Platform For AI:Grant permissions for DLC

PAI workspace member roles

Missing workspace roles may prevent certain DLC features from appearing in the console or cause access denied errors when creating training jobs.

NAS (Network Attached Storage)

NAS is used for data storage in DLC training environments.

OSS

OSS is used for storing training data and model outputs.

Grant general DLC permissions to an Alibaba Cloud account

1. Log on to the PAI console. In the top navigation bar, select the target region. On the right side of the page, select the target workspace and click Enter DLC.

2. Grant the AliyunPAIDLCDefaultRole role.

   1. Click Go to Authorization.

      

   2. On the Cloud Resource Access Authorization page, click Agree to Authorization and wait for the success message.

3. Add the AliyunOSSFullAccess permission to the AliyunPAIDLCDefaultRole role.

   1. In the RAM console, go to Identity Management > Roles and find the AliyunPAIDLCDefaultRole role.

      

   2. In the Actions column, click Add Permissions.

   3. In the Add Permissions panel, configure the following parameters:

      Parameter	Description
      Resource Scope	Select Account Level. Permissions take effect across all resources in the current Alibaba Cloud account. To restrict permissions to a specific resource group, select Resource Group Level.
      Principal	The system pre-fills the current RAM role. No changes needed.
      Access Policy	In the search box, enter OSS and select the required policy from the results. The selected policy appears in the Selected list on the right.

      Important

      AliyunOSSFullAccess grants access to all OSS buckets in the account. If DLC only needs access to specific buckets, create a custom policy that restricts access to those buckets only, following the principle of least privilege.

   4. Click Confirm new authorization.

4. Add the PaiDlcOAuthPolicy permission to the AliyunPAIDLCDefaultRole role.

   1. In the RAM console, go to Permission Management > Policies and click Create Policy.

   2. On the Script Editor tab, paste the following policy document. For details on creating custom policies, see Create a custom policy on the Script tab.

      {
        "Version": "1",
        "Statement": [
          {
            "Action": [
              "ram:GetDefaultDomain",
              "ram:ListApplications",
              "ram:CreateApplication",
              "ram:ListAppSecretIds",
              "ram:GetAppSecret",
              "ram:CreateAppSecret",
              "ram:DeleteApplication",
              "ram:DeleteAppSecret"
            ],
            "Resource": [
              "*"
            ],
            "Effect": "Allow"
          }
        ]
      }

   3. Set Name to PaiDlcOAuthPolicy and complete the policy creation.

   4. Go to Identity Management > Roles, find AliyunPAIDLCDefaultRole, and click Add Permissions in the Actions column.

   5. In the Add Permissions panel, search for and select the PaiDlcOAuthPolicy policy.

      

5. Verify the authorization result. Click AliyunPAIDLCDefaultRole and confirm that all three policies are correctly attached to the role.

   

Grant PAI access to OSS and NAS using one-click authorization

PAI provides a one-click authorization method as an alternative to the manual steps above.

1. Log on to the PAI console.

2. In the left navigation pane, go to Activation and Authorization > All Cloud Product Dependencies. Locate the DLC section and find OSS and NAS.

3. In the Actions column, check the authorization status:

   • If not authorized: click One-click Authorization and follow the on-screen instructions.

   • If already authorized: click View Authorization Information to review the details.