Reference of RAM policy actions and resources - Platform For AI - Alibaba Cloud - Platform For AI

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Platform for AI for RAM permission policies. The RAM code (RamCode) for Platform for AI is paiworkspace,pai,paiimage,paicodesource,paidataset,paimodel,paiexperiment,paiservicetemplate,paiconnection , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Platform for AI. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
paiworkspace:GetConnection	GetConnection	get	All Resource ``	None	None
paiworkspace:ChangeResourceGroup	ChangeResourceGroup	update	*Workspace `acs:paiworkspace:{#regionId}:{#accountId}:workspace/{#WorkspaceId}`	None	None
paiworkspace:DeleteWorkspaceResource	DeleteWorkspaceResource		All Resource ``	None	None
paiworkspace:UpdateConfigs	UpdateConfigs	update	All Resource ``	None	None
paiworkspace:CreateWorkspace	CreateWorkspace	create	All Resource ``	None	None
paiworkspace:DeleteWorkspace	DeleteWorkspace	delete	*Workspace `acs:paiworkspace:{#regionId}:{#accountId}:workspace/{#WorkspaceId}`	None	None
paiworkspace:DeleteConfig	DeleteConfig	delete	All Resource ``	None	None
paiworkspace:ListPermissions	ListPermissions	list	All Resource ``	None	None
paiworkspace:ListConfigs	ListConfigs	list	All Resource ``	None	None
paiworkspace:GetMember	GetMember	get	All Resource ``	None	None
paiworkspace:CreateMember	CreateMember		All Resource ``	None	None
paiworkspace:GetDefaultWorkspace	GetDefaultWorkspace	get	All Resource ``	None	None
paiworkspace:CreateWorkspaceResource	CreateWorkspaceResource		All Resource ``	None	None
paiworkspace:GetConfig	GetConfig	get	All Resource ``	None	None
paiworkspace:RemoveMemberRole	RemoveMemberRole		All Resource ``	None	None
paiworkspace:ValidateConnection	ValidateConnection	none	All Resource ``	None	None
paiworkspace:UpdateWorkspace	UpdateWorkspace	update	*Workspace `acs:paiworkspace:{#regionId}:{#accountId}:workspace/{#WorkspaceId}`	None	None
paiworkspace:UpdateDefaultWorkspace	UpdateDefaultWorkspace		All Resource ``	None	None
paiworkspace:ListMembers	ListMembers	list	All Resource ``	None	None
paiworkspace:AddMemberRole	AddMemberRole		All Resource ``	None	None
paiworkspace:DeleteMembers	DeleteMembers		All Resource ``	None	None
paiworkspace:DeleteConnection	DeleteConnection	delete	All Resource ``	None	None
paiworkspace:ListResources	ListResources	list	All Resource ``	None	None
paiworkspace:ListWorkspaces	ListWorkspaces	list	All Resource ``	None	None
paiworkspace:GetWorkspace	GetWorkspace	get	*Workspace `acs:paiworkspace:{#regionId}:{#accountId}:workspace/{#WorkspaceId}`	None	None
paiworkspace:CreateConnection	CreateConnection	create	All Resource ``	None	None
paiworkspace:ListConnections	ListConnections	list	All Resource ``	None	None
paiworkspace:ListWorkspaceUsers	ListWorkspaceUsers	list	*Workspace `acs:paiworkspace:{#regionId}:{#accountId}:workspace/{#WorkspaceId}`	None	None
paiworkspace:UpdateWorkspaceResource	UpdateWorkspaceResource		All Resource ``	None	None
paiworkspace:UpdateConfig	UpdateConfig	update	All Resource ``	None	None
paiworkspace:UpdateConnection	UpdateConnection	update	All Resource ``	None	None
pai:SetUserConfigs	SetUserConfigs	create	All Resource ``	None	None
pai:ListQuotas	ListQuotas	list	All Resource ``	None	None
pai:CreateOrder	CreateProductOrders	create	All Resource ``	None	None
pai:ListProducts	ListProducts	list	All Resource ``	None	None
pai:DeleteUserConfig	DeleteUserConfig	delete	All Resource ``	None	None
pai:AdministratePAI	GetPermission	get	All Resource ``	None	None
pai:ListUserConfigs	ListUserConfigs	list	All Resource ``	None	None
pai:ListFeatures	ListFeatures	list	All Resource ``	None	None
paiimage:ListImages	ListImages	list	All Resource ``	None	None
paiimage:AddImageLabels	AddImageLabels	create	All Resource ``	None	None
paiimage:GetImage	GetImage	get	All Resource ``	None	None
paiimage:AddImage	AddImage	create	All Resource ``	None	None
paiimage:PublishImage	PublishImage	update	All Resource ``	None	None
paiimage:ListImageLabels	ListImageLabels	list	All Resource ``	None	None
paiimage:RemoveImageLabels	RemoveImageLabels	delete	All Resource ``	None	None
paiimage:CreateImageBuild	CreateImageBuild	create	All Resource ``	None	None
paiimage:RemoveImage	RemoveImage	delete	All Resource ``	None	None
paicodesource:UpdateCodeSource	UpdateCodeSource	update	All Resource ``	None	None
paicodesource:ListCodeSources	ListCodeSources	list	All Resource ``	None	None
paicodesource:PublishCodeSource	PublishCodeSource	update	All Resource ``	None	None
paicodesource:DeleteCodeSource	DeleteCodeSource	delete	All Resource ``	None	None
paicodesource:GetCodeSource	GetCodeSource	get	All Resource ``	None	None
paicodesource:CreateCodeSource	CreateCodeSource	create	All Resource ``	None	None
paidataset:ListDatasetFileMetas	ListDatasetFileMetas	list	All Resource ``	None	None
paidataset:DeleteDataset	DeleteDataset	delete	All Resource ``	None	None
paidataset:UpdateDatasetJobConfig	UpdateDatasetJobConfig	update	All Resource ``	None	None
paidataset:CreateDatasetLabels	CreateDatasetLabels	create	All Resource ``	None	None
paidataset:GetDatasetFileMeta	GetDatasetFileMeta	get	All Resource ``	None	None
paidataset:UpdateDataset	UpdateDataset	update	All Resource ``	None	None
paidataset:GetDatasetFileMetasStatistics	GetDatasetFileMetasStatistics	get	All Resource ``	None	None
paidataset:CreateDatasetJob	CreateDatasetJob	create	All Resource ``	None	None
paidataset:ListDatasetJobConfigs	ListDatasetJobConfigs	get	All Resource ``	None	None
paidataset:CreateDatasetVersion	CreateDatasetVersion	create	All Resource ``	None	None
paidataset:GetDatasetJob	GetDatasetJob	get	All Resource ``	None	None
paidataset:GetDatasetJobConfig	GetDatasetJobConfig	get	All Resource ``	None	None
paidataset:GetDataset	GetDataset	get	All Resource ``	None	None
paidataset:CreateDataset	CreateDataset	create	All Resource ``	None	None
paidataset:CreateDatasetFileMetas	CreateDatasetFileMetas	create	All Resource ``	None	None
paidataset:DeleteDatasetVersionLabels	DeleteDatasetVersionLabels	delete	All Resource ``	None	None
paidataset:UpdateDatasetVersion	UpdateDatasetVersion	update	All Resource ``	None	None
paidataset:UpdateDatasetFileMetas	UpdateDatasetFileMetas	update	All Resource ``	None	None
paidataset:PublishDataset	PublishDataset	update	All Resource ``	None	None
paidataset:GetDatasetVersion	GetDatasetVersion	get	All Resource ``	None	None
paidataset:DeleteDatasetLabels	DeleteDatasetLabels	delete	All Resource ``	None	None
paidataset:CreateDatasetJobConfig	CreateDatasetJobConfig	create	All Resource ``	None	None
paidataset:StopDatasetJob	StopDatasetJob	none	All Resource ``	None	None
paidataset:CreateDatasetVersionLabels	CreateDatasetVersionLabels	create	All Resource ``	None	None
paidataset:ListDatasets	ListDatasets	list	All Resource ``	None	None
paidataset:ListDatasetJobs	ListDatasetJobs	get	All Resource ``	None	None
paidataset:DeleteDatasetJobConfig	DeleteDatasetJobConfig	delete	All Resource ``	None	None
paidataset:DeleteDatasetVersion	DeleteDatasetVersion	delete	All Resource ``	None	None
paidataset:ListDatasetVersions	ListDatasetVersions	list	All Resource ``	None	None
paimodel:CreateModel	CreateModel	create	All Resource ``	None	None
paimodel:DeleteModel	DeleteModel	delete	All Resource ``	None	None
paimodel:GetModelVersion	GetModelVersion	get	All Resource ``	None	None
paimodel:ListModelVersions	ListModelVersions	list	All Resource ``	None	None
paimodel:CreateModelVersion	CreateModelVersion	create	All Resource ``	None	None
paimodel:CreateModelVersionLabels	CreateModelVersionLabels	create	All Resource ``	None	None
paimodel:DeleteModelVersion	DeleteModelVersion	delete	All Resource ``	None	None
paimodel:DeleteModelLabels	DeleteModelLabels	delete	All Resource ``	None	None
paimodel:UpdateModelVersion	UpdateModelVersion	update	All Resource ``	None	None
paimodel:UpdateModel	UpdateModel	update	All Resource ``	None	None
paimodel:CreateModelLabels	CreateModelLabels	create	All Resource ``	None	None
paimodel:DeleteModelVersionLabels	DeleteModelVersionLabels	delete	All Resource ``	None	None
paimodel:ListModels	ListModels	list	All Resource ``	None	None
paimodel:GetModel	GetModel	get	All Resource ``	None	None
paiexperiment:SetExperimentLabel	SetExperimentLabels	create	All Resource ``	None	None
paiexperiment:GetRun	GetRun	get	All Resource ``	None	None
paiexperiment:DeleteExperiment	DeleteExperiment	delete	All Resource ``	None	None
paiexperiment:GetExperiment	GetExperiment	get	All Resource ``	None	None
paiexperiment:ListRuns	ListRuns	none	All Resource ``	None	None
paiexperiment:DeleteExperimentLabel	DeleteExperimentLabel	delete	All Resource ``	None	None
paiexperiment:ListExperiments	ListExperiment	list	All Resource ``	None	None
paiexperiment:UpdateExperiment	UpdateExperiment	update	All Resource ``	None	None
paiexperiment:ListRunMetrics	ListRunMetrics	get	All Resource ``	None	None
paiexperiment:DeleteRunLabel	DeleteRunLabel	delete	All Resource ``	None	None

Resource

The following table lists the resources defined by Platform for AI. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
Connection	acs:paiworkspace:{#regionId}:{#accountId}:connection/*
Workspace	acs:paiworkspace:{#regionId}:{#accountId}:workspace/{#WorkspaceId} acs:paiworkspace:{#Region}:{#AccountId}:workspace/{#WorkspaceId}

Condition

Platform for AI does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: