The access control of data tagging is based on a user’s database permission. There are two types of users in Treasure Data: Restricted User and TD Administrator.
See About Policy-based Permissions to learn more about DB PBP and the legacy database access control.
If the account has DB PBP disabled the account is using the legacy database access control model.
In the legacy database access control model, the administrator automatically has edit permission for all databases. Switch between TD Console and TD Console Legacy using the Treasure Data Logo at the top left of TD Console.
Administrator
- Only the TD administrator can create or delete Policy/Resource types of tags.
- With edit permission on the database, the administrator can:
- List all tags that are attached to columns or user-defined workflows.
- Attach or detach Resource tags to the columns or user-defined workflows.
- Attach or detach Policy tags to the columns or user-defined workflows.
Restricted User
- With edit permission on the database, the restricted user can:
- List all tags that are attached to columns or user-defined workflows.
- Attach or detach Resource tags to the columns or user-defined workflows.
- Attach or detach Policy tags to the columns or user-defined workflows.
- With only query permission on the database, the restricted user can list (view) all tags that are attached to columns or user-defined workflows.
- With edit permission on the database, the restricted user can:
Administrator
- Only the TD administrator can create or delete Policy/Resource types of tags.
- With edit permission on the database, the administrator can:
- List all tags that are attached to columns or user-defined workflows.
- Attach or detach Resource tags to the columns or user-defined workflows.
- Attach or detach Policy tags to the columns or user-defined workflows.
- With only query permission on the database, the administrator can list (view) all tags that are attached to columns or user-defined workflows.
Restricted User
- With edit permission on the database, the restricted user can:
- List all tags that are attached to user-defined workflows.
- Attach or detach Resource tags to user-defined workflows.
- With only query permission on the database, the restricted user can list (view) all tags that are attached to columns or user-defined workflows.
- With edit permission on the database, the restricted user can:
The restricted user cannot attach or detach policy tags, even with edit permission. Attaching or detaching policy tags impacts access control that is set up by tag-based policies. In DB PBP, only the TD administrator can configure database access control.