Implement role-based SSO to log on to the PAI console - Platform For AI - Alibaba Cloud - Platform For AI

Role-based SSO lets you log in to PAI without managing separate credentials, simplifying access while meeting enterprise security requirements.

Background information

To meet enterprise security and compliance requirements, Alibaba Cloud supports role-based SSO for accessing cloud resources. Unlike traditional account-and-password login, role-based SSO provides a more secure access method that meets higher security standards. For more information, see SAML role SSO overview.

Login methods supported by PAI

PAI supports the following three login methods:

Alibaba Cloud account login:

Log in to PAI directly with your Alibaba Cloud account or a RAM user. Your account automatically becomes a member of a PAI workspace and gains the corresponding product usage permissions.
CloudSSO login:

CloudSSO provides unified identity management and access control for multiple accounts in an Alibaba Cloud Resource Directory (RD). You can use CloudSSO to centrally manage enterprise users who access Alibaba Cloud, configure single sign-on (SSO) between your corporate identity provider and Alibaba Cloud, and centrally manage access permissions to all accounts in your RD.
Role-based SSO login:

Access PAI through role-based SSO. A RAM role becomes a member of a PAI workspace, and users who assume that role receive the same permissions as members who log in with an Alibaba Cloud account. For more information about RAM roles, see RAM role overview.

Role-based login

Create a RAM role and configure a trust policy.

By RAM user

If you need a RAM user to assume a RAM role by switching identities on the Alibaba Cloud console, set Principal Type to Cloud Account.

Create a RAM role for a trusted Account. For more information, see Create a RAM role for a trusted Alibaba Cloud account.

For Principal Name, select Current Account.

Go to the details page of the target role and modify the trust policy.

Update the trust policy with the following script:

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "RAM": [
          "acs:ram::YOUR_ROOT_ACCOUNT_ID:root"
        ]
      }
    },    
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "dataworks.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}

In the script, the root account ID in acs:ram::root account ID:root must be replaced with your account ID. You can go to the Basic Information page to obtain your account ID.

Create one or more RAM users. For more information, see Create a RAM user.
In the Actions column of the target RAM user, click Add Permissions. Grant the AliyunSTSAssumeRoleAccess permission to the RAM user to allow the user to call the AssumeRole operation of STS.

By identity provider

If you need users from an identity provider (IdP) to log in to Alibaba Cloud and assume a RAM role, select IdP as the trusted entity type.

Create a RAM role for a trusted IdP. For more information, see Create a RAM role for a trusted IdP.

Go to the details page of the target role and modify the trust policy.

Update the trust policy with the following script:

{
   "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Federated": [
                    "acs:ram::YOUR_ROOT_ACCOUNT_ID:saml-provider/IDP"
                ]
            },
            "Condition": {
                "StringEquals": {
                    "saml:recipient": "https://signin.aliyun.com/saml-role/sso"
                }
            }
        },
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "dataworks.aliyuncs.com"
              ]
            }
        }
    ],
    "Version": "1"
}

In the script, replace root account ID in acs:ram::root account ID:saml-provider/IDP with your root account ID. You can go to the User Basic Information page to obtain the account ID.

Configure an access policy.

Add an access policy to the role based on the PAI sub-products that the user needs.

Create an access policy. For example, you can name the policy PAIDefaultPolicy. For more information, see Cloud service dependencies and authorization: Designer. On the Policy Document tab, enter the following content:

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "cs:GetClusterById",
                "cs:GetClusters",
                "cs:GetUserConfig",
                "cs:DescribeClusterNodes",
                "cs:DescribeClusterInnerServiceKubeconfig",
                "cs:RevokeClusterInnerServiceKubeconfig"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "vpc:DescribeVSwitchAttributes",
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches",
                "vpc:DescribeVpcAttribute"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecs:DescribeSecurityGroupAttribute",
                "ecs:DescribeSecurityGroups",
                "ecs:CreateNetworkInterface",
                "ecs:DeleteNetworkInterface",
                "ecs:DescribeNetworkInterfaces",
                "ecs:CreateNetworkInterfacePermission",
                "ecs:DescribeNetworkInterfacePermissions",
                "ecs:DeleteNetworkInterfacePermission"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "nas:DescribeFileSystems",
                "nas:CreateMountTarget",
                "nas:DescribeMountTargets",
                "nas:ModifyMountTarget",
                "nas:DescribeProtocolMountTarget"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "cr:ListNamespace",
                "cr:ListRepository",
                "cr:GetAuthorizationToken",
                "cr:ListInstanceEndpoint",
                "cr:PullRepository",
                "cr:PushRepository",
                "cr:GetInstance",
                "cr:GetInstanceVpcEndpoint",
                "cr:ListInstance",
                "cr:ListInstanceDomain"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "oss:ListBuckets",
                "oss:GetObjectMetadata",
                "oss:GetObject",
                "oss:ListObjects",
                "oss:PutObject",
                "oss:CopyObject",
                "oss:CompleteMultipartUpload",
                "oss:AbortMultipartUpload",
                "oss:InitiateMultipartUpload",
                "oss:UploadPartCopy",
                "oss:UploadPart",
                "oss:DeleteObject"
            ],
            "Resource": "acs:oss:*:*:*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "datasetacc:DescribeInstance",
                "datasetacc:DescribeSlot",
                "datasetacc:DescribeEndpoint"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Permission type	Description
cs:***	Permissions related to Container Service for Kubernetes (ACK).
vpc:***	Permissions related to Virtual Private Cloud (VPC).
ecs:***	Permissions related to Elastic Compute Service (ECS).
nas:***	Permissions related to NAS.
cr:***	Permissions related to Container Registry (ACR).
oss:***	Permissions related to Object Storage Service (OSS).
datasetacc:***	Permissions related to dataset acceleration.

On the Resource Access Management console, choose Identities > Role.
Search for the role that you created in Step 1 and click the role name to go to the role details page.
On the Permissions tab, click Grant Permission to grant the created access policy to the role.

In the Grant Permission panel, set Authorized Scope to Alibaba Cloud Account. In the permission policy search box, search for and select the PAIDefaultPolicy custom policy, and then click OK.

Add the RAM role to a PAI workspace and grant permissions.

A RAM role must be added as a workspace member to use PAI sub-products. A workspace administrator can add the created RAM role on the Members and Roles page of the workspace. For more information, see Manage workspace members. In the Add Members panel, click the User/Role tab, search for and select the target RAM role from the list of members to be added, assign a workspace role from the Assign Role(s) drop-down list at the bottom, and then click OK.
Note
If you cannot find the role that you created, try the following:
- In the Add Members panel, click Refresh to update the account list.
- Try logging in to the PAI console by assuming the RAM role, and then search for and add the role again. For more information, see Assume a RAM role.
Log in to the PAI console to start algorithm development.

After authorization is complete, a user can assume the RAM role to log in to the PAI console and start algorithm development. For more information, see Assume a RAM role.