Platform For AI:Create and manage workspaces

Compute resources

You can associate or disassociate the following types of compute resources:

For more information about AI compute resources, see AI computing resources.

Members and roles

When multiple RAM users need to manage, develop, and perform O&M in the same workspace, you must add them as workspace members and assign appropriate roles.

PAI provides system default roles (basic roles and compute resource roles). You can view the mapping between roles and permissions. Assign roles to members as needed, or create custom roles.

Supported role types:

Member and role relationships:

• Each member must have at least one role.

• The Owner role cannot be removed. The Alibaba Cloud account or RAM user that creates a workspace automatically becomes the Owner of that workspace, with permissions to manage workspace members, reference and manage resource groups, and manage all assets within the workspace.

• DataWorks and PAI workspaces are interconnected. The Workspace Administrator, Visitor, and MaxCompute Developer roles in PAI correspond to the Workspace Administrator, Visitor, and Developer roles in DataWorks, respectively. These three roles are shared between the two services. If a member is removed from one of these roles in PAI and that role is the member's last role in the DataWorks workspace, DataWorks automatically removes the member, which triggers Entity transfer.

Resource visibility settings:

DSW instances, DLC jobs, and EAS services in a PAI workspace all support visibility settings:

• Visible to Creator Only: Only the resource creator and workspace administrators can view the resource.

• Visible in Workspace: All members in the workspace can view the resource.

Security recommendations for shared workspaces:

Workspace administrators can view all member resources in the workspace. Therefore, we recommend against sharing a single workspace across multiple companies or teams. If sharing is necessary, follow these guidelines:

1. Strictly control member roles. Do not assign the Workspace Administrator role to members from other companies.

2. Set sensitive resources to Visible to Creator Only to reduce the exposure scope.

Scheduling settings

Administrators can configure resource scheduling policies based on business requirements. For more information, see Scheduling configuration.

Event notification settings

Configure event notifications to track and monitor the status of DLC jobs, workflow jobs, and DSW instances, or to automatically trigger downstream operations when model version statuses change. For more information, see Event notification configuration.

Storage path settings

• We recommend that you configure an OSS path as the default storage path for storing temporary data and models generated during jobs. This facilitates unified management.

• If a Data Storage is also configured in Designer, the Data Storage path takes precedence when you run workflows.

SLS log forwarding settings

You can forward DLC job logs to Simple Log Service (SLS) for custom analysis. For more information, see Subscribe to job logs.

General settings

• Public Resource Group:

  • Default Network Configuration: Administrators can configure default network settings such as VPC and security group in the workspace. Centralized configuration by administrators helps control permissions.

• DLC Configurations:

  • Go to Node Container: Controls whether users can access the compute node container of a DLC job for debugging or troubleshooting. When enabled, authorized users can access the container through a terminal.

• DSW settings:

  • SSH Logon to Instance from Internet: Specifies whether users can log on to instances over SSH through the public network.

  • Open Instance from Internet: Specifies whether users can access DSW instances from the public network.

  • Rate Limit for Internet Access: Specifies whether to limit the network bandwidth of DSW instances when a dedicated gateway is used for public network access. This prevents a single instance from consuming excessive bandwidth and ensures the stability of shared resources.

Q: Why do I get a "Name already exists" error when creating a workspace?

If the name appears to be available but PAI reports that it already exists, a DataWorks workspace with the same name may already exist. Because PAI and DataWorks workspaces share the same underlying infrastructure, use a different name to ensure uniqueness.

Q: No data appears on the list page when configuring SLS log forwarding

Error message: Unauthorized error, with the message denied by sts or ram, action: log:ListProject, resource: acs:log......

Cause: The user does not have read permissions on the SLS Logstore.

Solution: Grant the user Logstore permissions by performing the following steps:

1. Log on to the RAM console. In the left-side navigation pane, choose Permissions > Grants, and then click Grant Permission.

2. Set the principal to the RAM user or RAM role, and select AliyunLogFullAccess as the authorization policy.

3. For finer-grained SLS permissions, go to the Log Service console, open the target project, click the More Applications icon, and then select Permission Assistant from the menu to generate a custom RAM policy.

Q: Request fails when configuring SLS log forwarding

Error message: Modify configuration failed [SLS] cannot init client for sis service: com.alibaba.pai.workspace.common.exception.ServiceExceptionV2: No Privilege error: {0}

Cause: The user does not have permissions to enable or disable SLS log forwarding.

Solution: Log on to the RAM console and configure a custom authorization policy to grant the user log forwarding permissions.

Configure the custom authorization policy as follows. For more information, see Create a custom policy:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "log:GetProductDataCollection",
                "log:CloseProductDataCollection",
                "log:OpenProductDataCollection"
            ],
            "Resource": "*"
        }
    ]
}

For more granular control, modify the Resource field to specify the target resources.

Q: How do I restore a deleted workspace or clean up residual resources?

After you delete a workspace, the data sources and compute resources in the workspace are moved to the recycle bin and retained for 14 days.

Uncleaned resources such as DSW instances, DLC jobs, and EAS services continue to incur charges until they are permanently deleted along with the workspace after 14 days. To stop billing immediately, restore the workspace first and then clean up the resources.

Procedure:

1. Go to the recycle bin through one of the following entry points and restore the target workspace.

   • The Go to Workspace Recycle Bin in the upper-right corner of the PAI Workspaces page.

   • The DataWorks console recycle bin.

   Important

   After you go to the recycle bin, switch to the region where the deleted workspace was located in the upper-left corner to find the target workspace.

2. After you restore the workspace, clean up the resources under it, such as DSW instances and EAS services.

3. After you confirm that all billable resources are deleted, go to the Workspaces page in the PAI console and delete the target workspace.

Troubleshoot hidden resources: After you restore a workspace, if you cannot find certain resources in the EAS service list (for example, EAS services created through ModelScope authorization), use the following methods to troubleshoot:

• Use the ActionTrail console to verify the creation status of the resource.

• Switch to the correct workspace and check the EAS instance list for running instances.