策略授权参考
本章节介绍DataArts Fabric策略授权场景下支持的策略授权项。
支持的授权项
策略包含系统策略和自定义策略，如果系统策略不满足授权要求，管理员可以创建自定义策略，并通过给用户组授予自定义策略来进行精细的访问控制。策略支持的操作与API相对应，授权项列表说明如下：
- 权限：允许或拒绝某项操作。
- 对应API接口：自定义策略实际调用的API接口。
- 授权项：自定义策略中支持的Action，在自定义策略中的Action中写入授权项，可以实现授权项对应的权限功能。
- 依赖的授权项：部分Action存在对其他Action的依赖，需要将依赖的Action同时写入授权项，才能实现对应的权限功能。
- IAM项目（Project）/企业项目（Enterprise Project）：自定义策略的授权范围，包括IAM项目与企业项目。授权范围如果同时支持IAM项目和企业项目，表示此授权项对应的自定义策略，可以在IAM和企业管理两个服务中给用户组授权并生效。如果仅支持IAM项目，不支持企业项目，表示仅能在IAM中给用户组授权并生效，如果在企业管理中授权，则该自定义策略不生效。管理员可以在授权项列表中查看授权项是否支持IAM项目或企业项目，“√”表示支持，“×”表示暂不支持。关于IAM项目与企业项目的区别，详情请参见IAM与企业管理的区别。
DataArts Fabric的支持自定义策略授权项如下所示：
生命周期管理
| 权限 | 对应API接口 | 授权项（Action） | 依赖的授权项 | IAM项目 (Project) | 企业项目 (Enterprise Project) |
|---|---|---|---|---|---|
| 查询Workspace列表 | GET /v1/workspaces | DataArtsFabric:workspace:list | - | √ | √ |
| 创建Workspace | POST /v1/workspaces | DataArtsFabric:workspace:create | lakeformation:instance:describe | √ | √ |
| 修改Workspace | PUT /v1/workspaces/{workspace_id} | DataArtsFabric:workspace:alter | lakeformation:instance:describe | √ | × |
| 修改Workspace监控配置 | PUT /v1/workspaces/{workspace_id}/metrics | DataArtsFabric:workspace:alterMetrics | - | √ | × |
| 删除Workspace | DELETE /v1/workspaces/{workspace_id} | DataArtsFabric:workspace:drop | - | √ | × |
| 查询计算资源 | GET /v1/workspaces/{workspace_id}/computes | DataArtsFabric:workspace:listCompute | - | √ | × |
| 创建计算资源 | POST /v1/workspaces/{workspace_id}/computes | DataArtsFabric:workspace:createCompute | - | √ | × |
| 修改计算资源 | PUT /v1/workspaces/{workspace_id}/computes/{compute_id} | DataArtsFabric:workspace:alterCompute | - | √ | × |
| 删除计算资源 | DELETE /v1/workspaces/{workspace_id}/computes/{compute_id} | DataArtsFabric:workspace:dropCompute | - | √ | × |
| 查询Workspace的Endpoint列表 | GET /v1/workspaces/{workspace_id}/endpoints | DataArtsFabric:endpoint:list | - | √ | × |
| 创建Workspace的Endpoint | POST /v1/workspaces/{workspace_id}/endpoints | DataArtsFabric:endpoint:create | - | √ | × |
| 查询Workspace的Endpoint详情 | GET /v1/workspaces/{workspace_id}/endpoints/{endpoint_id} | DataArtsFabric:endpoint:show | - | √ | × |
| 修改Workspace的Endpoint | PUT /v1/workspaces/{workspace_id}/endpoints/{endpoint_id} | DataArtsFabric:endpoint:alter | - | √ | × |
| 删除Workspace的Endpoint | DELETE /v1/workspaces/{workspace_id}/endpoints/{endpoint_id} | DataArtsFabric:endpoint:drop | DataArtsFabric:job:listJobInstance DataArtsFabric:service:listInstance | √ | × |
| 订阅公共端点 | POST /v1/workspaces/{workspace_id}/endpoints/{endpoint_id}/subscribe | DataArtsFabric:endpoint:subscribe | - | √ | × |
| 查询作业列表 | GET /v1/workspaces/{workspace_id}/jobs | DataArtsFabric:job:list | - | √ | × |
| 创建作业 | POST /v1/workspaces/{workspace_id}/jobs | DataArtsFabric:job:create | - | √ | × |
| 查询作业 | GET /v1/workspaces/{workspace_id}/jobs/{job_id}/versions | DataArtsFabric:job:show | - | √ | × |
| 修改作业 | PUT /v1/workspaces/{workspace_id}/jobs/{job_id} | DataArtsFabric:job:alter | - | √ | × |
| 删除作业 | DELETE /v1/workspaces/{workspace_id}/jobs/{job_id} | DataArtsFabric:job:drop | DataArtsFabric:job:listJobInstance | √ | × |
| 创建模型 | POST /v1/workspaces/{workspace_id}/models | DataArtsFabric:model:create | obs:bucket:HeadBucket obs:bucket:ListBucketVersions obs:bucket:ListAllMyBuckets obs:bucket:ListBucket | √ | × |
| 查询模型列表 | GET /v1/workspaces/{workspace_id}/models | DataArtsFabric:model:list | - | √ | × |
| 查询模型 | GET /v1/workspaces/{workspace_id}/models/{model_id}/versions | DataArtsFabric:model:show | - | √ | × |
| 删除模型 | DELETE /v1/workspaces/{workspace_id}/models/{model_id}/versions | DataArtsFabric:model:drop | DataArtsFabric:service:listInstance | √ | × |
| 修改模型 | PUT /v1/workspaces/{workspace_id}/models/{model_id}/versions | DataArtsFabric:model:alter | - | √ | × |
| 创建标签 | POST /v1/{project_id}/fabric-workspace/{workspace_id}/tags/create | DataArtsFabric:workspace:tagResource | - | √ | × |
| 删除标签 | POST /v1/{project_id}/fabric-workspace/{workspace_id}/tags/delete | DataArtsFabric:workspace:unTagResource | - | √ | × |
| 获取标签列表 | GET /v1/{project_id}/fabric-workspace/tags | DataArtsFabric:workspace:listTags | - | √ | × |
| 查询指定资源标签 | GET /v1/{project_id}/fabric-workspace/{workspace_id}/tags | DataArtsFabric:workspace:listTagsForResource | - | √ | × |
| 标签查询资源列表 | POST /v1/{project_id}/fabric-workspace/resource-instances/filter | DataArtsFabric:workspace:listResourcesByTag | - | √ | √ |
| 创建消息通知策略 | POST /v1/workspaces/{workspace_id}/messages | DataArtsFabric:workspace:createMessagePolicy | iam:agencies:listAgencies iam:roles:listRoles iam:permissions:listRolesForAgency smn:topic:list | √ | × |
| 查询消息通知策略列表 | GET /v1/workspaces/{workspace_id}/messages | DataArtsFabric:workspace:listMessagePolicy | - | √ | × |
| 删除消息通知策略 | DELETE /v1/workspaces/{workspace_id}/messages/{message_policy_id} | DataArtsFabric:workspace:deleteMessagePolicy | - | √ | × |
| 查询运行作业列表 | GET /v1/workspaces/{workspace_id}/jobs/runs | DataArtsFabric:job:listJobInstance | DataArtsFabric:workspace:list | √ | × |
| 运行作业 | POST /v1/workspaces/{workspace_id}/jobs/runs | DataArtsFabric:job:run | DataArtsFabric:workspace:list DataArtsFabric:endpoint:show | √ | × |
| 查询运行作业 | GET /v1/workspaces/{workspace_id}/jobs/runs/{run_id} | DataArtsFabric:job:showJobInstance | DataArtsFabric:workspace:list DataArtsFabric:endpoint:show | √ | × |
| 删除运行作业 | DELETE /v1/workspaces/{workspace_id}/jobs/runs/{run_id} | DataArtsFabric:job:dropJobInstance | DataArtsFabric:workspace:list DataArtsFabric:endpoint:show | √ | × |
| 取消运行作业 | POST /v1/workspaces/{workspace_id}/jobs/runs/{run_id}/cancel | DataArtsFabric:job:cancelJobInstance | DataArtsFabric:workspace:list DataArtsFabric:endpoint:show | √ | × |
| 调用推理服务实例 | POST /v1/workspaces/{workspace_id}/services/instances/{instance_id}/invocations | DataArtsFabric:model:inference | DataArtsFabric:workspace:list DataArtsFabric:endpoint:show | √ | × |
| 查询路由列表 | GET /v1/workspaces/{workspace_id}/routes | DataArtsFabric:workspace:listRoute | DataArtsFabric:workspace:list | √ | × |
| 查询session信息 | POST /v1/sessions | DataArtsFabric:workspace:showSession | - | √ | × |
