常规授权
添加子账号：add user RAM$zx037:cd-maxcompute;
新建角色： create role cddevelopment;
绑定project slb_http_logs到权限cddevelopment
grant CreateInstance, CreateResource, CreateFunction, CreateTable, List ON PROJECT slb_http_logs TO ROLE cd_development;
绑定table slb_http_logs到权限cddevelopment
grant Describe , Select ,Alter,Update ON TABLE slb_http_log TO ROLE cd_development;
将role绑定到子账号：
grant cddevelopment to RAM$zx037:cd-maxcompute;
取消角色子账号绑定：
revoke cddevelopment from RAM$zx037:cd-maxcompute;

针对整个project表授权（去除drop权限）
[root@ops-server ~]# cat /tmp/cd_development.json
{
"Statement": [{
"Action": ["odps:Read","odps:CreateInstance","odps:CreateTable","odps:List"],
"Effect": "Allow",
"Resource": ["acs:odps::projects/zx037_stage"]
},
{
"Action": ["odps:Select","odps:Describe","odps:Alter","odps:Update"],
"Effect": "Allow",
"Resource": ["acs:odps::projects/zx037_stage/tables/"]
},
{
"Action": ["odps:Drop"],
"Effect": "Deny",
"Resource": ["acs:odps::projects/zx037_stage/tables/*"]
}
],
"Version": "1"
}
查看role的policy语法:get policy on role cddevelopment;
将本地文件上传至role：put policy /tmp/cd_development.txt on role cddevelopment;
将role 绑定子账号：grant cddevelopment to RAM$zx037:cd-maxcompute;
查看子账号的权限：show grants for RAM$zx037:cd-maxcompute;

参考链接：
https://yq.aliyun.com/articles/71902
https://help.aliyun.com/document_detail/27935.html?spm=a2c4g.11186623.6.860.759ecfe6r4suEm
https://blog.csdn.net/yunqiinsight/article/details/82461136