# 开发环境权限 #### 场景级授权示例 - IAM新版控制台：提供基于IAM5.0版本的系统身份策略。用户可以直接在[IAM服务新版控制台](https://console.huaweicloud.com/iam5/)进行场景级授权配置。 表1IAM新版控制台授权管理操作场景的授权 | 策略名称 | 描述 | 类型 | |:---|:---|:---| | ModelArtsNotebookAllPolicy | ModelArts服务"模型开发-Notebook"的所有策略(读写) | 系统身份策略 | | ModelArtsNotebookReadOnlyPolicy | ModelArts服务"模型开发-Notebook"的只读策略 | 系统身份策略 | - IAM旧版控制台：需要用户在[IAM服务旧版控制台](https://console.huaweicloud.com/iam/)自定义身份策略来进行场景级授权配置，将创建的自定义策略授权给用户所在的用户组。详情参考下表进行配置。 表2基于要执行操作场景的授权 | 操作场景 | 示例 | |:---|:---| | 读写（IAM3.0） | ``` { "Version": "1.1", "Statement": [ { "Action": [ "modelarts:authorization:list", "modelarts:image:create", "modelarts:image:delete", "modelarts:image:get", "modelarts:image:list", "modelarts:image:listGroup", "modelarts:image:register", "modelarts:network:get", "modelarts:network:list", "modelarts:notebook:create", "modelarts:notebook:delete", "modelarts:notebook:get", "modelarts:notebook:getMountedStorage", "modelarts:notebook:list", "modelarts:notebook:listAllNotebooks", "modelarts:notebook:listMountedStorages", "modelarts:notebook:mountStorage", "modelarts:notebook:start", "modelarts:notebook:stop", "modelarts:notebook:umountStorage", "modelarts:notebook:update", "modelarts:notebook:updateStopPolicy", "modelarts:pool:get", "modelarts:pool:list", "modelarts:tag:list", "modelarts:trainJob:create", "modelarts:trainJob:get", "modelarts:trainJob:list", "modelarts:trainJob:logExport", "modelarts:trainJob:update", "modelarts:trainJobVersion:delete", "modelarts:workspace:getQuotas", "modelarts:workspace:get", "aom:alarm:list", "aom:metric:get", "aom:metric:list", "csms:secret:create", "csms:secret:list", "csms:secret:get", "csms:secret:getVersion", "iam:projects:listProjects", "iam:users:listUsers", "kms:cmk:list", "kms:dek:decrypt", "kps:domainKeypairs:get", "kps:domainKeypairs:list", "kps:SSHKeyPair:get", "obs:bucket:getBucketAcl", "obs:bucket:getBucketLocation", "obs:bucket:getBucketPolicy", "obs:bucket:headBucket", "obs:bucket:listAllMyBuckets", "obs:bucket:listBucket", "obs:bucket:putBucketAcl", "obs:object:abortMultipartUpload", "obs:object:deleteObject", "obs:object:deleteObjectVersion", "obs:object:getObject", "obs:object:getObjectAcl", "obs:object:getObjectVersion", "obs:object:getObjectVersionAcl", "obs:object:listMultipartUploadParts", "obs:object:modifyObjectMetadata", "obs:object:putObject", "obs:object:putObjectAcl", "sfsturbo:shares:getShare", "sfsturbo:shares:showFsDir", "swr:instance:createTempCredential", "swr:repo:download", "swr:repo:upload", "swr:repository:uploadArtifact", "swr:repository:downloadArtifact", "swr:instance:get", "swr:namespace:getNamespace", "swr:repo:getRepo", "swr:repo:getRepoDomain", "swr:repo:listRepoTags", "swr:repository:deleteTag", "swr:repository:getTag", "swr:repository:listNamespaces", "swr:namespace:listNamespaces", "swr:instance:list", "swr:instance:listDomainNames", "tms:predefineTags:list", "vpc:quotas:list", "vpc:securityGroups:get", "vpc:subnets:get", "vpc:vpcs:get", "vpc:vpcs:list", "nat:natGateways:get"， "nat:snatRules:list", "nat:snatRules:get", "nat:snatRules:create", "nat:natGateways:list" ], "Effect": "Allow" } ] } ``` | | 只读（IAM3.0） | ``` { "Version": "1.1", "Statement": [ { "Action": [ "modelarts:tag:list", "modelarts:notebook:listMountedStorages", "modelarts:notebook:listAllNotebooks", "modelarts:notebook:list", "modelarts:notebook:getMountedStorage", "modelarts:notebook:get" ], "Effect": "Allow" } ] } ``` | #### 接口级授权说明 如果您需要使用[ModelArts管理控制台](https://console.huaweicloud.com/modelarts/)开发环境的相关功能并进行权限管理，可参照如下表格进行操作。 表3开发环境细化权限说明 | 权限 | 对应API接口 | 授权项（IAM3.0） | 授权项（IAM5.0） | 依赖的授权项 | IAM项目 | 企业项目 | |:---|:---|:---|:---|:---|:---|:---| | 创建Notebook实例 | POST /v1/{project_id}/notebooks | modelarts:notebook:create | modelarts:notebook:create | swr:repo:listRepoTags swr:repo:getRepo swr:namespace:getNamespace swr:repo:getRepoDomain swr:repository:getTag swr:instance:get swr:instance:createTempCredential kps:SSHKeyPair:get vpc:vpcs:list vpc:subnets:get vpc:securityGroups:get vpc:quotas:list vpc:subnets:get csms:secret:get csms:secret:getVersion sfsturbo:shares:getShare sfsturbo:shares:showFsDir obs:object:GetObject obs:bucket:HeadBucket obs:bucket:GetBucketPolicy obs:bucket:GetBucketAcl obs:bucket:PutBucketAcl kms:dek:decrypt nat:natGateways:get nat:snatRules:list nat:snatRules:get nat:snatRules:create nat:natGateways:list | √ | √ | | 查询Notebook实例列表 | GET /v1/{project_id}/notebooks | modelarts:notebook:list | modelarts:notebook:list | - | √ | √ | | 查询所有Notebook实例列表 | GET /v1/{project_id}/notebooks/all | modelarts:notebook:listAllNotebooks | modelarts:notebook:listAllNotebooks | - | √ | × | | 查询Notebook实例详情 | GET /v1/{project_id}/notebooks/{id} | modelarts:notebook:get | modelarts:notebook:get | - | √ | √ | | 更新Notebook实例 | PUT /v1/{project_id}/notebooks/{id} | modelarts:notebook:update | modelarts:notebook:updateNotebook | csms:secret:get csms:secret:getVersion kps:SSHKeyPair:get | √ | √ | | 删除Notebook实例 | DELETE /v1/{project_id}/notebooks/{id} | modelarts:notebook:delete | modelarts:notebook:delete | - | √ | √ | | 通过运行的实例保存成容器镜像 | POST /v1/{project_id}/notebooks/{id}/create-image | modelarts:image:create | modelarts:image:create | swr:namespace:getNamespace swr:repo:listRepoTags swr:repository:listNamespaces swr:repository:getTag | √ | √ | | 查询Notebook支持的有效规格列表 | GET /v1/{project_id}/notebooks/flavors | - | - | - | √ | √ | | 查询Notebook支持的可切换规格列表 | GET /v1/{project_id}/notebooks/{id}/flavors | - | - | - | √ | √ | | 查询运行中的Notebook可用时长 | GET /v1/{project_id}/notebooks/{id}/lease | - | - | - | √ | √ | | Notebook时长续约 | PATCH /v1/{project_id}/notebooks/{id}/lease | modelarts:notebook:updateStopPolicy | modelarts:notebook:updateStopPolicy | - | √ | √ | | 启动Notebook实例 | POST /v1/{project_id}/notebooks/{id}/start | modelarts:notebook:start | modelarts:notebook:start | swr:repo:listRepoTags swr:repo:getRepo swr:namespace:getNamespace swr:repo:getRepoDomain swr:repository:getTag swr:instance:get swr:instance:createTempCredential kps:SSHKeyPair:get csms:secret:get csms:secret:getVersion sfsturbo:shares:getShare obs:object:GetObject obs:bucket:HeadBucket obs:bucket:GetBucketPolicy obs:bucket:GetBucketAcl obs:bucket:PutBucketAcl | √ | √ | | 停止Notebook实例 | POST /v1/{project_id}/notebooks/{id}/stop | modelarts:notebook:stop | modelarts:notebook:stop | - | √ | √ | | 获取动态挂载OBS实例信息列表 | GET /v1/{project_id}/notebooks/{id}/storage | modelarts:notebook:listMountedStorages | modelarts:notebook:listMountedStorages | - | √ | √ | | 动态挂载OBS | POST /v1/{project_id}/notebooks/{instance_id}/storage | modelarts:notebook:mountStorage | modelarts:notebook:mountStorage | - | √ | √ | | 获取动态挂载OBS实例详情 | GET /v1/{project_id}/notebooks/{instance_id}/storage/{storage_id} | modelarts:notebook:getMountedStorage | modelarts:notebook:getMountedStorage | - | √ | √ | | 动态卸载OBS | DELETE /v1/{project_id}/notebooks/{instance_id}/storage/{storage_id} | modelarts:notebook:umountStorage | modelarts:notebook:umountStorage | - | √ | √ | | 添加资源标签 | POST /v1/{project_id}/notebooks/{resource_id}/tags/create | modelarts:notebook:update | modelarts:notebook:update modelarts::tagResource | - | √ | √ | | 删除资源标签 | DELETE /v1/{project_id}/notebooks/{resource_id}/tags/delete | modelarts:notebook:update | modelarts:notebook:update modelarts::unTagResource | - | √ | √ | | 查询Notebook资源类型下的标签 | GET /v1/{project_id}/notebooks/tags | modelarts:tag:list | modelarts:tag:list | - | √ | √ | | 打开serverless开发环境实例（codelab） | POST /v1/{project_id}/notebooks/open | modelarts:notebook:open | modelarts:notebook:open | swr:repo:listRepoTags swr:repo:getRepo swr:namespace:getNamespace swr:repo:getRepoDomain swr:repository:getTag swr:instance:get swr:instance:createTempCredential | √ | √ | | 开发环境对接TMS批量删除资源标签 | DELETE /v1/{project_id}/modelarts-notebook/{resource_id}/tags/delete | modelarts:notebook:update | modelarts:notebook:update | - | √ | √ | | 开发环境对接TMS查询项目下的标签信息 | GET /v1/{project_id}/modelarts-notebook/tags | modelarts:tag:list | modelarts:tag:list | - | √ | √ | | 开发环境对接TMS查询资源下的标签信息 | GET /v1/{project_id}/modelarts-notebook/{resource_id}/tags | modelarts:tag:list | modelarts:tag:list | - | √ | √ | | 开发环境对接TMS查询资源实例数量 | POST /v1/{project_id}/modelarts-notebook/resource-instances/count | modelarts:notebook:list | modelarts:notebook:list | - | √ | √ | | 开发环境对接TMS查询资源实例列表 | POST /v1/{project_id}/modelarts-notebook/resource-instances/filter | modelarts:notebook:list | modelarts:notebook:list | - | √ | √ | | 开发环境对接TMS批量创建资源标签 | POST /v1/{project_id}/modelarts-notebook/{resource_id}/tags/create | modelarts:notebook:update | modelarts:notebook:update | - | √ | √ |