Secure EAS Access with Fine-Grained RAM User Permissions - Platform for AI - Alibaba Cloud - Platform For AI

By default, Resource Access Management (RAM) users cannot access EAS. An Alibaba Cloud account must grant them permissions. You can use system policies for full or read-only access, or create custom policies for fine-grained authorization.

Background information

EAS provides three authorization methods. You can choose one based on your requirements:

Grant a RAM user administrative permissions for EAS

EAS provides the AliyunPAIEASFullAccess system policy, which grants administrative permissions for EAS. After you attach this policy, the RAM user has full access to EAS.
Grant a RAM user read-only permissions for EAS

EAS provides the AliyunPAIEASReadOnlyAccess system policy, which grants read-only permissions. After you attach this policy, the RAM user can query and browse deployed EAS services.
Grant a RAM user fine-grained permissions

If the two system policies do not meet your requirements, you can create a custom policy to grant fine-grained permissions to the RAM user. For example, you can grant permissions to query or modify only specific deployed services or dedicated resource groups.

Grant a RAM user administrative permissions for EAS

After you grant administrative permissions, the RAM user has full permissions to operate EAS.

Log on to the RAM console.
Grant the administrative permissions for EAS to the RAM user. For more information, see Manage RAM user permissions.
Where:
- Set Resource Scope to Account Level.
- Set Access Policy to the system policy AliyunPAIEASFullAccess.
  
  Note
  Because OSS permissions are security-sensitive, they are not included in the AliyunPAIEASFullAccess policy. If the RAM user needs to use OSS, you must grant OSS permissions to the user separately. For more information, see RAM Policy Editor.

Grant a RAM user read-only permissions for EAS

After you grant read-only permissions, the RAM user can query and browse deployed EAS services, but cannot modify or delete them.

Log on to the RAM console.
Grant the read-only permissions for EAS to the RAM user. For more information, see Manage RAM user permissions.
Where:
- Set Resource Scope to Account Level.
- Set Access Policy to the system policy AliyunPAIEASReadOnlyAccess.

Grant a RAM user fine-grained permissions

To grant a RAM user fine-grained permissions to query or modify deployed services or dedicated resource groups, you can create and attach a custom policy.

Log on to the RAM console.

Create a custom policy. For more information, see Create a custom policy in script edit mode.

Important

You must carefully define the access policy based on the permissions that the RAM user requires.

For example, you can configure the script as follows.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "eas:CreateInstance",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "eas:DescribeService",
                "eas:DeleteService",
                "eas:UpdateService",
                "eas:UpdateServiceVersion"
            ],
            "Resource": [
                "acs:eas:<region>:<uid>:service/eas-m-xxx1",// This is an example. Modify it based on the access policy description below.
                "acs:eas:<region>:<uid>:service/eas-m-xxx2"
            ],
        }
    ]
}

For more information about the values of the Action and Resource parameters in the script, see the Access policy description section in this topic.

Attach the custom policy to the RAM user. For more information, see Manage RAM user permissions.
Where:
- Set Resource Scope to Account Level.
- Set Access Policy to the custom policy that you created.

Access policy description

An access policy consists of two parts: Action and Resource. The Action parameter specifies the operation to perform, and the Resource parameter specifies the object on which the operation is performed.

Action

The following sections describe the possible values for the Action parameter:

Service-related

Category	Action	Description
Service-related	eas:CreateService	Create a model service
	eas:ListServices	View the list of model services
	eas:DescribeService	View the details of a model service
	eas:DeleteService	Delete a model service
	eas:DeleteServiceLabel	Delete a model service label
	eas:ListServiceInstances	View the information of model service instances
	eas:DeleteServiceInstances	Restart a model service instance
	eas:UpdateService	Update a model service or add a version
	eas:UpdateServiceVersion	Switch the version of a model service
	eas:StartService	Start a model service
	eas:StopService	Stop a model service
	eas:UpdateService	Update a model service
	eas:UpdateServiceLabel	Update a model service label
	eas:RestartService	Restart a model service
	eas:CreateServiceAutoScaler	Enable automatic scaling for a model service
	eas:CreateServiceCronScaler	Enable scheduled scaling for a model service
	eas:DeleteServiceAutoScaler	Disable automatic scaling for a model service
	eas:DeleteServiceCronScaler	Disable scheduled scaling for a model service
	eas:DescribeServiceAutoScaler	View the automatic scaling status of a model service
	eas:DescribeServiceCronScaler	View the scheduled scaling information of a model service
	eas:UpdateServiceAutoScaler	Update the automatic scaling configuration of a model service
	eas:UpdateServiceCronScaler	Update the scheduled scaling configuration of a model service
	eas:CreateAppService	Create an application service
	eas:UpdateServiceSafetyLock	Update the service safety lock
	eas:UpdateServiceInstance	Update the properties of a service instance
	eas:UpdateAppService	Update an application service
	eas:DescribeServiceDiagnosis	View the details of a service diagnosis
	eas:DescribeServiceInstanceDiagnosis	View the details of a service instance diagnosis
	eas:DescribeServiceEvent	Query the deployment events of a model service
	eas:DescribeGroup	View the details of a service group
	eas:ListServiceVersions	Query the historical versions of a service
	eas:ListServiceContainers	Query the list of containers for a service
	eas:ListGroups	View the list of service groups
	eas:CreateServiceMirror	Create traffic mirroring for a model service
	eas:DescribeServiceMirror	View the traffic mirroring status of a model service
	eas:UpdateServiceMirror	Update the traffic mirroring configuration of a model service
	eas:DeleteServiceMirror	Disable traffic mirroring for a model service
	eas:ReleaseService	Configure the traffic ratio for a blue-green deployment service
	eas:DescribeServiceLog	View the log information of a model service

Resource group-related

Category	Action	Description
Resource group-related	eas:CreateResource	Create a dedicated resource group
	eas:DescribeResource	View the basic information of a dedicated resource group
	eas:ListResources	View the list of dedicated resource groups
	eas:DeleteResource	Delete a dedicated resource group
	eas:UpdateResource	Update the basic information of a dedicated resource group
	eas:ListResourceInstances	View the list of machine instances in a dedicated resource group
	eas:ListResourceInstanceWorker	View the list of containers created by a machine instance in a dedicated resource group
	eas:ListResourceServices	View the services deployed in a dedicated resource group
	eas:CreateResourceInstances	Create machine instances for a dedicated resource group
	eas:UpdateResourceInstance	Update a machine instance in a dedicated resource group
	eas:DeleteResourceInstances	Delete a machine instance from a dedicated resource group
	eas:UpdateResourceDLink	Update the VPC direct connection status of a dedicated resource group
	eas:DescribeResourceDLink	View the VPC direct connection status of a dedicated resource group
	eas:DeleteResourceDLink	Delete the VPC direct connection configuration of a dedicated resource group
	eas:CreateResourceLog	Enable SLS log delivery for a dedicated resource group
	eas:DescribeResourceLog	View the SLS log delivery status of a dedicated resource group
	eas:DeleteResourceLog	Delete the SLS log delivery configuration of a dedicated resource group

Stress testing task-related

Category	Action	Description
Stress testing task-related	eas:CreateBenchmarkTask	Create a stress testing task
	eas:DeleteBenchmarkTask	Delete a stress testing task
	eas:DescribeBenchmarkTask	View the details of a stress testing task
	eas:DescribeBenchmarkTaskReport	View the report of a stress testing task
	eas:ListBenchmarkTask	Query the list of stress testing tasks
	eas:StartBenchmarkTask	Start a stress testing task
	eas:StopBenchmarkTask	Stop a stress testing task
	eas:UpdateBenchmarkTask	Update a stress testing task

Private gateway-related

Category	Action	Description
Private gateway-related	eas:CreateGateway	Create a private gateway
	eas:DescribeGateway	View the details of a private gateway
	eas:UpdateGateway	Update a private gateway
	eas:CreateGatewayIntranetLinkedVpc	Create a private network access endpoint for a private gateway
	eas:ListGatewayIntranetLinkedVpc	View the list of private network access endpoints for a private gateway
	eas:DeleteGatewayIntranetLinkedVpc	Delete a private network access endpoint for a private gateway
	eas:DeleteGateway	Delete a private gateway
	eas:ListPrivileges	View the whitelist configuration of a user

Resource

The following section describes the possible values for the Resource parameter:

In EAS, the format of a Resource parameter is as follows:

acs:eas:<region>:<uid>:<resource_type>/<id>

Replace the following parameters with their actual values:

<region>: The region where the service or dedicated resource group is located.
<uid>: The UID of the account that can perform the operation.
<resource_type>: The resource type. For example, the value is service when you perform operations on service-related resources, and resource when you perform operations on resource group-related resources.
<id>: The ID of the service or dedicated resource group.

The following examples describe the values of the Resource parameter for performing operations on services deployed in a specified public resource group, services deployed in a dedicated resource group, and a specified dedicated resource group:

Perform an operation on a specified deployed service
- Perform an operation on a service deployed in a public resource group
```
acs:eas:cn-hangzhou:123456789012****:service/eas-m-u12fxt9ml1syoj****
```
  The preceding Resource parameter specifies the service with the ID eas-m-u12fxt9ml1syoj****. The service is deployed in a public resource group in the China (Hangzhou) region by the account 123456789012****.
```
acs:eas:cn-hangzhou:123456789012****:service/your_service_name
```
  The preceding Resource parameter specifies the service named your_service_name. The service is deployed in a public resource group in the China (Hangzhou) region by the account 123456789012****.
- Perform an operation on a service deployed in a dedicated resource group
```
acs:eas:cn-shanghai:123456789012****:resource/eas-r-jksauxqjsai81****/service/eas-m-iaskn1skn1us****
```
  The preceding Resource parameter specifies the service with the ID eas-m-iaskn1skn1us****. The service is deployed in the dedicated resource group with the ID eas-r-jksauxqjsai8**** in the China (Shanghai) region by the account 123456789012****.
```
acs:eas:cn-shanghai:123456789012****:resource/eas-r-jksauxqjsai8****/service/your_private_service
```
  The preceding Resource parameter specifies the service named your_private_service. The service is deployed in the dedicated resource group with the ID eas-r-jksauxqjsai8**** in the China (Shanghai) region by the account 123456789012****.
Perform an operation on a specified dedicated resource group
```
acs:eas:cn-beijing:123456789012****:resource/eas-r-jksauxqjsai8****
```
The preceding Resource parameter specifies the dedicated resource group with the ID eas-r-jksauxqjsai8**** in the China (Beijing) region that belongs to the account 123456789012****.
Batch authorization

You can replace any part of the Resource format with an asterisk (*) to perform batch authorization.
The following are examples of Resource values for batch authorization:
- ```
acs:eas:*:123456789012****:service/*
```
  This Resource parameter specifies all services in public resource groups across all regions that belong to the account 123456789012****.
- ```
acs:eas:cn-hangzhou:123456789012****:resource/eas-r-jksauxqjsai8****/*
```
  This Resource parameter specifies all services that are deployed in the dedicated resource group eas-r-jksauxqjsai8**** in the China (Hangzhou) region and belong to the account 123456789012****.
- ```
acs:eas:*:123456789012****:*
```
  This Resource parameter specifies all resource groups and services across all regions that belong to the account 123456789012****.
- ```
acs:eas:*:123456789012****:service/prefix*
```
  This Resource parameter specifies the services in public resource groups whose names have the prefix prefix across all regions that belong to the account 123456789012****.