LAS provides metadata object permission management functionality, enabling you to manage permissions for LAS metadata objects such as Catalog, Schema, Table, and UDF. This includes adding, displaying, editing, and deleting permissions. This document introduces the key points for permission management operations and provides a detailed permission list.

Prerequisites for granting permissions to a user or group on the LAS permission management page:

• The user or group has already been granted the relevant Policy in IAM and can access the LAS service.
• Users can only manage permissions for objects for which they have the Admin role.

Add authorization #

1. Log in and enter LAS Console. In the left navigation bar, click "Metadata" > "rights management" to enter the metadata permission management page. Click the Add authorization button in the upper right corner of the page.
   

2. Configure the permission control details in the pop-up sidebar.
   

   Parameters	Configuration instructions
   Authorized resources	Select the type of authorization object and the specific authorization object. Authorization scope: The following levels are currently supported: Data catalog (Catalog), database (Schema) and data table (Table) or function (UDF). You can select different authorization objects to manage their permissions. After selecting the authorization scope, select the objects to be authorized at each level within the corresponding scope.
   authorized object	Select which user, user group, or role to authorize. Currently, you can authorize users, user groups, or roles that have been created under the same primary account in "Access Control IAM".
   Grant permission	Select the scope of permissions for the role to be granted to the target user. LAS provides preset permission roles such as Admin, Developer, Viewer, and Read. Each permission role has a different scope of permissions for metadata object operations. Different metadata objects support different permission roles. For details on the types and scopes of permission roles supported by each metadata object, see Permission list description below. You can refer to the permission list to select the permission role to grant.

Edit/delete permissions #

• If the grantee already has a permission role, duplicate granting is not allowed. You can find the authorization record in permission management, click Edit, and change the user's role.
• In the authorization list, you can see the Delete button. If you do not want the user to continue to have permissions for Schema, Table, or UDF, you can delete the permissions directly.

The metadata at different levels corresponds to different permission points and roles, as well as their relationships. Details are as follows:

Database (Schema) level #

Table level #

Function (UDF) level #