Platform For AI:Configure RAM policies for resource groups

Resource pool

A resource pool holds purchased computing resources for AI development. These resources are organized into dedicated resource groups. Cloud-native resources in a resource pool include general computing resources and Lingjun resources.

For more information, see Overview.

Resource quota

A resource quota is a subset of AI computing resources drawn from the resource pool. After you associate a resource quota with a workspace, workspace members use those resources for AI development and online service deployment.

Resource quotas follow a tree structure:

• A root resource quota is created directly from resource pool resources.

• Each root resource quota divides into one or more child resource quotas.

• Each child resource quota further divides into additional child resource quotas.

For more information, see Overview.

Manage the resource pool

Scenario: Grant a RAM user full management permissions over the resource pool, including the ability to view, create, update, and delete dedicated resource groups.

What this policy grants: All resource group operations on all dedicated resource groups, plus read access to VPC and security group information.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "pai:*ResourceGroup*"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "ecs:DescribeSecurityGroups"
      ],
      "Resource": "*"
    }
  ]
}

Create, scale, and delete root resource quotas

Scenario: Grant a RAM user permissions to create, update, scale, or delete root resource quotas, but restrict which dedicated resource groups the user draws resources from.

What this policy grants:

• Read and update access to three specific dedicated resource groups: resourcegroup1, resourcegroup2, and resourcegroup3.

• Full quota management on all resource quotas created from those resource groups.

A root resource quota contains resources from one or more dedicated resource groups. This policy requires both resource pool permissions (to access the source resource groups) and quota permissions.

The following example limits the RAM user to three dedicated resource groups. The ARN acs:pai:*:*:quota/* grants management of all resource quotas created from those resource groups.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "pai:GetResourceGroup",
        "pai:ListResourceGroups",
        "pai:UpdateResourceGroup"
      ],
      "Resource": [
        "acs:pai:*:*:resourcegroup/resourcegroup1",
        "acs:pai:*:*:resourcegroup/resourcegroup2",
        "acs:pai:*:*:resourcegroup/resourcegroup3"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "pai:CreateQuota",
        "pai:UpdateQuota",
        "pai:ScaleQuota",
        "pai:DeleteQuota",
        "pai:GetQuota",
        "pai:ListQuotas"
      ],
      "Resource": [
        "acs:pai:*:*:quota/*"
      ]
    }
  ]
}

Manage a root resource quota

Scenario: Grant a RAM user permissions to manage a specific root resource quota and its child resource quotas, without granting resource pool permissions.

What this policy grants (using quota1 as an example):

• View quota1.

• Update the metadata of quota1, such as the tag and description.

• Create, update, scale, and delete child resource quotas under quota1.

This policy contains two statements:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "pai:CreateQuota",
        "pai:UpdateQuota",
        "pai:ScaleQuota",
        "pai:DeleteQuota",
        "pai:GetQuota",
        "pai:ListQuotas"
      ],
      "Resource": [
        "acs:pai:*:*:quota/quota1/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "pai:UpdateQuota",
        "pai:GetQuota",
        "pai:ListQuotas"
      ],
      "Resource": [
        "acs:pai:*:*:quota/quota1"
      ]
    }
  ]
}

Manage a child resource quota

Scenario: Grant a RAM user permissions to manage a specific child resource quota and its own child resource quotas.

What this policy grants (using quota1.2 as an example):

• View quota1.2.

• Update the metadata of quota1.2, such as the tag and description.

• Create, update, scale, and delete child resource quotas under quota1.2.

This policy contains two statements:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "pai:CreateQuota",
        "pai:UpdateQuota",
        "pai:ScaleQuota",
        "pai:DeleteQuota",
        "pai:GetQuota",
        "pai:ListQuotas"
      ],
      "Resource": [
        "acs:pai:*:*:quota/*/quota1.2/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "pai:UpdateQuota",
        "pai:GetQuota",
        "pai:ListQuotas"
      ],
      "Resource": [
        "acs:pai:*:*:quota/*/quota1.2"
      ]
    }
  ]
}

Add VPC permissions for Lingjun resource quotas

Scenario: Grant VPC read permissions required when creating root or child resource quotas that use Lingjun resources in the China (Ulanqab) region.

What this policy grants: Read access to VPCs, vSwitches, and security groups. Append this statement to any quota management policy when VPC configuration is needed.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "ecs:DescribeSecurityGroups"
      ],
      "Resource": "*"
    }
  ]
}