Configure conditional access with RAM policies - Platform For AI

Platform for AI (PAI) integrates with Resource Access Management (RAM) to authenticate all operations on PAI resources. All operations on PAI sub-services connected to workspaces are routed to RAM by using workspace APIs for authentication. To implement fine-grained access control beyond what standard roles provide, attach a RAM policy that includes a Condition element to a RAM role. PAI evaluates the conditions in the policy and passes the matching properties to RAM for authentication.

If your access control requirements are met by predefined workspace roles, see Appendix: Roles and permissions before creating custom policies.

Supported Condition keys

The Condition element in a RAM policy specifies when a permission takes effect. PAI supports the following Condition keys:

Key	Description	Type	Valid values
`pai:Accessibility`	Resource visibility within the workspace	String	`PUBLIC`: visible to all workspace members. `PRIVATE`: visible only to the creator.
`pai:EntityAccessType`	Whether the resource was created by the authenticated user	String	`CREATOR`: created by the current authenticated user. `OTHERS`: created by another user.
`acs:SourceIp`	Source IP address of the request	String	One or more IP addresses, used with the `IpAddress` condition operator.

If a policy attached to a RAM user does not include pai:Accessibility or pai:EntityAccessType in the Condition element, RAM skips those property checks during authentication.

Limit access by resource visibility and creator

Attach policies with pai:Accessibility and pai:EntityAccessType conditions to RAM roles to control which resources each role can access based on visibility and ownership.

The Resource element in each Statement uses this format:

acs:<sub-service-code>:<region>:<account-id>:workspace/<workspace-id>/<resource-name>/<resource-id>

Algorithm developer role

To grant a developer access only to their own private resources and all public resources, use a policy with two statements.

The first statement allows the role to access resources that are both private (pai:Accessibility: PRIVATE) and created by the authenticated user (pai:EntityAccessType: CREATOR). The second statement allows access to all public resources regardless of creator.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "pai:*"
      ],
      "Resource": "acs:paidsw:*:*:*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "pai:Accessibility": "PRIVATE",
          "pai:EntityAccessType": "CREATOR"
        }
      }
    },
    {
      "Action": [
        "pai:*"
      ],
      "Resource": "acs:paidsw:*:*:*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "pai:Accessibility": "PUBLIC"
        }
      }
    }
  ]
}

Administrator role

To grant a role unrestricted access to all resources in the workspace — regardless of visibility or creator — omit the Condition element entirely. RAM grants access without checking pai:Accessibility or pai:EntityAccessType.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "pai:*"
      ],
      "Resource": "acs:paidsw:*:*:*",
      "Effect": "Allow"
    }
  ]
}

Other roles

Policies for other workspace roles follow the same pattern as the algorithm developer role. The Condition element stays the same; only the Action element changes based on the permissions assigned to each role.

Limit access by IP address

To block requests from specific IP addresses, attach a policy with Effect: Deny and the acs:SourceIp condition key to the RAM role. Use the IpAddress condition operator to specify the blocked addresses. When a request originates from a listed IP address, RAM rejects access to the specified resources.

The following policy denies all actions on eas and pai* resources when the request comes from 192.0.2.100 or 203.0.113.200:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "*",
      "Resource": [
        "acs:eas:*:*:*",
        "acs:pai*:*:*:*"
      ],
      "Condition": {
        "IpAddress": {
          "acs:SourceIp": [
            "192.0.2.100",
            "203.0.113.200"
          ]
        }
      }
    }
  ]
}

The Resource element follows the format acs:<sub-service-ram-code>:<region>:<account-id>:workspace/<workspace-id>/<resource-name-plural>/<resource-id>.

How it works

When a RAM user requests access to a PAI API object, PAI evaluates the resource properties and calls the RAM API for authentication. RAM grants access only when both conditions are true:

The RAM user has permission to perform the requested action on the resource.
The runtime property values that PAI passes to RAM (such as pai:Accessibility and pai:EntityAccessType) match the values defined in the Condition element of the attached policy.

Platform For AI:Configure access permissions using RAM policies