Configure a RAM role for DLC to obtain temporary STS credentials - Platform For AI

When your DLC jobs access other cloud resources, you must configure an AccessKey pair for authentication. By associating a RAM role, your DLC job can use temporary credentials from Security Token Service (STS) to access other cloud services, eliminating the need for long-term AccessKey pairs and reducing the risk of key leakage. This topic describes how to create a RAM role, grant permissions to DLC, and obtain temporary access credentials by using the RAM role.

Benefits

A RAM role is a trusted entity that cloud services can assume to handle cross-service access. Using a RAM role for authentication and access control offers the following benefits:

Security: Temporary STS credentials replace long-term AccessKey pairs, reducing the risk of key leakage.
Control and convenience: You can precisely control developer access to cloud resources by modifying the RAM role's permission policy.

Limitations

You can associate only one RAM role with a single DLC job.

Configuration methods

When you create a DLC job, configure a RAM role and obtain temporary STS credentials.

Configure a RAM role for DLC

PAI default role

The default role of PAI is based on the service role AliyunPAIDLCDefaultRole. It has fine-grained permissions to access only MaxCompute and Object Storage Service (OSS). A temporary credential issued from this role has the same permissions as the Alibaba Cloud account when accessing MaxCompute tables. When accessing OSS, it can only access the default OSS bucket configured for the current workspace.

After granting the default role of PAI, you can obtain temporary credentials within the job to access basic development resources without granting excessive permissions or creating an additional RAM role.

Use cases

With the default role of PAI granted, you do not need to configure an AccessKey pair in the following scenarios:
- Submitting a job by using the PyODPS SDK to a MaxCompute project where the job owner has execution permissions.
- Accessing data in the default OSS bucket configured for the current workspace by using the OSS SDK.
Configuration method

When you create a DLC job, in the Roles and Permissions section, select Default Roles of PAI as the Instance RAM Role. In the Roles and Permissions section, set Visibility to Visible within the workspace, and set Instance RAM Role to default role of PAI.

After configuring the RAM role, you must obtain a temporary access credential by using the associated RAM role.

Custom role

If the permissions of the temporary credentials from the default role of PAI do not meet your requirements, you can create a RAM role and customize its permission policy. Follow these steps:

Log on to the RAM console and create a RAM role.

Configure the following key parameters:
- Principal Type: Select Cloud Services.
- Principal Name: Select PAI.
Grant permissions to the created RAM role.

Attach a system or custom policy to the RAM role to define its permissions. For example, grant the AliyunOSSReadOnlyAccess policy to the RAM role to grant read-only access to OSS.

If you are a RAM user, contact your Alibaba Cloud account administrator to grant your RAM user the permissions to use the RAM role. For more information, see Manage RAM user permissions. The following code provides an example of a custom permission policy:
```
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::*:role/${RoleName}"
    }
  ]
}
```
Replace ${RoleName} with the name of the RAM role associated with the DLC job.

Submit the DLC job and associate the RAM role. In the Roles and Permissions section, configure the following key parameters. For information about other parameters, see Create a training job.

Parameter	Description
Instance RAM Role	Select Custom Role.
RAM Role	Select the RAM role that you created in the preceding steps. The temporary credential inherits the permissions of this custom role when accessing cloud services.

After configuring the RAM role, you must obtain a temporary access credential by using the associated RAM role.

No associated role

If you do not need to use an AccessKey pair to access data, we recommend that you do not associate a role. When you create a DLC job, in the Roles and Permissions section, select Does Not Associate Role as the Instance RAM Role. In the Roles and Permissions section, set Visibility to Visible to creator only and Instance RAM Role to Do not associate role.

Obtain a temporary access credential

If you assign the default role of PAI or a custom role to a DLC job, you can obtain temporary credentials in one of the following ways:

Use the credentials tool

The Alibaba Cloud Credentials tool obtains temporary credentials from STS by calling a local service that is automatically injected when the job is created. The credentials are automatically refreshed on a regular basis.

When you create a DLC job, complete the following key configurations:

Install the Alibaba Cloud Credentials tool.

In the Third-party Library Settings section, select Third-party Libraries and enter alibabacloud_credentials in the text box to install the Alibaba Cloud Credentials tool.

Note
You can skip this step if the library is pre-installed in the image.
Configure a script file.

The following code provides a Python script example. For more examples in other SDK languages, see Best practices for using access credentials to access Alibaba Cloud OpenAPI. You can use the Source Code Repositories or Mount Configuration option to upload the script file to the DLC environment.
```
from alibabacloud_credentials.client import Client as CredClient
from alibabacloud_credentials.models import Config as CredConfig
credentialsConfig = CredConfig(
    type='credentials_uri'
)
credentialsClient = CredClient(credentialsConfig)
```

Access the local service

When you create a DLC job, run the following command in the Startup Command field to obtain temporary credentials from the automatically injected local service.

# Obtain a temporary access credential for the instance RAM role.
curl $ALIBABA_CLOUD_CREDENTIALS_URI

The following example shows a sample output:

{
	"Code": "Success",
	"AccessKeyId": "STS.N*********7",
	"AccessKeySecret": "3***************d",
	"SecurityToken": "DFE32G*******"
	"Expiration": "2024-05-21T10:39:29Z"
}

Field descriptions:

SecurityToken: The temporary security token of the RAM role.
Expiration: The expiration time of the temporary credentials.

Access a local file

In the DLC container, read the file at the specified path to obtain the temporary credentials for the RAM role. This file is automatically injected and periodically refreshed by PAI. The file path is /mnt/.alibabacloud/credentials. The following code shows the file content:

{
	"AccessKeyId": "STS.N*********7",
	"AccessKeySecret": "3***************d",
	"SecurityToken": "DFE32G*******"
	"Expiration": "2024-05-21T10:39:29Z"
}

Examples

Access ODPS

When you create a DLC job, complete the following key configurations:

Install required libraries.

In the Third-party Library Settings section, configure the Third-party Libraries to install the Alibaba Cloud Credentials tool and the ODPS SDK.
```
alibabacloud_credentials
pyodps
```
Note
You can skip this step if these libraries are pre-installed in the image.

Configure a script file.

The following code provides a Python script example. You can use the Source Code Repositories or Mount Configurations option to upload the script file to the DLC environment and configure a Mount Path, such as /mnt/data/.

from alibabacloud_credentials import providers
from odps.accounts import CredentialProviderAccount
from odps import ODPS
if __name__ == '__main__':
    account = CredentialProviderAccount(providers.DefaultCredentialsProvider())
    o = ODPS(
        account=account,
        project="{odps_project}",  # Replace with your project name.
        endpoint="{odps_endpoint}"  # Replace with the endpoint of the region where your project is located.
    )
    for t in o.list_tables():
        print(t)

Configure the startup command.

Set the Startup Command to the command that runs the script. For example, python /mnt/data/xx.py.
Configure role information.

For Instance RAM Role, select Default Roles of PAI.

Access OSS

When you create a DLC job, complete the following key configurations:

Install required libraries.

In the Third-party Library Settings section, configure the Third-party Libraries to install the Alibaba Cloud Credentials tool and the OSS SDK.
```
alibabacloud_credentials
oss2
```
Note
You can skip this step if these libraries are pre-installed in the image.

Configure a script file.

import oss2
from alibabacloud_credentials.client import Client
from alibabacloud_credentials import providers
from itertools import islice
auth = oss2.ProviderAuth(providers.DefaultCredentialsProvider())
bucket = oss2.Bucket(auth,
                     '{oss_endpoint}',  # Replace with the endpoint of the region where your OSS bucket is located.
                     '{oss_bucket}'  # Replace with the name of your OSS bucket.
         )
for b in islice(oss2.ObjectIterator(bucket), 10):
    print(b.key)

Configure the startup command.

Set the Startup Command to the command that runs the script. For example, python /mnt/data/xx.py.
Configure role information.

For Instance RAM Role, select Default Roles of PAI.

FAQ

Error when selecting a custom role

Error message: check permission for ram role failed or check permission for RAM user failed.

You can log on to the RAM console to verify that the role exists.
- If the role does not exist, change the Instance RAM Role to an existing role.
- If the role exists, contact your Alibaba Cloud account administrator to grant your RAM user the permissions to use the role. For more information, see Manage RAM user permissions. The following is a sample custom permission policy. Replace ${RoleName} with the name of your RAM role.
```
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::*:role/${RoleName}"
    }
  ]
}
```

Error message: Failed to assume role for user.

This error typically occurs because no trust policy is configured for your role. Add a trust policy by following these steps:

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click the name of the target RAM role.
On the Trust Policy tab, click Edit Trust Policy.

In the editor, modify the trust policy, and then click OK.

Assume that the original trust policy of the role is:

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "RAM": [
          "acs:ram::aaa:root"
        ],
        "Service": [
          "xxx.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}

The new policy content is as follows:

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "RAM": [
          "acs:ram::aaa:root"
        ],
        "Service": [
          "xxx.aliyuncs.com",
          "pai.aliyuncs.com" 
        ]
      }
    }
  ],
  "Version": "1"
}