Platform For AI:Configure the EAS RAM role

Step 1: Create a RAM role

1. Log on to the RAM console and create a RAM role.

2. Set the following parameters:

   Parameter	Value
   Principal Type	Cloud Service
   Principal Name	Platform for AI/PAI (eas.pai.aliyuncs.com)

   

3. On the Trust Policy tab of the new role, confirm that eas.pai.aliyuncs.com appears in the Service principal array. This trust policy controls which services can assume the role. A correctly configured trust policy looks like this:

   Important

   Missing this entry is the most common cause of the failed to assume role deployment error. If the role was created with a different principal (for example, another service), click Edit Trust Policy and add "eas.pai.aliyuncs.com" to the Service array.

   {
     "Statement": [
       {
         "Action": "sts:AssumeRole",
         "Effect": "Allow",
         "Principal": {
           "Service": [
             "eas.pai.aliyuncs.com"
           ]
         }
       }
     ],
     "Version": "1"
   }

Step 2: Grant permissions to the role

Attach system or custom policies to give the role access to the resources your service needs. For example, attach AliyunOSSReadOnlyAccess to allow read access to OSS.

Step 3: Associate the role when deploying

Add the following to the JSON in the Service Configuration section. Replace role_arn with the ARN of the role you created. To find the ARN, see View the RAM role.

"options": {
  "enable_ram_role": true
},
"role_arn": "acs:ram::111*************:role/${RoleName}"

Grant PassRole permission to a RAM user

If you deploy EAS services as a RAM user (sub-account), the primary account must grant you the ram:PassRole permission. Without it, deployment fails with a role configuration error.

Ask the primary account to attach the following custom policy to your RAM user. Replace ${RoleName} with the name of the RAM role associated with the EAS service. For help, see Create a custom permission policy and Grant permissions to a RAM user.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "acs:ram::*:role/${RoleName}"
    }
  ]
}

Role not found

Symptom:

Check in the RAM console whether the role exists.

• Role doesn't exist: Update the service configuration to reference an existing role name.

• Role exists but error persists: The RAM user deploying the service lacks ram:PassRole permission. Ask the primary account to attach the following policy (replace ${RoleName} with the role name). See Grant permissions to a RAM user.

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "ram:PassRole",
        "Resource": "acs:ram::*:role/${RoleName}"
      }
    ]
  }

Failed to assume role

Symptom: The Deployment Events tab on the Elastic Algorithm Service page shows:

unable to render, error: failed to assume role for user, reason: You are not authorized to do this action. You should be authorized by RAM.

The RAM role's trust policy does not include eas.pai.aliyuncs.com as a trusted principal. To fix this:

1. Log on to the RAM console as a RAM administrator.

2. In the left navigation pane, choose Identities > Roles.

3. Click the name of the target RAM role.

4. On the Trust Policy tab, click Edit Trust Policy.

5. In the Service array, add "eas.pai.aliyuncs.com" and click OK.

Before:

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "RAM": ["acs:ram::aaa:root"],
        "Service": ["xxx.aliyuncs.com"]
      }
    }
  ],
  "Version": "1"
}

After:

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "RAM": ["acs:ram::aaa:root"],
        "Service": [
          "xxx.aliyuncs.com",
          "eas.pai.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}