Platform For AI：雲產品依賴與授權：LangStudio

查看AliyunPAILangStudioDefaultRole預設權限原則。

1. 登入RAM控制台，並在左側導覽列選擇身份管理 > 角色。

2. 在角色頁面的搜尋方塊中，輸入AliyunPAILangStudioDefaultRole進行搜尋，並單擊目標角色名稱。

3. 在許可權管理頁面單擊權限原則名稱，查看並拷貝預設策略內容。

   {
     "Version": "1",
     "Statement": [
       {
         "Action": [
           "eas:CreateService",
           "eas:ListServices",
           "eas:DescribeService",
           "eas:DeleteService",
           "eas:UpdateService",
           "eas:StartService",
           "eas:StopService"
         ],
         "Resource": "*",
         "Effect": "Allow"
       },
       {
         "Action": [
           "oss:GetObject",
           "oss:PutObject",
           "oss:DeleteObject",
           "oss:ListObjects"
         ],
         "Resource": "*",
         "Effect": "Allow"
       },
       {
         "Action": [
           "paillmtrace:GetXtraceToken"
         ],
         "Resource": "*",
         "Effect": "Allow"
       },
       {
         "Action": [
           "paidlc:CreateJob",
           "paidlc:DeleteJob",
           "paidlc:StopJob",
           "paidlc:GetJob",
           "paidlc:UpdateJob",
           "paidlc:ListJobs"
         ],
         "Resource": "*",
         "Effect": "Allow"
       },
       {
         "Action": [
           "paidsw:CreateInstance",
           "paidsw:DeleteInstance",
           "paidsw:UpdateInstance",
           "paidsw:StartInstance",
           "paidsw:StopInstance",
           "paidsw:GetInstance",
           "paidsw:ListInstances"
         ],
         "Resource": "*",
         "Effect": "Allow"
       },
       {
         "Action": "pai:AssumeUser",
         "Resource": "acs:pai:*:*:users/*",
         "Effect": "Allow"
       },
       {
         "Action": "ram:CreateServiceLinkedRole",
         "Resource": "*",
         "Effect": "Allow",
         "Condition": {
           "StringEquals": {
             "ram:ServiceName": "eas.pai.aliyuncs.com"
           }
         }
       },
       {
         "Action": [
           "dataworks:CreateWorkflowDefinition",
           "dataworks:UpdateWorkflowDefinition",
           "dataworks:GetWorkflowDefinition",
           "dataworks:ListWorkflowDefinitions",
           "dataworks:DeleteWorkflowDefinition",
           "dataworks:CreateDeployment",
           "dataworks:GetDeployment",
           "dataworks:ExecDeploymentStage",
           "dataworks:GetJobStatus",
           "dataworks:ImportWorkflowDefinition"
         ],
         "Resource": "*",
         "Effect": "Allow"
       },
       {
         "Action": [
           "paiflow:CreatePipelineRun",
           "paiflow:GetPipelineRun",
           "paiflow:DeletePipelineRun",
           "paidataset:CreateDataset",
           "paidataset:GetDataset",
           "paidataset:UpdateDataset",
           "paidataset:ListDatasets",
           "paidataset:DeleteDataset",
           "paidataset:CreateDatasetVersion",
           "paidataset:GetDatasetVersion",
           "paidataset:UpdateDatasetVersion",
           "paidataset:DeleteDatasetVersion",
           "paidataset:ListDatasetVersions"
         ],
         "Resource": "*",
         "Effect": "Allow"
       }
     ]
   }

通過指令碼編輯模式建立自訂權限原則，其中：

• 權限原則內容可根據上述拷貝的預設策略內容進行修改。例如，修改OSS授權策略內容，修改為通過RAM的Condition屬性指定可訪問的OSS Bucket，樣本內容如下（實際使用時需移除所有的注釋）：

  {
      "Version": "1", 
      "Statement": [
          //其他授權策略，不要修改
  
          //修改OSS授權策略，通過指定Tag限定授權訪問的OSS資源
          {
              "Action": [
                  "oss:GetObject", 
                  "oss:PutObject", 
                  "oss:DeleteObject", 
                  "oss:ListObjects"
              ], 
              "Resource": "*", 
              "Effect": "Allow", 
              "Condition": {
                  "StringEquals": {
                      "oss:BucketTag/Product": "PaiLangStudio"
                  }
              }
          }
      ]
  }

  說明

  OSS支援對Bucket打標籤，您可以對授權LangStudio訪問的Bucket打上標籤（Key-Value索引值對），例如Key:Product, Value:PaiLangStudio。具體操作，請參見管理儲存空間標籤。

• 名稱配置為CustomAliyunPAILangStudioDefaultRolePolicy。

將新建立的自訂權限原則CustomAliyunPAILangStudioDefaultRolePolicy添加到AliyunPAILangStudioDefaultRole角色，並解除該角色預設的授權策略AliyunPAILangStudioDefaultRolePolicy。具體操作，請參見為RAM角色授權和為RAM角色移除許可權。

更新成功後，LangStudio則會按照新增的授權策略訪問您的資源。