Bind a MaxCompute project as a computing resource in DataWorks - DataWorks

Before you can develop and manage MaxCompute tasks in DataWorks, you must first bind your MaxCompute project as a MaxCompute computing resource in DataWorks. After binding, you can use this computing resource in various DataWorks modules to connect to the MaxCompute project and perform operations such as data synchronization, data development, and data analysis.

Limits

A MaxCompute project can be bound as a computing resource only when the MaxCompute project and the DataWorks workspace are in the same region and belong to the same Alibaba Cloud account.

Permission restrictions:

Product	User	Required permissions
DataWorks side	Alibaba Cloud account	No additional authorization required.
DataWorks side	RAM user/RAM role	Only workspace members with the Deploy and Workspace Administrator roles, or members with the `AliyunDataWorksFullAccess` permission can create computing resources. You can authorize workspace members accordingly.
MaxCompute side	RAM user/RAM role	When binding a computing resource: You must have the MaxCompute odps:ListProjects permission and the Super_Administrator permission for the target MaxCompute project. When used as the default access identity: You must have the admin or super_administrator permission for the MaxCompute project. After the computing resource is bound, the account or role will be added to the MaxCompute production project as the Role_Project_Scheduler role.

Production data in the current workspace belongs to the default access identity specified when creating the computing resource for the production environment. If other accounts need to operate on or access production tables, they must request the relevant permissions in the Security Center.

Prerequisites

You have activated MaxCompute in the same region as DataWorks and created a MaxCompute project.
You have created a workspace in DataWorks, and the RAM user you are using has been added to the workspace and assigned the workspace administrator role.
Note
DataWorks workspaces are divided into basic mode and standard mode. When creating a workspace, you need to understand the differences between basic mode and standard mode.
You have bound resource groups to the workspace and ensured network connectivity.
- When using Serverless resource groups, you only need to ensure that the MaxCompute computing resource has normal connectivity with the Serverless resource group.
- When using the legacy exclusive resource group, you need to ensure that the MaxCompute computing resource has normal connectivity with the exclusive scheduling resource group in the corresponding scenario.

New version of data development: Bind a MaxCompute computing resource

Bind a MaxCompute computing resource for workspaces that have Joined The Public Beta Of Data Development (Data Studio) (new Version).

Access the computing resource list page

Log on to the DataWorks console, switch to the target region, and click More > Management Center in the left-side navigation pane. Select the corresponding workspace from the dropdown list and click Go To Management Center.
In the left-side navigation pane, click Computing Resources to access the computing resource list page.

Bind a MaxCompute computing resource

On the computing resource list page, configure the binding of a MaxCompute computing resource.

Select the type of computing resource to bind.
1. Click Bind Computing Resource or Create Computing Resource to access the Bind Computing Resource page.
2. On the Bind Computing Resource page, select MaxCompute as the computing resource type to access the Bind MaxCompute Computing Resource configuration page.

Configure the MaxCompute computing resource.

On the Bind MaxCompute Computing Resource configuration page, configure the parameters according to the following table.

Parameter	Description
MaxCompute Project	Select the MaxCompute project you want to bind. You can create an internal MaxCompute project or create an external MaxCompute project, and then select the newly created project. Note If you created a workspace in standard mode, you need to select different MaxCompute projects for the production and development environments. For information about MaxCompute billable items and billing methods. If you cannot select the target MaxCompute project, grant the Super_Administrator permission of the project to the current login account.
Default Access Identity	The default access identity that is used to access the MaxCompute project in the current workspace. Development environment: Currently only supports access using the Executor identity. Production environment: Supports access using Alibaba Cloud Account, Alibaba Cloud RAM User, and Alibaba Cloud RAM Role. Note Only Alibaba Cloud accounts and users or roles with the AdministratorAccess permission can select all identity access options. Production data in the current workspace belongs to the default access identity specified for the production environment when creating the computing resource. If other accounts need to operate on or access production tables, they must request the relevant permissions in the Security Center. For more information, see Manage permissions on MaxCompute and Overview.
Computing Resource Instance Name	The identifier of the computing resource. When a task is run, the system selects a computing resource for the task based on the name of the specified computing resource instance.

Test the connectivity.
In the Connection Configuration section, select the resource group that DataWorks will use to run MaxCompute tasks, and click Test Connectivity to ensure that the resource group can access your MaxCompute project normally. For more information, see Network connectivity solutions.
Note
If no available resource group exists, you can add and bind a Serverless resource group to the workspace, and then test the connectivity with the computing resource in the Computing Resources section of the workspace.
Click Complete Creation to finish the MaxCompute computing resource configuration.
Note
- After binding is complete, the system will automatically create a MaxCompute data source with the same name in the Data Sources section of the current workspace.
- After the computing resource is successfully bound, the platform will authorize the access identity by adding the access identity account to the MaxCompute project and mapping the corresponding MaxCompute permissions for that identity. Before the authorization is complete, connectivity tests may result in permission errors. In this case, after saving the computing resource, you need to wait for a moment.

Legacy version of data development: Bind a MaxCompute computing resource

Bind a MaxCompute computing resource for workspaces that have not Joined The Public Beta Of Data Development (Data Studio) (new Version).

Access the computing resource list page

Go to the DataStudio page.
Log on to the DataWorks console. In the top navigation bar, select the desired region. In the left-side navigation pane, choose Data Development and O&M > Data Development. On the page that appears, select the desired workspace from the drop-down list and click Go to Data Development.
In the left-side navigation pane, click the icon to access the Computing Resources list page.

Bind a MaxCompute computing resource

On the computing resource list page, configure the binding of a MaxCompute computing resource.

Select the type of computing resource to bind.
1. Click Create Computing Resource to access the Create Computing Resource page.
2. On the Create Computing Resource page, select MaxCompute as the computing resource type to access the Create Computing Resource configuration page.

Configure the MaxCompute computing resource.

On the Create Computing Resource configuration page, configure the parameters according to the following table.

Parameter	Description
Authentication Method	New computing resources only support authentication through Alibaba Cloud accounts and Alibaba Cloud RAM roles.
Alibaba Cloud Account	Only MaxCompute projects under the Current Alibaba Cloud Account can be used as computing resources for the current workspace.
MaxCompute Project Name	Select the MaxCompute project you want to bind. If the target project does not exist, you need to create a MaxCompute project. Note If you created a workspace in standard mode, you need to select different MaxCompute projects for the production and development environments. For information about MaxCompute billable items and billing methods. If you cannot select the target MaxCompute project, grant the Super_Administrator permission of the project to the current login account.
Region	Select the region where the MaxCompute project is located. If the selected MaxCompute project is not in the same region as the current workspace, you cannot bind the MaxCompute project as a computing resource.
Default Access Identity	The default access identity that is used to access the computing resource in the current workspace. Development environment: Currently only supports access using the Executor identity. Production environment: Supports access using Alibaba Cloud account, Alibaba Cloud RAM user, and Alibaba Cloud RAM role. Note Only Alibaba Cloud accounts and users or roles with the AdministratorAccess permission can select all identity access options. Production data in the current workspace belongs to the default access identity specified for the production environment when creating the computing resource. If other accounts need to operate on or access production tables, they must request the relevant permissions in the Security Center. For more information, see Manage permissions on MaxCompute and Overview.
Endpoint	The endpoint that DataWorks uses to access the MaxCompute project through this computing resource. This includes the endpoint for accessing the MaxCompute service and the Tunnel service endpoint for uploading and downloading local or cloud computing resource data. The following configuration methods are supported: Auto Fit: DataWorks automatically adapts based on the actual situation. We recommend selecting this option. Note If the MaxCompute project and DataWorks service are in different regions, creating a cross-region access scenario, Data Integration will use the public network access address to read and download data by default in the auto-fit mode. In this case, when using Serverless resource groups, you need to configure an Internet NAT gateway and EIP for the bound VPC to support public network access. Custom Configuration: In the custom configuration mode, you need to manually configure the MaxCompute Endpoint and Tunnel Endpoint. Different regions have different endpoints.

Test the connectivity.
In the Connection Configuration section, select the resource group that DataWorks will use to run MaxCompute tasks, and click Test Connectivity to ensure that the resource group can access your MaxCompute project normally. For more information, see Network connectivity solutions.
Note
If no available resource group exists, you can add and bind a Serverless resource group to the workspace, and then test the connectivity with the computing resource in the Computing Resources section of the workspace.
Click Create Computing Resource And Bind To Data Development to finish the MaxCompute computing resource configuration.
Note
- After binding is complete, the system will automatically create a MaxCompute data source with the same name in the Data Sources section of the current workspace.
- After the computing resource is successfully bound, the platform will authorize the access identity by adding the access identity account to the MaxCompute project and mapping the corresponding MaxCompute permissions for that identity. Before the authorization is complete, connectivity tests may result in permission errors. In this case, after saving the computing resource, you need to wait for a moment.

What to do next

After completing the MaxCompute computing resource binding, a MaxCompute data source will be automatically created for the workspace. You can use this data source in Data Integration, along with in Database nodes (new version of data development) or Database nodes (legacy version of data development).

FAQ

Issue: When scheduling a MaxCompute computing resource, the error connect timed out, the possible reason is that the endpoint `http://service.odps.aliyun.com/api` is wrong, please check your endpoint occurs.
Solution: Check if the Endpoint configuration of the MaxCompute computing resource is correct. Enter the VPC Endpoint for the same region as the resource.
Issue: When testing the connectivity of a computing resource, the error You have NO privilege 'odps:Read' on {acs:odps:*:projects/xxx} occurs.
Solution: Check if your MaxCompute project status is normal. If it is in a frozen or Suspended state, you can Resume the MaxCompute project you need to bind in the MaxCompute console.