Create a workspace

Create and manage PAI workspaces to organize compute resources, user permissions, and AI assets.

Limitations

Only Administrators and Owners can modify workspace configuration.
Voice call, SMS, and email features for event notifications are available only in China (Hangzhou), China (Shanghai), and China (Ulanqab) regions.

Prerequisites

Alibaba Cloud account (main account): Main accounts can perform all operations without additional authorization.
RAM user (sub-account): RAM users must be granted the AliyunPAIFullAccess permission. AliyunPAIFullAccess grants full access to PAI. Assign it with caution. We recommend using a main account for administrative operations.

Go to the PAI workspace list page, click Create Workspace, and configure the following parameters:

Configure the basic information. Key parameters include:
- Add Member: Add and assign roles to workspace members. You can also add members after workspace creation. For details, see Configure members and roles.
- Workspace Default Storage: We recommend configuring default storage for the workspace to store temporary data and models from tasks such as training.
Configure resource associations. Key parameters include:
- Intelligent Computing Lingjun Resources: High-performance compute resource groups for model development and training.
- General Computing Resources: Dedicated general computing resources for AI development. For details, see Create a resource group and purchase general computing resources.
- MaxCompute Resources: CPU resources from MaxCompute for algorithms in Designer. For details, see MaxCompute resource quotas.
- Fully Managed Flink Resources: Used for large-scale distributed model training. For details, see Fully Managed Flink resource management.
For more information, see AI compute resources.
Confirm information and enter the workspace.

After you enter the workspace, the left-side navigation pane displays all PAI components for managing your AI development workflow. For details, see AI development.

Manage a workspace

Go to the Workspace Details page. After you enter the target workspace, click Configure Workspace in the upper-right corner:

Compute resources

View and associate compute resources:

Note

You currently cannot disassociate a linked compute resource. To remove an association, contact your account manager.

Intelligent Computing Lingjun Resources: High-performance compute resource groups for model development and training.
General Computing Resources: Dedicated general computing resources for AI development. For details, see Create a resource group and purchase general computing resources.
MaxCompute Resources: CPU resources from MaxCompute for algorithms in Designer. For details, see MaxCompute resource quotas.
Fully Managed Flink Resources: Used for large-scale distributed model training. For details, see Fully Managed Flink resource management.

For more information, see AI compute resources.

Members and roles

When multiple users (RAM users) need to perform management, development, or O&M tasks in the same workspace, add them as members and assign appropriate roles. PAI provides various roles. To select appropriate roles, view the role-to-permission mapping.

Add members/roles

You can assign multiple roles to a single RAM user. Supported roles:

Role type	Description
basic role	Basic roles: Administrator: Manages workspace members, resource groups, and all assets. Algorithm Developer: Performs development and model training. Algorithm O&M Engineer: Manages task priorities, model deployments, and online service monitoring. Labeling Administrator: Performs operations in Intelligent Annotation. Visitor: Has read-only access to various assets in the workspace.
compute resource role	Grants permissions for MaxCompute data development and corresponds to the developer role in DataWorks. Assign this role to RAM users who submit jobs from PAI to MaxCompute.
custom role	To add a custom role: Permission levels: No Permissions: No permissions in the specified product module. Read-only: View own and public resources in the specified product module. Modify/Execute: Edit and run own resources in the specified product module. Full Access: Manage all resources in the specified product module.

Modify member roles

Member and role rules:
- Each member must have at least one role.
- You cannot remove the Owner role. The Alibaba Cloud account or RAM user that creates a workspace is automatically assigned the Owner role. This role grants permissions to manage members, resource groups, and all assets within the workspace.
- PAI and DataWorks workspaces are interconnected. Administrator, Visitor, and Developer roles are shared. If you remove a member's last shared role in PAI, the member is also removed from the corresponding DataWorks workspace. This may trigger an entity transfer.

Resource scheduling

PAI provides workspace-level resource management and scheduling. Administrators can configure resource scheduling based on business requirements and use cases. For details, see Configure resource scheduling.

Event notifications

Configure event notifications to track and monitor the status of DLC jobs, pipeline jobs, and DSW instances, or to trigger downstream operations automatically based on model version status changes. For details, see Configure event notifications.

Storage path

Configure default storage path for the workspace:

We recommend configuring default storage for the workspace to store temporary data and models from tasks such as training.
If Data Storage is also set in Designer, the Data Storage path overrides workspace storage when running a pipeline.

SLS forwarding

Configure log forwarding for DSW instances and DLC jobs in the current workspace to Log Service (SLS) for custom analysis:

Parameter	Description
Project	Resource management unit in Log Service (SLS) for resource isolation and control. If you do not have a Project, create a Project.
LogStore	Unit for collecting, storing, and querying log data in Log Service. If you do not have a LogStore, create a LogStore.
Modules for log forwarding to SLS	Supports log forwarding for DSW instances and DLC jobs.

General settings

General settings provide the following feature toggles. Note: Restart affected instances for changes to take effect.

Public Resource Group:

Default Network Configuration: Administrators can set default network settings such as VPC and security groups. This centralized configuration helps control permissions effectively.

DLC Configurations:

Go to Node Container: Controls whether users can access compute node containers of DLC jobs for debugging or troubleshooting. When enabled, authorized users can access containers using a terminal.

DSW configurations:

SSH Logon to Instance from Internet: Controls whether users can log on to DSW instances from the internet using SSH.
Open Instance from Internet: Controls whether users can access DSW instances from the internet.
Rate Limit for Internet Access: Limits network speed of DSW instances when accessing the internet through a dedicated NAT gateway. This prevents a single instance from consuming excessive bandwidth and ensures stability of shared resources.

FAQ

"Name already exists" error when creating a workspace

If you see this error but the workspace does not appear in your PAI workspace list, a workspace with the same name may exist in DataWorks. PAI and DataWorks workspaces are interconnected at the backend. We recommend using a name unique across both services.

Empty list when configuring SLS log forwarding

Error message: denied by sts or ram, action: log:ListProject, resource: acs:log.....

Cause: The user does not have permission to read the SLS LogStore.

Solution: Grant the required permissions to the user in the Resource Access Management (RAM) console.

Set the principal to the RAM user or RAM role, and select AliyunLogFullAccess policy.

For more fine-grained permission control, go to the Log Service console. In the desired Project, use the Permission Assistant to generate a custom RAM policy.

Request fails when configuring SLS log forwarding

Error message: Modify configuration configuration failed [SLS] cannot init client for sis service: com.alibaba.pai.workspace.common.exception.ServiceExceptionV2: No Privilege error: {0}

Cause: The user does not have permission to enable or disable log forwarding for the SLS LogStore.

Solution: Grant log forwarding permissions to the user in the Resource Access Management (RAM) console. The following is a sample custom policy:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "log:GetProductDataCollection",
                "log:CloseProductDataCollection",
                "log:OpenProductDataCollection"
            ],
            "Resource": "*"
        }
    ]
}

For more fine-grained management, modify the Resource section to specify desired resources.