# LakeFormation委托用户权限参考
当MRS对接LakeFormation后，LakeFormation委托用户通过Spark、HetuEngine等执行SQL时所需的LakeFormation权限参考如下所示。
- **DDL Statements**
  表1DDL Statements 
  | DDL语句                                                                                             | 元数据LakeFormation鉴权所需权限                                                                                                                                                                                                                                                          |
  |:---|:---|
  | ALTER DATABASE                                                                                    | database:describe database:alter                                                                                                                                                                                   |
  | ALTER TABLE                                                                                       | database:describe table:describe table:alter                                                                                                         |
  | ALTER VIEW                                                                                        | database:describe table:describe(source\\target\\new) table:alter                                                                                      |
  | CREATE DATABASE                                                                                   | catalog:createDatabase                                                                                                                                                                                                                                                          |
  | CREATE OR REPLACE FUNCTION (create)  | database:describe function:describe database:createFunction                                                                                           |
  | CREATE OR REPLACE FUNCTION (replace) | database:describe function:describe function:alter                                                                                                    |
  | CREATE TABLE                                                                                      | database:describe table:describe database:createTable                                                                                                |
  | CREATE VIEW                                                                                       | database:createTable table:describe（source\\target） table:drop(target)（替换） tableLocation：R |
  | DROP DATABASE                                                                                     | database:drop                                                                                                                                                                                                                                                                   |
  | DROP FUNCTION                                                                                     | database:describe function:describe function:drop                                                                                                    |
  | DROP TABLE                                                                                        | database:describe table:describe table:drop                                                                                                         |
  | DROP VIEW                                                                                         | database:describe table:describe(target\\source) table:drop(target)                                                                               |
  | REPAIR TABLE                                                                                      | database:describe table:describe table:alter                                                                                                           |
  | TRUNCATE TABLE                                                                                    | database:describe table:describe                                                                                                                                                                                   |
  | DELETE TABLE                                                                                      | database:describe table:describe table:alter                                                                                                           |
  | USE DATABASE                                                                                      | database:describe                                                                                                                                                                                                                                                               |
     
  
- **DML Statements**
  表2DML Statements 
  | DDL语句                             | 调用元数据接口需要LakeFormation权限                                                                                                                                               |
  |:---|:---|
  | INSERT TABLE                      | database:describe table:describe table:alter |
  | INSERT OVERWRITE DIRECTORY SELECT | database:describe table:describe                                                                           |
  | INSERT OVERWRITE DIRECTORY        | 无                                                                                                                                                                      |
  | LOAD DATA                         | database:describe table:describe                                                                           |
     
  ![](https://support.huaweicloud.com/usermanual-mrs/public_sys-resources/notice_3.0-zh-cn.png)
  - Hive对接时，INSERT TABLE会调用HiveExternalMetastore loaddata接口，间接调用altertable接口。
  
  - load data时spark会移动来源文件夹，删除表文件夹导致相关OBS权限丢失，需要另外赋予OBS权限到上级目录。
    
- **Data Retrieval Statements**
  表3Data Retrieval Statements 
  | DDL语句            | 调用元数据接口需要LakeFormation权限                                                                     |
  |:---|:---|
  | SELECT Statement | database:describe table:describe |
  | EXPLAIN          | 取决于执行sql                                                                                     |
     
  
- **Auxiliary Statements**
  表4Auxiliary Statements 
  | DDL语句               | 调用元数据接口需要LakeFormation权限                                                                                                                                                      |
  |:---|:---|
  | ADD FILE(OBS)       | 无                                                                                                                                                                             |
  | ADD JAR(OBS)        | 无                                                                                                                                                                             |
  | ANALYZE TABLE       | database:describe table:describe table:alter        |
  | CACHE TABLE         | database:describe table:describe                                                                                |
  | CLEAR CACHE         | 无                                                                                                                                                                             |
  | DESCRIBE DATABASE   | database:describe                                                                                                                                                             |
  | DESCRIBE FUNCTION   | database:describe function:describe                                                                              |
  | DESCRIBE QUERY      | database:describe table:describe                                                                                  |
  | DESCRIBE TABLE      | database:describe table:describe                                                                                  |
  | LIST FILE           | 无                                                                                                                                                                             |
  | LIST JAR            | 无                                                                                                                                                                             |
  | REFRESH             | 无                                                                                                                                                                             |
  | REFRESH TABLE       | database:describe table:describe                                                                                |
  | REFRESH FUNCTION    | database:describe function:describe                                                                             |
  | RESET               | 无                                                                                                                                                                             |
  | SET                 | 无                                                                                                                                                                             |
  | SHOW COLUMNS        | database:describe table:describe                                                                                  |
  | SHOW CREATE TABLE   | database:describe table:describe                                                                                   |
  | SHOW DATABASES      | catalog:listDatabase                                                                                                                                                          |
  | SHOW FUNCTIONS      | database:describe 无（通过describe权限过滤）                                                                            |
  | SHOW PARTITIONS     | database:describe table:describe                                                                                 |
  | SHOW TABLE EXTENDED | database:describe table:describe database:listTable |
  | SHOW TABLES         | database:describe database:listTable                                                                              |
  | SHOW TBLPROPERTIES  | database:describe table:describe                                                                                  |
  | SHOW VIEWS          | database:describe database:listTable                                                                               |
  | UNCACHE TABLE       | database:describe table:describe                                                                                   |
     
  ![](https://support.huaweicloud.com/usermanual-mrs/public_sys-resources/notice_3.0-zh-cn.png)
  - 通过Hive对接时，Spark会通过HiveExternalCatalog调用alterTableStats，将分析数据写入表属性中。
  
  - listTableNames、listDatabaseNames需要具有**catalog:listDatabase、** **database:listTable**权限，否则将会返回空列表。
  
  - 不支持分区鉴权，即column:select鉴权时不对涉及的分区进行鉴权。
  
  - 当用户拥有任意权限，即可以视为拥有use权限。