Lists all system policies that PAI supports, with the permissions each policy grants to RAM identities.
What is a system policy
An access policy is a collection of permissions described in a specific syntax. It defines the authorized resources, actions, and conditions. Resource Access Management (RAM) provides two types of access policies:
System policies: Created and maintained by Alibaba Cloud. Use them without modification.
Custom policies: Created, updated, and deleted by you to fit specific requirements.
As PAI evolves, new permissions are added to system policies to support new features. These updates apply automatically to all RAM identities—RAM users, RAM user groups, and RAM roles—that have been granted the policies.
System policies fall into three categories: product system policies, service role policies, and service-linked role policies. Not all categories apply to every product. The available types for PAI are listed in this topic.
For a full overview of RAM access policies, see Overview of access policies.
System policies enable quick start and apply to console access, OpenAPI, and command-line interface (CLI) access. However, for better data security, use custom policies for OpenAPI or CLI access to grant only the specific permissions that each user or application requires.
Policy quick reference
| Policy | Scope | Access level |
|---|---|---|
| AliyunPAIFullAccess | Platform for AI (PAI) | Full management |
| AliyunPAIReadOnlyAccess | Platform for AI (PAI) | Read-only |
| AliyunDatasetAccFullAccess | Dataset Accelerator (PAI-DatasetAcc) | Full management |
| AliyunDatasetAccReadOnlyAccess | Dataset Accelerator (PAI-DatasetAcc) | Read-only |
| AliyunPAIEASFullAccess | Elastic Algorithm Service (PAI-EAS) | Full management |
| AliyunPAIEASReadOnlyAccess | Elastic Algorithm Service (PAI-EAS) | Read-only |
| AliyunServiceRolePolicyForPaiLangStudio | PAI | Service-linked role only |
| AliyunServiceRolePolicyForPAIABTest | PAIABTest | Service-linked role only |
Follow the Principle of Least Privilege (PoLP). Grant only the permissions required for the task.
Product system policies
Product system policies grant access to PAI and its sub-services.
Platform for AI (PAI)
AliyunPAIFullAccess Grants full management permissions for Platform for AI (PAI). View policy details
AliyunPAIReadOnlyAccess Grants read-only permissions for Platform for AI (PAI). View policy details
Dataset Accelerator (PAI-DatasetAcc)
AliyunDatasetAccFullAccess Grants full management permissions for Dataset Accelerator (PAI-DatasetAcc). View policy details
AliyunDatasetAccReadOnlyAccess Grants read-only permissions for Dataset Accelerator (PAI-DatasetAcc). View policy details
Elastic Algorithm Service (PAI-EAS)
AliyunPAIEASFullAccess Grants full management permissions for Elastic Algorithm Service (PAI-EAS). View policy details
AliyunPAIEASReadOnlyAccess Grants read-only permissions for Elastic Algorithm Service (PAI-EAS). View policy details
Service-linked role policies
Service-linked role policies are attached exclusively to service-linked roles. Do not attach them to RAM users, RAM user groups, or RAM roles.
AliyunServiceRolePolicyForPaiLangStudio
PAI uses the service-linked role AliyunServiceRoleForPaiLangStudio to access resources in other Alibaba Cloud services. AliyunServiceRolePolicyForPaiLangStudio is the authorization policy for that role. This policy is defined and managed by PAI—it cannot be modified or deleted.
AliyunServiceRolePolicyForPAIABTest
PAIABTest uses the service-linked role AliyunServiceRoleForPAIABTest to access resources in other Alibaba Cloud services. AliyunServiceRolePolicyForPAIABTest is the authorization policy for that role. This policy is defined and managed by PAIABTest—it cannot be modified or deleted.
Authorization reference
By default, RAM identities have no permissions. An Alibaba Cloud account administrator must grant permissions before a RAM identity can access account resources.
To grant permissions to a RAM identity, see the relevant guide: