Platform For AI:Cloud product dependencies and authorization: DSW

Authorize an account

DSW is a cloud-based IDE for machine learning that provides an interactive programming environment. When you use DSW for interactive modeling, you may need the following cloud services. Activate and authorize them in advance.

• PAI sub-product: DSW

  Account type	Scenario	Guidance
  Alibaba Cloud account	An Alibaba Cloud account has full DSW permissions by default. No additional authorization is required.	Not applicable
  RAM user (Recommended)	PAI provides different member roles. You can add a RAM user as a workspace member and assign a role with the required permissions. For the permissions of each role, see Appendix: Roles and permissions list.	Create and manage workspaces

Common operation permissions

Some DSW operations require specific API-level permissions that workspace role assignments do not automatically grant. These permissions are bound to individual resource IDs and must be explicitly included in a RAM policy.

• Dependent cloud services: OSS

  DSW depends on OSS for data storage. Activate OSS and grant the required permissions.

  Scenario	Description	Guidance
  Activate OSS	We recommend that you use an Alibaba Cloud account to activate OSS, as no additional authorization is required. To use a RAM user to activate OSS, grant the RAM user the AliyunOSSFullAccess permission.	Activation: Quick start Grant permissions to a RAM user: RAM Policy Common operations: Quick start
  Use OSS	When you use OSS: Authorization: OSS provides detailed RAM control policies. Grant specific operation permissions to RAM users as needed. Common operations: Create a bucket before you upload files to OSS.

Authorize the PAI service account

Grant DSW permissions to an Alibaba Cloud account

To ensure DSW works correctly, verify that your Alibaba Cloud account has general DSW permissions. These permissions are typically granted when you activate PAI and create a default workspace. Follow the instructions in Reference: Check if the AliyunPAIDSWDefaultRole role is attached to your account to verify whether your account has the required permissions. If not, follow the steps in this section to grant them.

1. Go to the DSW page.

   1. Log on to the PAI console.

   2. On the Overview page, select the target region.

   3. In the left navigation bar, click Workspaces, and on the Workspace List page, click the name of the target workspace to enter it.

   4. In the left-side navigation pane of the workspace, choose Model Training > Data Science Workshop (DSW) to open the DSW page.

2. Authorize the AliyunPAIDSWDefaultRole role.

   1. Click Create Instance.

   2. In the Grant Permissions dialog box, click Authorize Now.

   3. On the cloud resource access authorization page, click Agree to Authorization.

      On the cloud resource access authorization page, the system automatically configures the required service-linked role for DSW. No manual configuration is required.

Authorize PAI to access OSS and NAS

PAI provides one-click authorization to grant PAI access to dependent cloud products such as OSS and NAS. Follow these steps:

1. Log on to the PAI console.

2. In the left navigation bar, click Activation & Authorization > Dependent Services, and in the DSW section, find OSS and NAS.

3. In the Actions column, check the authorization status for OSS.

   • If it is not authorized, click Authorize Now in the Actions column and follow the on-screen instructions.

   • If it is already authorized, click View Authorization in the Actions column.

If you do not grant the AliyunPAIDLCAccessingOSSRole permission to access OSS, the following error may occur when you mount an OSS dataset:

root@dsw-xxx:/mnt/workspace# cd /mnt
root@dsw-xxx:/mnt# ls -ll
total 9
drw-rw-r--  0    99    99  512 Jan  1  1970 data
drwxr-xr-x  5 root root 4096 Dec 13 02:42 systemDisk
drwxr-xr-x  5 root root 4096 Dec 13 02:42 workspace
root@dsw-xxx:/mnt# cd data
root@dsw-xxx:/mnt/data# ls -ll
ls: reading directory '.': Input/output error
total 0
root@dsw-xxx:/mnt/data#

Grant VPC permissions for DSW internet access

When you enable internet access for a DSW instance, PAI requires permissions to access VPC resources such as NAT gateways. The following VPC permission must remain permanently granted. Do not revoke it after granting.

Granting the permission to a sub-account: If a RAM user (sub-account) receives a "no permission" error when enabling internet access for a DSW instance, the primary Alibaba Cloud account must create a custom policy in the RAM console and grant vpc:ListEnhanhcedNatGatewayAvailableZones to the RAM user.

Avoiding availability zone errors: When you configure internet access, verify the availability zone (AZ) where your DSW resources reside and select the same AZ in the console to prevent mismatch errors.

Reference: Check for the AliyunPAIDSWDefaultRole role

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Identity Management > Roles.

3. On the Roles page, enter AliyunPAIDSWDefaultRole in the search box and press Enter.

   • If the role is found, the DSW service-linked role is already authorized.

   • If the role is not found, you must authorize it. For instructions, see Grant general DSW permissions to an Alibaba Cloud account.

FAQ

Q: What should I do if one-click authorization shows that a role does not exist or the authorization is incomplete?

When you use the one-click authorization feature in the PAI console, you may see a prompt indicating that a RAM role does not exist or that authorization is incomplete. Follow the steps below based on your scenario.

Scenario 1: A specified RAM role (such as AliyunODPSPAIDefaultRole) does not exist or authorization is incomplete

1. Go to the RAM console.

2. Delete the specified role (for example, AliyunODPSPAIDefaultRole).

3. Return to the PAI console and click One-click Authorization again to complete the authorization.

Scenario 2: You are prompted to delete AliyunPAIDSWDefaultRole, but cannot find the role in the RAM console

1. In the PAI console dialog, confirm the authorization.

2. Refresh the page.

3. If the warning persists, perform One-click Authorization again.

Related documentation

After you complete the authorization, you can create a DSW instance and use the DSW development environment to develop and train AI models. For instructions, see Create a DSW instance.