# 策略授权参考 本章节介绍AI DataLake服务策略授权场景下支持的策略授权项。 #### 支持的授权项 策略包含系统策略和自定义策略，如果系统策略不满足授权要求，管理员可以创建自定义策略，并通过给用户组授予自定义策略来进行精细的访问控制。策略支持的操作与API相对应，授权项列表说明如下： - 权限：允许或拒绝某项操作。 - 对应API接口：自定义策略实际调用的API接口。 - 授权项：自定义策略中支持的Action，在自定义策略中的Action中写入授权项，可以实现授权项对应的权限功能。 - 依赖的授权项：部分Action存在对其他Action的依赖，需要将依赖的Action同时写入授权项，才能实现对应的权限功能。 - IAM项目(Project)/企业项目(Enterprise Project)：自定义策略的授权范围，包括IAM项目与企业项目。授权范围如果同时支持IAM项目和企业项目，表示此授权项对应的自定义策略，可以在IAM和企业管理两个服务中给用户组授权并生效。如果仅支持IAM项目，不支持企业项目，表示仅能在IAM中给用户组授权并生效，如果在企业管理中授权，则该自定义策略不生效。管理员可以在授权项列表中查看授权项是否支持IAM项目或企业项目，"√"表示支持，"×"表示暂不支持。关于IAM项目与企业项目的区别，详情请参见：[IAM与企业管理的区别](https://support.huaweicloud.com/iam_faq/iam_01_0101.html)。 AI DataLake服务支持自定义策略授权项如下所示： 表1API授权项列表 | 权限 | 对应API接口 | 授权项（Action） | 依赖的授权项 | IAM项目 (Project) | 企业项目 (Enterprise Project) | |:---|:---|:---|:---|:---|:---| | 创建工作空间 | POST /v2/workspaces | DataArtsFabric:workspace:create | lakeformation:instance:show | √ | √ | | 查询workspace列表 | GET /v2/workspaces | DataArtsFabric:workspace:list | - | √ | √ | | 查询workspace详细信息 | GET /v2/workspaces/{workspace_id} | DataArtsFabric:workspace:list | - | √ | √ | | 修改 workspace | PUT /v2/workspaces/{workspace_id} | DataArtsFabric:workspace:alter | lakeformation:instance:show | √ | × | | 删除workspace | DELETE /v2/workspaces/{workspace_id} | DataArtsFabric:workspace:drop | - | √ | × | | 创建计算资源 | POST /v2/workspaces/{workspace_id}/computes | DataArtsFabric:workspace:createCompute | - | √ | × | | 查询计算资源列表 | GET /v2/workspaces/{workspace_id}/computes | DataArtsFabric:workspace:listCompute | - | √ | × | | 查看计算资源详情 | GET /v2/workspaces/{workspace_id}/computes/{compute_id} | DataArtsFabric:workspace:listCompute | - | √ | × | | 查询计算资源操作记录列表 | GET /v2/workspaces/{workspace_id}/computes/versions | DataArtsFabric:workspace:listCompute | - | √ | × | | 删除计算资源 | DELETE /v2/workspaces/{workspace_id}/computes/{compute_id} | DataArtsFabric:workspace:dropCompute | - | √ | × | | 修改计算资源 | PUT /v2/workspaces/{workspace_id}/computes/{compute_id} | DataArtsFabric:workspace:alterCompute | - | √ | × | | 查询计算资源指标 | GET /v2/workspaces/{workspace_id}/computes/metrics | DataArtsFabric:workspace:listComputeMetrics | - | √ | × | | 查询镜像列表 | GET /v2/workspaces/{workspace_id}/images | DataArtsFabric:workspace:listImages | - | √ | × | | 查看自定义镜像版本列表 | GET /v2/workspaces/{workspace_id}/images/{image_id}/versions | DataArtsFabric:workspace:listImages | - | √ | × | | 注册镜像 | POST /v2/workspaces/{workspace_id}/images | DataArtsFabric:workspace:registerImage | - swr:repo:listRepos - swr:repo:createRepoDomain - swr:repo:listRepoTags | √ | × | | 添加自定义镜像版本 | POST /v2/workspaces/{workspace_id}/images/{image_id}/versions | DataArtsFabric:workspace:registerImage | - swr:repo:listRepos - swr:repo:createRepoDomain - swr:repo:listRepoTags | √ | × | | 修改镜像 | PUT /v2/workspaces/{workspace_id}/images/{image_id}/versions/{version_id} | DataArtsFabric:workspace:updateImage | - | √ | × | | 删除镜像 | DELETE /v2/workspaces/{workspace_id}/images/{image_id} | DataArtsFabric:workspace:deleteImage | - | √ | × | | 删除指定镜像版本 | DELETE /v2/workspaces/{workspace_id}/images/{image_id}/versions/{version_id} | DataArtsFabric:workspace:deleteImage | - | √ | × | | 查询镜像详情 | GET /v2/workspaces/{workspace_id}/images/{image_id} | DataArtsFabric:workspace:showImage | - | √ | × | | 查看自定义镜像版本 | GET /v2/workspaces/{workspace_id}/images/{image_id}/versions/{version_id} | DataArtsFabric:workspace:showImage | - | √ | × | | 查询endpoint列表 | GET /v2/workspaces/{workspace_id}/endpoints | DataArtsFabric:endpoint:list | - | √ | × | | 查询用户可用的endpoint列表 | GET /v2/endpoints | DataArtsFabric:endpoint:list | - | √ | × | | 创建endpoint | POST /v2/workspaces/{workspace_id}/endpoints | DataArtsFabric:endpoint:create | - obs:bucket:listBucketVersions - obs:bucket:listAllMyBuckets - obs:bucket:listBucket | √ | × | | 查询endpoint详情 | GET /v2/workspaces/{workspace_id}/endpoints/{endpoint_id} | DataArtsFabric:endpoint:show | - | √ | × | | 查询端点监控 | GET /v2/workspaces/{workspace_id}/endpoints/{endpoint_id}/metrics | DataArtsFabric:endpoint:show | - | √ | × | | 修改endpoint | PUT /v2/workspaces/{workspace_id}/endpoints/{endpoint_id} | DataArtsFabric:endpoint:alter | - | √ | × | | 删除endpoint | DELETE /v2/workspaces/{workspace_id}/endpoints/{endpoint_id} | DataArtsFabric:endpoint:drop | - DataArtsFabric:job:listJobInstance - DataArtsFabric:service:listInstance | √ | × | | 查询资源池资源限制 | GET /v2/workspaces/{workspace_id}/endpoint-limit | DataArtsFabric:endpoint:showResourceLimit | - | √ | × | | 创建标签 | POST /v2/{project_id}/{resource_type}/{resource_id}/tags/create | DataArtsFabric::tagResource | - | √ | × | | 删除标签 | POST /v2/{project_id}/{resource_type}/{resource_id}/tags/delete | DataArtsFabric::unTagResource | - | √ | × | | 获取标签列表 | GET /v2/{project_id}/{resource_type}/tags | DataArtsFabric::listTags | - | √ | × | | 查询指定资源标签 | GET /v2/{project_id}/{resource_type}/{resource_id}/tags | DataArtsFabric::listTagsForResource | - | √ | × | | 标签查询资源列表 | POST /v2/{project_id}/{resource_type}/resource-instances/filter | DataArtsFabric::listResourcesByTag | - | √ | √ | | 取消作业运行 | POST /v2/workspaces/{workspace_id}/ray-jobs/{job_id}/cancel | DataArtsFabric:rayJob:cancel | - | √ | × | | 查询Ray作业列表 | GET /v2/workspaces/{workspace_id}/ray-jobs | DataArtsFabric:rayJob:list | - | √ | × | | 运行作业 | POST /v2/workspaces/{workspace_id}/ray-jobs | DataArtsFabric:rayJob:run | - | √ | × | | 查询作业详情 | GET /v2/workspaces/{workspace_id}/ray-jobs/{job_id} | DataArtsFabric:rayJob:show | - | √ | × | | 创建RaySession会话 | POST /v2/workspaces/{workspace_id}/ray-sessions | DataArtsFabric:raySession:create | DataArtsFabric:workspace:list | √ | × | | 关闭RaySession会话 | DELETE /v2/workspaces/{workspace_id}/ray-sessions/{session_id} | DataArtsFabric:raySession:cancel | DataArtsFabric:workspace:list | √ | × | | 启动Spark作业 | POST /v2/workspaces/{workspace_id}/spark-jobs | DataArtsFabric:sparkJob:run | - DataArtsFabric:workspace:list - DataArtsFabric:endpoint:show - DataArtsFabric:endpoint:list | √ | × | | 查询Spark作业列表 | GET /v2/workspaces/{workspace_id}/spark-jobs | DataArtsFabric:sparkJob:list | - DataArtsFabric:workspace:list - DataArtsFabric:endpoint:list | √ | × | | 查看Spark作业详情 | GET /v2/workspaces/{workspace_id}/spark-jobs/{job_id} | DataArtsFabric:sparkJob:show | DataArtsFabric:workspace:list | √ | × | | 查询Spark作业状态 | GET /v2/workspaces/{workspace_id}/spark-jobs/{job_id}/state | DataArtsFabric:sparkJob:show | DataArtsFabric:workspace:list | √ | × | | 取消Spark作业 | POST /v2/workspaces/{workspace_id}/spark-jobs/{job_id}/cancel | DataArtsFabric:sparkJob:stop | DataArtsFabric:workspace:list | √ | × | | 查看Spark作业提交日志 | POST /v2/workspaces/{workspace_id}/spark-jobs/{job_id}/show-submit-log | DataArtsFabric:sparkJob:show | DataArtsFabric:workspace:list | √ | × | | 执行SparkSql作业 | POST /v2/workspaces/{workspace_id}/spark-sqls | DataArtsFabric:sparkSql:run | - DataArtsFabric:workspace:list - DataArtsFabric:endpoint:show - DataArtsFabric:endpoint:list | √ | × | | 查询SparkSql作业列表 | GET /v2/workspaces/{workspace_id}/spark-sqls | DataArtsFabric:sparkSql:list | - DataArtsFabric:workspace:list - DataArtsFabric:endpoint:list | √ | × | | 查看SparkSql作业详情 | GET /v2/workspaces/{workspace_id}/spark-sqls/{statement_id} | DataArtsFabric:sparkSql:show | DataArtsFabric:workspace:list | √ | × | | 查询SparkSql作业状态 | GET /v2/workspaces/{workspace_id}/spark-sqls/{statement_id}/state | DataArtsFabric:sparkSql:show | DataArtsFabric:workspace:list | √ | × | | 取消SparkSql作业 | POST /v2/workspaces/{workspace_id}/spark-sqls/{statement_id}/cancel | DataArtsFabric:sparkSql:stop | DataArtsFabric:workspace:list | √ | × | | 预览SparkSql作业查询结果 | POST /v2/workspaces/{workspace_id}/spark-sqls/{statement_id}/preview | DataArtsFabric:sparkSql:show | DataArtsFabric:workspace:list | √ | × | | 重启SparkSql集群 | POST /v2/workspaces/{workspace_id}/endpoints/{endpoint_name}/spark-sqls/restart-cluster | DataArtsFabric:endpoint:restart | - DataArtsFabric:workspace:list - DataArtsFabric:endpoint:show - DataArtsFabric:endpoint:list | √ | × | | 查询Spark异步操作状态 | POST /v2/workspaces/{workspace_id}/spark-operators/{operation_id}/show-state | DataArtsFabric:sparkOperator:show | - DataArtsFabric:workspace:list - DataArtsFabric:endpoint:list | √ | × | | 创建sql session | POST /v2/workspaces/{workspace_id}/aura-sessions | DataArtsFabric:workspace:createSqlSession | -- | √ | × | | 执行statement | POST /v2/workspaces/{workspace_id}/aura-sessions/statements | DataArtsFabric:workspace:executeStatement | DataArtsFabric:endpoint:show | √ | × | | 查询statement结果 | GET /v2/workspaces/{workspace_id}/aura-sessions/{session_id}/statements/{statement_id} | DataArtsFabric:workspace:showStatementResult | DataArtsFabric:endpoint:show | √ | × | | 查询sql session信息 | GET /v2/workspaces/{workspace_id}/aura-sessions/{session_id} | DataArtsFabric:workspace:showSqlSession | DataArtsFabric:endpoint:show | √ | × | | 查询sql session列表 | GET /v2/workspaces/{workspace_id}/aura-sessions | DataArtsFabric:workspace:listSqlSessions | DataArtsFabric:endpoint:show | √ | × | | 查询session 下 statement历史记录 | GET /v2/workspaces/{workspace_id}/aura-sessions/{session_id}/statements | DataArtsFabric:workspace:listSessionStatementRecords | DataArtsFabric:endpoint:show | √ | × | | 删除sql session | DELETE /v2/workspaces/{workspace_id}/aura-sessions/{session_id} | DataArtsFabric:workspace:deleteSqlSession | -- | √ | × | | 取消statement 执行 | POST /v2/workspaces/{workspace_id}/aura-sessions/{session_id}/statements/{statement_id}/cancel | DataArtsFabric:workspace:cancelStatement | DataArtsFabric:endpoint:show | √ | × | | 查询statement历史记录 | GET /v2/workspaces/{workspace_id}/aura-statement-records | DataArtsFabric:workspace:listStatementRecords | DataArtsFabric:endpoint:show | √ | × | | 查询AuraJobV2监控指标 | GET /v2/workspaces/{workspace_id}/aura-sessions/{session_id}/statements/{statement_id}/query-metrics | DataArtsFabric:endpoint:show | - | √ | × | | 查询AuraJobV2算子监控 | GET /v2/workspaces/{workspace_id}/aura-sessions/{session_id}/statements/{statement_id}/operator-metrics | DataArtsFabric:endpoint:show | - | √ | × |