资产管理权限

场景级授权示例

• IAM新版控制台：提供基于IAM5.0版本的系统身份策略。用户可以在IAM服务新版控制台创建新的自定义策略，将创建的自定义策略授权给用户所在的用户组。由于部分模块未完全对接IAM5.0，目前还需在IAM服务旧版控制台创建新的自定义策略，配置以下IAM3.0的策略，将创建的自定义策略授权给用户所在的用户组。详情可参照下表配置。

  表1 基于要执行操作场景的授权

  操作场景	示例	还需在IAM旧版控制台配置的IAM3.0策略
  读写（IAM5.0）	{ "Version": "5.0", "Statement": [ { "Action": [ "modelarts:trainJob:list", "modelarts:service:list", "modelarts:image:deleteGroup", "modelarts:image:updateGroup", "modelarts:image:list", "modelarts:image:listGroup", "modelarts:image:get", "modelarts:image:register", "modelarts:image:sync", "modelarts:image:delete", "modelarts:authorization:list", "swr:namespace:getNamespace", "swr:repo:listRepoTags", "swr:repo:deleteRepoTag", "swr:repository:getTag", "swr:repository:deleteTag", "swr:repo:listRepos", "swr:repository:listRepositories", "swr:repository:listArtifacts", "swr:repo:getRepo", "swr:repo:getRepoDomain", "swr:repo:createRepoDomain", "swr:instance:list", "obs:bucket:ListBucket", "obs:object:GetObject", "modelarts:clusterFlavor:list", "modelarts:fusionJob:get", "modelarts:fusionJob:getEventsCategories", "modelarts:tag:list", "modelarts:trainJob:get", "modelarts:trainJob:getFtArtifacts", "modelarts:trainJob:getFtDetail", "modelarts:trainJob:getFtMetrics", "modelarts:workspace:get", "lts:groups:get", "lts:topics:get", "lts:groups:create", "lts:groups:list", "lts:topics:create", "lts:topics:delete", "lts:topics:list", "sfsturbo:shares:getShare", "sfsturbo:shares:showFsDir", "obs:object:DeleteObject", "obs:bucket:CreateBucket", "obs:object:PutObject", "obs:bucket:GetBucketAcl", "obs:bucket:PutBucketAcl", "csms:secretVersion:get", "modelarts:pool:list", "modelarts:pool:get", "modelarts:trainJob:listAll", "obs:bucket:ListAllMyBuckets" ], "Effect": "Allow" } ] }	{ "Version": "1.1", "Statement": [ { "Effect": "Allow", "Action": [ "modelarts:fusionJob:get", "modelarts:service:list", "modelarts:trainJob:get", "modelarts:trainJob:list", "modelarts:trainJob:listAll", "modelarts:workspace:get" ] } ] }
  只读（IAM5.0）	{ "Version": "5.0", "Statement": [ { "Action": [ "modelarts:trainJob:list", "modelarts:service:list", "modelarts:image:list", "modelarts:image:listGroup", "modelarts:image:get", "modelarts:authorization:list", "swr:namespace:getNamespace", "swr:repo:listRepoTags", "swr:repository:getTag", "swr:repo:listRepos", "swr:repository:listRepositories", "swr:repository:listArtifacts", "swr:repo:getRepo", "swr:repo:getRepoDomain", "swr:instance:list", "obs:bucket:ListBucket", "obs:object:GetObject", "modelarts:clusterFlavor:list", "modelarts:fusionJob:get", "modelarts:fusionJob:getEventsCategories", "modelarts:tag:list", "modelarts:trainJob:get", "modelarts:trainJob:getFtArtifacts", "modelarts:trainJob:getFtDetail", "modelarts:trainJob:getFtMetrics", "modelarts:workspace:get", "lts:groups:get", "lts:topics:get", "lts:groups:list", "lts:topics:list", "sfsturbo:shares:getShare", "sfsturbo:shares:showFsDir", "obs:bucket:GetBucketAcl", "csms:secretVersion:get", "modelarts:pool:list", "modelarts:pool:get", "modelarts:trainJob:listAll", "obs:bucket:ListAllMyBuckets" ], "Effect": "Allow" } ] }	{ "Version": "1.1", "Statement": [ { "Effect": "Allow", "Action": [ "modelarts:fusionJob:get", "modelarts:service:list", "modelarts:trainJob:get", "modelarts:trainJob:list", "modelarts:trainJob:listAll", "modelarts:workspace:get" ] } ] }

• IAM旧版控制台：不提供基于IAM3.0版本的系统身份策略，用户需要在IAM服务旧版控制台自定义身份策略来进行场景级授权配置。详情参考下表进行配置。

  表2 基于要执行操作场景的授权

  操作场景	示例
  读写（IAM3.0）	{ "Version": "1.1", "Statement": [ { "Action": [ "modelarts:trainJob:list", "modelarts:service:list", "modelarts:image:deleteGroup", "modelarts:image:updateGroup", "modelarts:image:list", "modelarts:image:listGroup", "modelarts:image:get", "modelarts:image:register", "modelarts:image:sync", "modelarts:image:delete", "modelarts:authorization:list", "swr:namespace:getNamespace", "swr:repo:listRepoTags", "swr:repo:deleteRepoTag", "swr:repository:getTag", "swr:repository:deleteTag", "swr:repo:listRepos", "swr:repository:listRepositories", "swr:repository:listArtifacts", "swr:repo:getRepo", "swr:repo:getRepoDomain", "swr:repo:createRepoDomain", "swr:instance:list", "obs:bucket:ListBucket", "obs:object:GetObject", "modelarts:clusterFlavor:list", "modelarts:fusionJob:get", "modelarts:fusionJob:getEventsCategories", "modelarts:tag:list", "modelarts:trainJob:get", "modelarts:trainJob:getFtArtifacts", "modelarts:trainJob:getFtDetail", "modelarts:trainJob:getFtMetrics", "modelarts:workspace:get", "lts:groups:get", "lts:topics:get", "lts:groups:create", "lts:groups:list", "lts:topics:create", "lts:topics:delete", "lts:topics:list", "sfsturbo:shares:getShare", "sfsturbo:shares:showFsDir", "obs:object:DeleteObject", "obs:bucket:CreateBucket", "obs:object:PutObject", "obs:bucket:GetBucketAcl", "obs:bucket:PutBucketAcl", "csms:secretVersion:get", "modelarts:pool:list", "modelarts:pool:get", "modelarts:trainJob:listAll", "obs:bucket:ListAllMyBuckets" ], "Effect": "Allow" } ] }
  只读（IAM3.0）	{ "Version": "1.1", "Statement": [ { "Action": [ "modelarts:trainJob:list", "modelarts:service:list", "modelarts:image:list", "modelarts:image:listGroup", "modelarts:image:get", "modelarts:authorization:list", "swr:namespace:getNamespace", "swr:repo:listRepoTags", "swr:repository:getTag", "swr:repo:listRepos", "swr:repository:listRepositories", "swr:repository:listArtifacts", "swr:repo:getRepo", "swr:repo:getRepoDomain", "swr:instance:list", "obs:bucket:ListBucket", "obs:object:GetObject", "modelarts:clusterFlavor:list", "modelarts:fusionJob:get", "modelarts:fusionJob:getEventsCategories", "modelarts:tag:list", "modelarts:trainJob:get", "modelarts:trainJob:getFtArtifacts", "modelarts:trainJob:getFtDetail", "modelarts:trainJob:getFtMetrics", "modelarts:workspace:get", "lts:groups:get", "lts:topics:get", "lts:groups:list", "lts:topics:list", "sfsturbo:shares:getShare", "sfsturbo:shares:showFsDir", "obs:bucket:GetBucketAcl", "csms:secretVersion:get", "modelarts:pool:list", "modelarts:pool:get", "modelarts:trainJob:listAll", "obs:bucket:ListAllMyBuckets" ], "Effect": "Allow" } ] }

接口级授权说明

如果您需要使用ModelArts管理控制台资产管理的相关功能并进行权限管理，可参照下文进行操作。