Alibaba Cloud Model Studio:RAM permissions

RAM permissions: can be divided into system policies and custom policies. System policies cover common scenarios and can help you configure permissions swiftly. For more granular control, such as restricting specific RAM users from calling certain APIs in the API catalog, you can use custom policies. Or, you can use the two policy types together, see Policy overview.

System policies

Permission collections created, managed, and updated by Alibaba Cloud. RAM users or RAM roles can use but not modify them. Model Studio provides the following system policies:

• AliyunBailianFullAccess: Grants full Management layer and data permissions.

  Note: Data permissions are different from data layer permissions. This policy does not grant workspace permissions.

  • Management layer: All permissions, including:

    • Manage workspaces, accounts, and all API keys.

    • Activate new features in Model Studio.

    • The essential permissions for paying subscription bills, see FAQ.

  • Data: Manage permissions, including:

    • Create, manage, and access structured knowledge base.

    • Use the hit test feature of knowledge bases.

    • Call all APIs in the API catalog.

• AliyunBailianReadOnlyAccess: Grants limited management layer permissions (read-only) and limited data permissions (read-only).

  Note: Data permissions are different from data layer permissions. This policy does not grant workspace permissions.

  • Management layer: Limited permissions (read-only), including:

    • Read-only access to workspaces, accounts, and all API keys.

    • Cannot activate new features.

    • The essential permissions for paying subscription bills, see FAQ.

  • Data: Read-only permissions, including:

    • Cannot create, manage, and access structured knowledge base.

    • Cannot use the hit test feature of knowledge bases.

    • Cannot call APIs that add, delete, or modify data in the API catalog, such as Retrieve, AddFile, and CreateIndex.

    • Can call read-only APIs in the API catalog, such as DescribeFile and GetIndexJobStatus.

• AliyunBailianControlFullAccess: Grants limited management layer permissions (control).

  • Management layer: Limited permissions (control), including:

    • Manage workspaces, accounts, and all API keys.

    • Cannot activate new features.

    • The essential permissions for paying subscription bills, see FAQ.

• AliyunBailianControlReadOnlyAccess: Grants limited management layer permissions (read-only).

  • Management layer: Limited permissions (read-only), including:

    • Read-only access to workspaces, accounts, and all API keys.

    • Cannot activate new features.

    • The essential permissions for paying subscription bills, see FAQ.

• AliyunBailianDataFullAccess: Grants data permissions.

  Note: Data permissions are different from data layer permissions. This policy does not grant workspace permissions.

  • Data: Manage permissions, including:

    • Create, manage, and access structured knowledge bases.

    • Use the hit test feature of knowledge bases.

    • Call all APIs in the API catalog.

• AliyunBailianDataReadOnlyAccess: Grants limited data permissions.

  Note: Data permissions are different from data layer permissions. This policy does not grant workspace permissions.

  • Data: Read-only permissions, including:

    • Cannot create, manage, and access structured knowledge base.

    • Cannot use the hit test feature of knowledge bases.

    • Cannot call APIs that add, delete, or modify data in the API catalog, such as Retrieve, AddFile, and CreateIndex.

    • Can call read-only APIs in the API catalog, such as DescribeFile and GetIndexJobStatus.

Custom policies

If you are using the Alibaba Cloud account or a RAM user with the AliyunRAMFullAccess system policy, you can create and manage custom policies. You can maintain custom policies by yourself and update or delete the permissions at any time.

APIs related to knowledge base and data management support custom policies. Select the necessary permissions from the list below to create custom policies and grant minimal authorization to RAM users. For the procedure, see Grant data permissions to a RAM user.

FAQ