Platform For AI:Permission management

Activate and purchase PAI resources

To activate PAI and purchase resources, add the AliyunPAIFullAccess policy.

Use PAI sub-services

PAI provides workspace-based permission management. Add RAM users as workspace members and assign roles like Resource Administrator (Alibaba Cloud Account/through RAM Authorization), Workspace Administrator/Owner, Algorithm Developer, Algorithm O&M Engineer, Labeling Administrator, or Visitor. See Appendix: Role and permission list for role permissions.

• For iTAG, see iTAG personnel assignment for further permission settings.

• EAS provides system policies to authorize RAM users. For example:

  • EAS management permissions: AliyunPAIEASFullAccess

  • EAS read-only permissions: AliyunPAIEASReadOnlyAccess

• Most AI Acceleration features only require operation permissions of the corresponding sub-services (model development, training, and inference). Dataset acceleration requires AliyunPAIFullAccess and AliyunDatasetAccFullAccess permissions.

Activate and use other cloud services

PAI depends on these cloud services:

Workspace members have partial permissions for dependent cloud services based on their assigned roles. If permission issues occur when activating or using cloud services, refer to this table for authorization operations.

Example: To use a RAM user to activate OSS, add the system policy AliyunOSSFullAccess. For permission issues when using OSS, refer to OSS RAM Policy for RAM authorization.

1. Log on to the PAI console.

2. In the left navigation pane, click Activation & Authorization > Dependent Services, and find OSS under Designer.

3. Check authorization status in the Actions column.

   • If not authorized, click Authorize in the Actions column and follow the instructions.

   • If authorized, click View Authorization in the Actions column to view details.

Add a policy to a RAM user

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the required RAM user, and click Add Permissions in the Actions column.

   

   You can also select multiple RAM users and click Add Permissions in the lower part of the page to grant permissions to the RAM users at a time.

4. In the Grant Permission panel, add permissions for the RAM user:

   • Resource Scope: Select Account.

   • Policy: Select the AliyunPAIFullAccess policy.

     Important

     A RAM user with this policy can purchase, create, and delete all resources and has administrator permissions on all workspaces. Use with caution.

     Refer to Create a custom policy to set minimum required policies for RAM users.

5. Click Grant permissions.

6. Click Close.

Create a custom policy

1. Log on to the RAM console as a RAM administrator.

2. In the left navigation pane, choose Permissions > Policies.

3. Click Create Policy, choose the JSON tab, and configure this policy (grants RAM users permission to view all EAS model services).

   Important

   Follow the principle of least privilege when specifying policy documents.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "eas:ListServices"
               ],
               "Resource": "*"
           }
       ]
   }

For more information, see Create a custom policy in script editor mode.