据和元数据的访问。 在LakeFormation管理控制台，对资源授权。FlinkJob支持角色和委托两种主体类型。 了解LakeFormation SQL资源权限请参考[配置LakeFormation元数据权限](https://support.huaweicloud.com/usermanual-lakeformation/lakeformation_03_00014.html)。 #### SQL鉴权 ![](https://support.huaweicloud.com/usermanual-aidatalake/public_sys-resources/caution_3.0-zh-cn.png) - 除了表格内的权限，IAM侧还需要配置lakeformation:policy:describe。 - 由于Flink默认会校验default数据库，所以在执行任何SQL前，需要在LakeFormation控制台上先为目标Catalog下的default数据库授予DESCRIBE权限，授权操作请参考[配置LakeFormation元数据权限](https://support.huaweicloud.com/usermanual-lakeformation/lakeformation_03_00014.html)。 - 建议不要给lakeformation:policy:create权限，给了会被视为管理员，跳过SQL鉴权。 - [Paimon] 表1Paimon鉴权 | 类型 | SQL | LakeFormation SQL资源鉴权权限 | IAM权限 | |:---|:---|:---|:---| | SQL DDL | CREATE DATABASE | database:DESCRIBE catalog:CREATE_DATABASE catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:database:create" "lakeformation:catalog:describe" | | SQL DDL | CREATE TABLE my_table | database:DESCRIBE database:CREATE_TABLE table:DESCRIBE catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create" "lakeformation:catalog:describe" | | SQL DDL | Create Table As Select | table:DESCRIBE table:INSERT table:SELECT table:ALTER database:CREATE_TABLE database:DESCRIBE catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create" "lakeformation:table:alter" "lakeformation:catalog:describe" | | SQL DDL | Create Table Like | table:DESCRIBE table:INSERT database:CREATE_TABLE database:DESCRIBE catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create" "lakeformation:catalog:describe" | | SQL DDL | ALTER TABLE my_table SET (key1=val1); | database:DESCRIBE table:DESCRIBE table:ALTER catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" "lakeformation:catalog:describe" | | SQL DDL | ALTER TABLE my_table RESET (key1=val1); | database:DESCRIBE table:DESCRIBE table:ALTER catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" "lakeformation:catalog:describe" | | SQL DDL | ALTER TABLE my_table RENAME TO my_table_new; | database:DESCRIBE table:DESCRIBE table:ALTER catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" "lakeformation:catalog:describe" | | SQL DDL | ALTER TABLE my_table ADD (c1 INT, c2 STRING); | database:DESCRIBE table:DESCRIBE table:ALTER catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" "lakeformation:catalog:describe" | | SQL DDL | ALTER TABLE my_table RENAME c0 TO c1; | database:DESCRIBE table:DESCRIBE table:ALTER catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" "lakeformation:catalog:describe" | | SQL DDL | ALTER TABLE my_table DROP (c1, c2); | database:DESCRIBE table:DESCRIBE table:ALTER catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" "lakeformation:catalog:describe" | | SQL DDL | ALTER TABLE my_table MODIFY buy_count BIGINT COMMENT ''; | database:DESCRIBE table:DESCRIBE table:ALTER catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" "lakeformation:catalog:describe" | | SQL DDL | ALTER TABLE my_table ADD c INT AFTER b; | database:DESCRIBE table:DESCRIBE table:ALTER catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" "lakeformation:catalog:describe" | | SQL DDL | ALTER TABLE my_table MODIFY col_a DOUBLE AFTER col_b; | database:DESCRIBE table:DESCRIBE table:ALTER catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" "lakeformation:catalog:describe" | | SQL DDL | ALTER TABLE my_table MODIFY col_a DOUBLE; | database:DESCRIBE table:DESCRIBE table:ALTER catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" "lakeformation:catalog:describe" | | SQL DDL | ALTER DATABASE \[catalog_name.\]db_name SET (key1=val1, key2=val2, ...); | database:DESCRIBE database:ALTER catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:database:alter" "lakeformation:catalog:describe" | | SQL DML | INSERT INTO my_table SELECT ... | table:DESCRIBE table:ALTER table:SELECT database:DESCRIBE catalog:DESCRIBE | "lakeformation:table:describe", "lakeformation:table:alter", "lakeformation:database:describe" "lakeformation:catalog:describe" | | Auxiliary语句 | DESCRIBE TABLE | database:DESCRIBE table:DESCRIBE catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" "lakeformation:catalog:describe" | | Auxiliary语句 | SHOW DATABASES | catalog:LIST_DATABASE database:DESCRIBE catalog:DESCRIBE | "lakeformation:database:describe" "lakeformation:catalog:describe" | | Auxiliary语句 | SHOW CURRENT DATABASE | catalog:LIST_DATABASE database:DESCRIBE catalog:DESCRIBE | "lakeformation:database:describe" "lakeformation:catalog:describe" | | Auxiliary语句 | SHOW CREATE TABLE | database:DESCRIBE table:DESCRIBE catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" "lakeformation:catalog:describe" | | Auxiliary语句 | SHOW COLUMNS | database:DESCRIBE table:DESCRIBE catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" "lakeformation:catalog:describe" | | Auxiliary语句 | SHOW PARTITIONS | database:DESCRIBE table:DESCRIBE catalog:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" "lakeformation:catalog:describe" | - [Iceberg] 表2Iceberg鉴权 | 类型 | SQL | LakeFormation SQL资源鉴权权限 | IAM权限 | |:---|:---|:---|:---| | SQL DDL | CREATE DATABASE | database:DESCRIBE catalog:CREATE_DATABASE | "lakeformation:database:describe", "lakeformation:database:create" | | SQL DDL | CREATE TABLE my_table | database:DESCRIBE database:CREATE_TABLE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create" | | SQL DDL | Create Table Like | table:DESCRIBE table:INSERT database:CREATE_TABLE database:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create" | | SQL DDL | DROP DATABASE | database:DESCRIBE database:DROP | "lakeformation:database:describe", "lakeformation:database:drop" | | SQL DDL | DROP TABLE | database:DESCRIBE table:DESCRIBE table:DROP | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:drop" | | SQL DDL | ALTER TABLE | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | | SQL DDL | ALTER TABLE .. RENAME TO | database:DESCRIBE database:CREATE_TABLE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" "lakeformation:table:create" | | SQL DML | INSERT INTO my_table SELECT ... | table:DESCRIBE table:ALTER table:SELECT database:DESCRIBE | "lakeformation:table:describe", "lakeformation:table:alter", "lakeformation:database:describe" | | SQL DML | INSERT OVERWRITE my_table SELECT ... | table:DESCRIBE table:ALTER table:UPDATE database:DESCRIBE | "lakeformation:table:describe", "lakeformation:table:alter", "lakeformation:database:describe" | | Auxiliary语句 | DESCRIBE TABLE | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | | Auxiliary语句 | SHOW DATABASES | catalog:LIST_DATABASE database:DESCRIBE | "lakeformation:database:describe" | | Auxiliary语句 | SHOW CURRENT DATABASE | catalog:LIST_DATABASE database:DESCRIBE | "lakeformation:database:describe" | | Auxiliary语句 | SHOW CREATE TABLE | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | | Auxiliary语句 | SHOW TABLES | database:LIST_TABLE database:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | | Auxiliary语句 | SHOW COLUMNS | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | | Auxiliary语句 | SHOW PARTITIONS | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" |