Platform For AI:Permission management

Authorize RAM users to activate PAI and purchase PAI resources

To activate PAI and purchase PAI resources, you need to add the AliyunPAIFullAccess policy to RAM user.

Authorize RAM users to use PAI sub-services

PAI provides the ability to manage permissions through workspaces. You can add RAM users as workspace members and grant different RAM accounts the permissions of Resource Administrator (Alibaba Cloud Account/through RAM Authorization), Workspace Administrator/Owner, Algorithm Developer, Algorithm O&M Engineer, Labeling Administrator, and Visitor member roles. For role permissions, see Appendix: Role and permission list.

• For iTAG, see iTAG personnel assignment for further permission settings.

• EAS provides system policies to authorize RAM users. For example:

  • EAS management permissions: AliyunPAIEASFullAccess.

  • EAS read-only permissions: AliyunPAIEASReadOnlyAccess.

• Most AI Acceleration features only require the operation permissions of the corresponding model development, training, and inference sub-services, with no additional authorization needed. When using dataset acceleration only, RAM accounts need the AliyunPAIFullAccess and AliyunDatasetAccFullAccess permissions.

Authorize RAM users to activate/use other cloud services

The following table lists other services that PAI depends on:

If your RAM users have been added as workspace members, they will have partial permissions for other cloud services based on their assigned roles. If you encounter permission issues when activating or using other cloud services, you can refer to the following table for authorization operations.

For example: To use a RAM user to activate OSS, you need to add the system policy AliyunOSSFullAccess to the RAM user. If you encounter permission issues when using OSS, you can refer to OSS RAM Policy for RAM authorization.

1. Log on to the PAI console.

2. In the navigation pane on the left, click Activation & Authorization > Dependent Services, and find OSS under the Designer function module.

3. Check the authorization status of OSS in the Actions column.

   • If not yet authorized, click Authorize in the Actions column and follow the instructions to complete the authorization.

   • If authorization is complete, click View Authorization in the Actions column to view details.

Add a policy to a RAM user (such as AliyunPAIFullAccess)

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the required RAM user, and click Add Permissions in the Actions column.

   

   You can also select multiple RAM users and click Add Permissions in the lower part of the page to grant permissions to the RAM users at a time.

4. In the Grant Permission panel, add permissions for the RAM user. Where:

   • Resource Scope: Select Account.

   • Policy: Select the AliyunPAIFullAccess policy.

     Important

     A RAM user with this system policy can purchase, create, and delete all types of resources and has administrator permissions on all workspaces. Proceed with caution.

     You can refer to Create a custom policy to set the minimum available policy for RAM users.

5. Click Grant permissions.

6. Click Close.

Create a custom policy

1. Log on to the RAM console as a RAM administrator.

2. In the navigation pane on the left, choose Permissions > Policies

3. Click Create Policy and choose the JSON tab and configure the following policy (grants RAM users permission to view the list of all EAS model services in the account).

   Important

   When you specify the policy document, we recommend that you follow the principle of least privilege.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "eas:ListServices"
               ],
               "Resource": "*"
           }
       ]
   }

For more information, see Create a custom policy in script editor mode.