Platform For AI:Configure the EAS RAM role

Benefits

A RAM role is a trusted entity role that cloud services can assume, used to solve "cross-service access" issues. Obtaining temporary access credentials based on RAM roles for identity verification and access control has the following benefits:

• Security and confidentiality: No need to manage credentials within the service. STS temporary access credentials replace long-term AccessKeys, reducing the risk of key leakage.

• Convenient and controllable: By modifying RAM role permission policies, you can more conveniently and precisely control the permissions for developers to access cloud resources within the service.

Limits

Currently, an EAS service can only be associated with one RAM role.

Configuration methods

Configure a RAM role for the EAS service when creating it, and obtain STS temporary access credentials.

"options": {
  "enable_ram_role": true
}

# Obtain temporary authorization access credentials for the instance RAM role
curl $ALIBABA_CLOUD_CREDENTIALS_URI

{
	"Code": "Success",
	"AccessKeyId": "STS.N*********7",
	"AccessKeySecret": "3***************d",
	"SecurityToken": "DFE32G*******",
	"Expiration": "2024-05-21T10:39:29Z"
}

{
	"Code": "Success",
	"AccessKeyId": "STS.N*********7",
	"AccessKeySecret": "3***************d",
	"SecurityToken": "DFE32G*******",
	"Expiration": "2024-05-21T10:39:29Z"
}

Examples

This section describes how to access PyODPS or OSS based on the EAS RAM role. You can integrate the code into the service image or mount it to the service instance through model configuration. This example demonstrates the mounting method. The procedure is as follows:

1. Go to the Custom Deployment page. For more information, see Service deployment.

2. On the Custom Deployment page, configure the following key parameters. For more parameter configuration information, see Console custom deployment parameter description.

   Parameter		Description
   Environment Information	Run Command	Add a command to execute the code, such as python /mnt/data/xx.py.
   	Model Configuration	Mount the code file xx.py to the EAS service instance through Model Configuration. Select the directory where the code file is located and configure the mount path /mnt/data/. The code file content example is as follows: Example 1: Access OSS data based on the RAM role import oss2 from alibabacloud_credentials.client import Client from alibabacloud_credentials import providers from itertools import islice if __name__ == '__main__': auth = oss2.ProviderAuth(providers.DefaultCredentialsProvider()) # <oss_endpoint> needs to be replaced with your OSS Bucket name; <oss_bucket> needs to be replaced with the Endpoint of the region where your OSS Bucket is located. bucket = oss2.Bucket(auth, '<oss_endpoint>', '<oss_bucket>' ) for b in islice(oss2.ObjectIterator(bucket), 10): print(b.key) Where: <oss_bucket> needs to be replaced with your OSS Bucket name, and ensure it is the default OSS bucket preset in the current workspace. <oss_endpoint> needs to be replaced with the Endpoint of the region where your OSS Bucket is located. Because EAS does not connect to the public network by default, you should configure the internal network Endpoint address (such as oss-cn-hangzhou-internal.aliyuncs.com). If you need to use a public network Endpoint (such as oss-cn-hangzhou.aliyuncs.com), you need to configure a virtual private cloud (VPC) with public network access capability for EAS. For more information, see Network configuration. Example 2: Access PyODPS data based on the RAM role from alibabacloud_credentials import providers from odps.accounts import CredentialProviderAccount from odps import ODPS if __name__ == '__main__': account = CredentialProviderAccount(providers.DefaultCredentialsProvider()) # <odps_project> needs to be replaced with your Project name; <odps_endpoint> needs to be replaced with the Endpoint of the region where your Project is located. o = ODPS( account=account, project="<odps_project>", endpoint="<odps_endpoint>" ) for t in o.list_tables(): print(t) Where: <odps_project> needs to be replaced with your Project name. You can log on to the MaxCompute console and view the specific Project name in Workspace > Project Management in the specified region. Note If you use a RAM user, ensure that the user has operation permissions for the project. For more information, see Authorize other users. <odps_endpoint> needs to be replaced with the Endpoint of the region where your Project is located. Because EAS does not connect to the public network by default, you should configure the internal network Endpoint address (such as https://service.cn-hangzhou-vpc.maxcompute.aliyun-inc.com/api). If you need to use a public network Endpoint (such as https://service.cn-hangzhou.maxcompute.aliyun.com/api), you need to configure a virtual private cloud (VPC) with public network access capability for EAS. For more information, see Network configuration.
   	Third-party Library Configuration	Configure the following Third-party Library List to install the Alibaba Cloud Credentials tool, PyODPS SDK, and OSS SDK. alibabacloud_credentials pyodps oss2 Note If the third-party libraries are pre-installed in the image, you can skip this configuration.
   Service Configuration		Taking the PAI default role as an example, add the following configuration to the JSON in the Service Configuration section: "options": { "enable_ram_role": true } Note If you use JSON for direct deployment and want to call the OSS SDK through the PAI default role, you need to ensure that the service configuration includes the metadata.workspace_id field.

3. After the parameter configuration is complete, click Deploy.

   After the service is successfully deployed, you can view the running results in the service logs.

FAQ

How do I resolve errors when configuring a custom RAM role when deploying an EAS service?

• Error message:

  Log on to the RAM console and check if the role exists.

  • If the role does not exist, modify the instance custom RAM role to an existing role.

  • If the role exists, contact the primary account to grant the sub-account the following custom permission policy (replace ${RoleName} with the RAM role name) to obtain the permission to pass the RAM role to the EAS instance. For more information, see Grant permissions to a RAM user.

    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "ram:PassRole",
          "Resource": "acs:ram::*:role/${RoleName}"
        }
      ]
    }

• The Deployment Event error message is unable to render, error: failed to assume role for user, reason: You are not authorized to do this action. You should be authorized by RAM..

  You can view this on the Elastic Algorithm Service page by clicking the service name and then switching to the Deployment Events tab, as shown in the following figure:

  In most cases, this error occurs because no trust policy is configured for the RAM role. To configure a trust policy for the RAM role, perform the following steps:

  1. Log on to the RAM console as a RAM administrator.

  2. In the left-side navigation pane, choose Identities > Roles.

  3. On the Roles page, click the name of the target RAM role.

  4. On the Trust Policy tab, click Edit Trust Policy to add trust for "eas.pai.aliyuncs.com".

  5. In the code editor, modify the content of the trust policy and click OK.

     The following sample code shows the original policy document of the RAM role:

     {
       "Statement": [
         {
           "Action": "sts:AssumeRole",
           "Effect": "Allow",
           "Principal": {
             "RAM": [
               "acs:ram::aaa:root"
             ],
             "Service": [
               "xxx.aliyuncs.com"
             ]
           }
         }
       ],
       "Version": "1"
     }

     The new policy content is as follows:

     {
       "Statement": [
         {
           "Action": "sts:AssumeRole",
           "Effect": "Allow",
           "Principal": {
             "RAM": [
               "acs:ram::aaa:root"
             ],
             "Service": [
               "xxx.aliyuncs.com",
               "eas.pai.aliyuncs.com" 
             ]
           }
         }
       ],
       "Version": "1"
     }