Role-based SSO provides a convenient and secure way for users to efficiently use PAI features. This method simplifies the login process, enhances account security, and increases management flexibility.
Background information
To meet the increasingly strict security and compliance requirements of enterprises, Alibaba Cloud lets you access cloud resources by using role-based SSO. Traditionally, enterprise users log in to the Alibaba Cloud console with an account and password. However, role-based SSO provides a more secure access method that meets higher security standards. For more information, see SAML role SSO overview.
Login methods supported by PAI
PAI supports the following three login methods:
Alibaba Cloud account login:
You can use your Alibaba Cloud account or a RAM user to log in to PAI directly. By entering your account and password, you can access the Alibaba Cloud console and use PAI under that identity. In this case, your Alibaba Cloud account automatically becomes a member of a PAI workspace and gains the corresponding product usage permissions.
CloudSSO provides unified identity management and access control for multiple accounts in an Alibaba Cloud Resource Directory (RD). You can use CloudSSO to centrally manage enterprise users who access Alibaba Cloud, configure single sign-on (SSO) between your corporate identity provider and Alibaba Cloud, and centrally manage access permissions to all accounts in your RD.
You can also access the Alibaba Cloud console and use PAI by using role-based SSO. With this method, a RAM role becomes a member of a PAI workspace. Users who assume the RAM role receive the same product usage permissions as members who log in with an Alibaba Cloud account. For more information about RAM roles, see RAM role overview.
Role-based login
Create a RAM role and configure a trust policy.
By RAM user
If you need a RAM user to assume a RAM role by switching identities on the Alibaba Cloud console, select Alibaba Cloud Account as the trusted entity type.
Create a RAM role for a trusted Account. For more information, see Create a RAM role for a trusted Alibaba Cloud account.
For the Select Trusted Entity parameter, select Current Alibaba Cloud Account.
Go to the details page of the target role and modify the trust policy.
Update the trust policy with the following script:
{ "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "RAM": [ "acs:ram::YOUR_ROOT_ACCOUNT_ID:root" ] } }, { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": [ "dataworks.aliyuncs.com" ] } } ], "Version": "1" }In the script, the root account ID in acs:ram::root account ID:root must be replaced with your account ID. You can go to the Basic Information page to obtain your account ID.
Create one or more RAM users. For more information, see Create a RAM user.
In the Actions column of the target RAM user, click Add Permissions. Grant the AliyunSTSAssumeRoleAccess permission to the RAM user to allow the user to call the AssumeRole operation of STS.
By identity provider
If you need users from an identity provider (IdP) to log in to Alibaba Cloud and assume a RAM role, select IdP as the trusted entity type.
Create a RAM role for a trusted IdP. For more information, see Create a RAM role for a trusted IdP.
Go to the details page of the target role and modify the trust policy.
Update the trust policy with the following script:
{ "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Federated": [ "acs:ram::YOUR_ROOT_ACCOUNT_ID:saml-provider/IDP" ] }, "Condition": { "StringEquals": { "saml:recipient": "https://signin.aliyun.com/saml-role/sso" } } }, { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": [ "dataworks.aliyuncs.com" ] } } ], "Version": "1" }In the script, replace root account ID in acs:ram::root account ID:saml-provider/IDP with your root account ID. You can go to the User Basic Information page to obtain the account ID.
Configure an access policy.
You can add an access policy to the role based on the PAI sub-products that the user needs to use.
Create an access policy. For example, you can name the policy PAIDefaultPolicy. For more information, see Cloud service dependencies and authorization: Designer. On the Policy Document tab, enter the following content:
{ "Version": "1", "Statement": [ { "Action": [ "cs:GetClusterById", "cs:GetClusters", "cs:GetUserConfig", "cs:DescribeClusterNodes", "cs:DescribeClusterInnerServiceKubeconfig", "cs:RevokeClusterInnerServiceKubeconfig" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "vpc:DescribeVSwitchAttributes", "vpc:DescribeVpcs", "vpc:DescribeVSwitches", "vpc:DescribeVpcAttribute" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ecs:DescribeSecurityGroupAttribute", "ecs:DescribeSecurityGroups", "ecs:CreateNetworkInterface", "ecs:DeleteNetworkInterface", "ecs:DescribeNetworkInterfaces", "ecs:CreateNetworkInterfacePermission", "ecs:DescribeNetworkInterfacePermissions", "ecs:DeleteNetworkInterfacePermission" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "nas:DescribeFileSystems", "nas:CreateMountTarget", "nas:DescribeMountTargets", "nas:ModifyMountTarget", "nas:DescribeProtocolMountTarget" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "cr:ListNamespace", "cr:ListRepository", "cr:GetAuthorizationToken", "cr:ListInstanceEndpoint", "cr:PullRepository", "cr:PushRepository", "cr:GetInstance", "cr:GetInstanceVpcEndpoint", "cr:ListInstance", "cr:ListInstanceDomain" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "oss:ListBuckets", "oss:GetObjectMetadata", "oss:GetObject", "oss:ListObjects", "oss:PutObject", "oss:CopyObject", "oss:CompleteMultipartUpload", "oss:AbortMultipartUpload", "oss:InitiateMultipartUpload", "oss:UploadPartCopy", "oss:UploadPart", "oss:DeleteObject" ], "Resource": "acs:oss:*:*:*", "Effect": "Allow" }, { "Action": [ "datasetacc:DescribeInstance", "datasetacc:DescribeSlot", "datasetacc:DescribeEndpoint" ], "Resource": "*", "Effect": "Allow" } ] }Permission type
Description
cs:***
Permissions related to Container Service for Kubernetes (ACK).
vpc:***
Permissions related to Virtual Private Cloud (VPC).
ecs:***
Permissions related to Elastic Compute Service (ECS).
nas:***
Permissions related to NAS.
cr:***
Permissions related to Container Registry (ACR).
oss:***
Permissions related to Object Storage Service (OSS).
datasetacc:***
Permissions related to dataset acceleration.
On the Resource Access Management console, choose .
Search for the role that you created in Step 1 and click the role name to go to the role details page.
On the Permissions tab, click Grant Permission to grant the created access policy to the role.
In the Grant Permission panel, set Authorized Scope to Alibaba Cloud Account. In the permission policy search box, search for and select the PAIDefaultPolicy custom policy, and then click OK.
Add the RAM role to a PAI workspace and grant permissions.
To use PAI sub-products, a RAM role must be added as a workspace member. A workspace administrator can add the created RAM role on the Members and Roles page of the workspace. For more information, see Manage workspace members. In the Add Members panel, click the User/Role tab, search for and select the target RAM role from the list of members to be added, assign a workspace role from the Assign Role(s) drop-down list at the bottom, and then click OK.
NoteIf you cannot find the role that you created, try the following:
In the Add Members panel, click Refresh to update the account list.
Try logging in to the PAI console by assuming the RAM role, and then search for and add the role again. For more information, see Assume a RAM role.
Log in to the PAI console to start algorithm development.
After the authorization is complete, a user can assume the RAM role to log in to the PAI console and start algorithm development. For more information, see Assume a RAM role.