:RAM permissions

RAM users and RAM roles need specific permissions to manage Model Studio, use knowledge bases, or call data management and prompt APIs. This topic covers Model Studio's RAM permission policies.

RAM permissions: Divided into system policies and custom policies. System policies cover common scenarios for quick setup. For granular control (e.g., restricting specific RAM users from calling certain APIs), use custom policies or combine both policy types. See Overview of RAM policies.

System policies

Alibaba Cloud-managed permission collections. RAM users and RAM roles can use but not modify them. Model Studio provides the following system policies:

See Permission management for guidance on using and choosing system policies.

By default, accounts that activate Model Studio have AliyunBailianFullAccess and permissions for all workspaces.

• AliyunBailianFullAccess: Full Permission management and data permissions.

  Note: Data permissions ≠ data layer permissions. This policy does not grant workspace permissions.

  • Management layer: Full permissions, including:

    • Manage workspaces, accounts, and API keys.
    • Activate new features in Model Studio.
    • Essential permissions for subscription billing, see FAQ.

  • Data: Management permissions, including:

    • Create, manage, and access structured knowledge bases.
    • Use hit test for knowledge bases.
    • Call all API catalog APIs.

• AliyunBailianReadOnlyAccess: Limited management and data permissions (read-only).

  Note: Data permissions ≠ data layer permissions. This policy does not grant workspace permissions.

  • Management layer: Read-only permissions, including:

    • Read-only access to workspaces, accounts, and API keys.
    • Cannot activate new features.
    • Essential permissions for subscription billing, see FAQ.

  • Data: Read-only, including:

    • Cannot create, manage, or access structured knowledge bases.
    • Cannot use hit test for knowledge bases.
    • Cannot call APIs that modify data (add, delete, update), like Retrieve, AddFile, and CreateIndex.
    • Can call read-only API catalog APIs like DescribeFile and GetIndexJobStatus.

• AliyunBailianControlFullAccess: Limited management permissions (control).

  • Management layer: Control permissions, including:

    • Manage workspaces, accounts, and API keys.
    • Cannot activate new features.
    • Essential permissions for subscription billing, see FAQ.

• AliyunBailianControlReadOnlyAccess: Limited management permissions (read-only).

  • Management layer: Read-only permissions, including:

    • Read-only access to workspaces, accounts, and API keys.
    • Cannot activate new features.
    • Essential permissions for subscription billing, see FAQ.

• AliyunBailianDataFullAccess: Full data permissions.

  Note: Data permissions ≠ data layer permissions. This policy does not grant workspace permissions.

  • Data: Management permissions, including:

    • Create, manage, and access structured knowledge bases.
    • Use the hit test for knowledge bases.
    • Call all API catalog APIs.

• AliyunBailianDataReadOnlyAccess: Limited data permissions (read-only).

  Note: Data permissions ≠ data layer permissions. This policy does not grant workspace permissions.

  • Data: Read-only, including:

    • Cannot create, manage, or access structured knowledge bases.
    • Cannot use hit test for knowledge bases.
    • Cannot call APIs that modify data (add, delete, update), like Retrieve, AddFile, and CreateIndex.
    • Can call read-only API catalog APIs like DescribeFile and GetIndexJobStatus.

Custom policies

Alibaba Cloud accounts or RAM users with the AliyunRAMFullAccess policy can create and manage custom policies. Maintain, update, or delete these policies as needed.

Knowledge base and data management APIs support custom policies. Select necessary permissions from the list below to grant minimal authorization to RAM users. For the procedure, see Configure a custom policy.

Feature	API	Required permission	Permission description
Knowledge base	CreateIndex	sfm:CreateIndex	See The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below: Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation. API: The API that you can call to perform the action. Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete. Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective. For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy. For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy. Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services. Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions. Action Access level Resource type Condition key Dependent action sfm:CreateIndex create *All Resource * None None.
	GetIndexJobStatus	sfm:GetIndexJobStatus	See RAM authorization.
	SubmitIndexJob	sfm:SubmitIndexJob	See RAM authorization.
	SubmitIndexAddDocumentsJob	sfm:SubmitIndexAddDocumentsJob	See RAM authorization.
	Retrieve	sfm:Retrieve	See RAM authorization.
	ListIndexDocuments	sfm:ListIndexFiles	See RAM authorization.
	ListChunks	sfm:ChunkList	See RAM authorization.
	ListIndices	sfm:ListIndex	See RAM authorization.
	DeleteIndex	sfm:DeleteIndex	See RAM authorization.
	DeleteIndexDocument	sfm:DeleteIndexDocument	See RAM authorization.
Data management	ApplyFileUploadLease	sfm:ApplyFileUploadLease	See RAM authorization.
	AddFile	sfm:AddFile	See RAM authorization.
	DescribeFile	sfm:DescribeFile	See RAM authorization.

FAQ

What RAM permissions are required when activating new features like model calling using a RAM user (or RAM role)?

Feature	RAM permissions required
Model calling	Use the Alibaba Cloud account to grant the AliyunBailianFullAccess system policy for your RAM user (or RAM role) in the RAM console. Other management layer permissions are not applicable.
Paying subscription bills	Use the Alibaba Cloud account to grant the AliyunBSSOrderAccess system policy and one of the Permission management(AliyunBailianFullAccess, AliyunBailianReadOnlyAccess, AliyunBailianControlFullAccess, or AliyunBailianControlReadOnlyAccess) in the RAM console.