Platform for AI PAI コンソールへのロールベース SSO の実装 - Platform for AI - Alibaba Cloud - Platform For AI

Role-based SSO lets you log in to PAI without managing separate credentials, simplifying access while meeting enterprise security requirements.

Background information

To meet enterprise security and compliance requirements, Alibaba Cloud supports role-based SSO for accessing cloud resources. Unlike traditional account-and-password login, role-based SSO provides a more secure access method that meets higher security standards. For more information, see SAML role SSO overview.

Login methods supported by PAI

PAI supports the following three login methods:

Alibaba Cloud account login:

Log in to PAI directly with your Alibaba Cloud account or a RAM user. Your account automatically becomes a member of a PAI workspace and gains the corresponding product usage permissions.
CloudSSO login:

CloudSSO は Alibaba Cloud リソースディレクトリと統合されており、複数アカウントの ID 管理とアクセスの制御を統合的に提供します。 CloudSSO を使用すると、Alibaba Cloud リソースへのアクセスを必要とする企業ユーザーを管理し、リソースディレクトリのアカウントに対するアクセス権限をユーザーに一元的に割り当てることができます。また、設定を 1 回構成するだけで、ID プロバイダー (IdP) から Alibaba Cloud リソースへのシングルサインオン (SSO) アクセスを実装できます。
Role-based SSO login:

Access PAI through role-based SSO. A RAM role becomes a member of a PAI workspace, and users who assume that role receive the same permissions as members who log in with an Alibaba Cloud account. For more information about RAM roles, see RAM role overview.

Role-based login

Create a RAM role and configure a trust policy.

By RAM user

If you need a RAM user to assume a RAM role by switching identities on the Alibaba Cloud console, set [信頼プリンシパルタイプ] to [アカウント].

Create a RAM role for a trusted [Alibaba Cloud アカウント]. For more information, see Create a RAM role for a trusted Alibaba Cloud account.

For [信頼プリンシパル名], select [現在のアカウント].

Go to the details page of the target role and modify the trust policy.

Update the trust policy with the following script:

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "RAM": [
          "acs:ram::YOUR_ROOT_ACCOUNT_ID:root"
        ]
      }
    },    
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "dataworks.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}

In the script, the root account ID in acs:ram::root account ID:root must be replaced with your account ID. You can go to the Basic Information page to obtain your account ID.

Create one or more RAM users. For more information, see Create a RAM user.
In the [操作] column of the target RAM user, click [権限の追加]. Grant the AliyunSTSAssumeRoleAccess permission to the RAM user to allow the user to call the AssumeRole operation of STS.

By identity provider

If you need users from an identity provider (IdP) to log in to Alibaba Cloud and assume a RAM role, select [IdP] as the trusted entity type.

Create a RAM role for a trusted [IdP]. For more information, see Create a RAM role for a trusted IdP.

Go to the details page of the target role and modify the trust policy.

Update the trust policy with the following script:

{
   "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Federated": [
                    "acs:ram::YOUR_ROOT_ACCOUNT_ID:saml-provider/IDP"
                ]
            },
            "Condition": {
                "StringEquals": {
                    "saml:recipient": "https://signin.alibabacloud.com/saml-role/sso"
                }
            }
        },
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "dataworks.aliyuncs.com"
              ]
            }
        }
    ],
    "Version": "1"
}

In the script, replace root account ID in acs:ram::root account ID:saml-provider/IDP with your root account ID. You can go to the User Basic Information page to obtain the account ID.

Configure an access policy.

Add an access policy to the role based on the PAI sub-products that the user needs.

Create an access policy. For example, you can name the policy PAIDefaultPolicy. For more information, see Cloud service dependencies and authorization: Designer. On the [Policy Document] tab, enter the following content:

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "cs:GetClusterById",
                "cs:GetClusters",
                "cs:GetUserConfig",
                "cs:DescribeClusterNodes",
                "cs:DescribeClusterInnerServiceKubeconfig",
                "cs:RevokeClusterInnerServiceKubeconfig"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "vpc:DescribeVSwitchAttributes",
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches",
                "vpc:DescribeVpcAttribute"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecs:DescribeSecurityGroupAttribute",
                "ecs:DescribeSecurityGroups",
                "ecs:CreateNetworkInterface",
                "ecs:DeleteNetworkInterface",
                "ecs:DescribeNetworkInterfaces",
                "ecs:CreateNetworkInterfacePermission",
                "ecs:DescribeNetworkInterfacePermissions",
                "ecs:DeleteNetworkInterfacePermission"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "nas:DescribeFileSystems",
                "nas:CreateMountTarget",
                "nas:DescribeMountTargets",
                "nas:ModifyMountTarget",
                "nas:DescribeProtocolMountTarget"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "cr:ListNamespace",
                "cr:ListRepository",
                "cr:GetAuthorizationToken",
                "cr:ListInstanceEndpoint",
                "cr:PullRepository",
                "cr:PushRepository",
                "cr:GetInstance",
                "cr:GetInstanceVpcEndpoint",
                "cr:ListInstance",
                "cr:ListInstanceDomain"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "oss:ListBuckets",
                "oss:GetObjectMetadata",
                "oss:GetObject",
                "oss:ListObjects",
                "oss:PutObject",
                "oss:CopyObject",
                "oss:CompleteMultipartUpload",
                "oss:AbortMultipartUpload",
                "oss:InitiateMultipartUpload",
                "oss:UploadPartCopy",
                "oss:UploadPart",
                "oss:DeleteObject"
            ],
            "Resource": "acs:oss:*:*:*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "datasetacc:DescribeInstance",
                "datasetacc:DescribeSlot",
                "datasetacc:DescribeEndpoint"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Permission type	Description
cs:***	Permissions related to Container Service for Kubernetes (ACK).
vpc:***	Permissions related to Virtual Private Cloud (VPC).
ecs:***	Permissions related to Elastic Compute Service (ECS).
nas:***	Permissions related to NAS.
cr:***	Permissions related to Container Registry (ACR).
oss:***	Permissions related to Object Storage Service (OSS).
datasetacc:***	Permissions related to dataset acceleration.

On the [Resource Access Management] console, choose アイデンティティ > ロール.
Search for the role that you created in Step 1 and click the role name to go to the role details page.
On the [権限管理] tab, click [権限の付与] to grant the created access policy to the role.

In the Grant Permission panel, set Authorized Scope to Alibaba Cloud Account. In the permission policy search box, search for and select the PAIDefaultPolicy custom policy, and then click OK.

Add the RAM role to a PAI workspace and grant permissions.

A RAM role must be added as a workspace member to use PAI sub-products. A workspace administrator can add the created RAM role on the [メンバーとロール] page of the workspace. For more information, see Manage workspace members. In the Add Members panel, click the User/Role tab, search for and select the target RAM role from the list of members to be added, assign a workspace role from the Assign Role(s) drop-down list at the bottom, and then click OK.
説明
If you cannot find the role that you created, try the following:
- In the Add Members panel, click Refresh to update the account list.
- Try logging in to the PAI console by assuming the RAM role, and then search for and add the role again. For more information, see Assume a RAM role.
Log in to the PAI console to start algorithm development.

After authorization is complete, a user can assume the RAM role to log in to the PAI console and start algorithm development. For more information, see Assume a RAM role.