快速入门&总览页

场景级授权示例

• IAM新版控制台：提供基于IAM5.0版本的系统身份策略。用户可以在IAM服务新版控制台创建新的自定义策略，将创建的自定义策略授权给用户所在的用户组。由于部分模块未完全对接IAM5.0，目前还需在IAM服务旧版控制台创建新的自定义策略，配置以下IAM3.0的策略，将创建的自定义策略授权给用户所在的用户组。详情可参照下表配置。

  表1 IAM新版控制台快速入门&总览操作场景的授权

  策略名称	描述	类型	还需配置的IAM3.0的策略
  ModelArtsOverviewReadOnlyPolicy	ModelArts服务"快速入门&总览"的只读策略	系统身份策略	-
  ModelArtsOverviewAllPolicy	ModelArts服务"快速入门&总览"的所有策略(读写)	系统身份策略	-

• IAM旧版控制台，不提供基于IAM3.0版本的系统身份策略，用户需要在IAM服务旧版控制台自定义身份策略来进行场景级授权配置。详情参考下表进行配置。

  表2 IAM旧版控制台快速入门&总览操作场景的授权

  操作场景	示例
  读写（IAM3.0）	{"Version":"1.1", "Statement":[{"Action":[ "modelarts:authorization:list", "modelarts:authorization:create", "modelarts:authorization:delete", "modelarts:clusterFlavor:list", "iam:quotas:listQuotasForProject", "iam:quotas:listQuotas", "iam:agencies:createAgency", "iam:agencies:listAgencies", "iam:permissions:listRolesForAgency", "iam:permissions:grantRoleToAgencyOnDomain", "iam:permissions:grantRoleToAgency", "iam:agencies:delete", "iam:users:listUsers", "iam:roles:listRoles", "iam:roles:createRole", "iam:roles:updateRole", "iam:agencies:getAgency", "iam:groups:listGroups", "iam:permissions:listRolesForAgencyOnDomain", "iam:permissions:listRolesForAgencyOnProject", "iam:permissions:listRolesForAgency" ], "Effect":"Allow"}
  只读（IAM3.0）	{"Version":"1.1", "Statement":[{"Action":[ "modelarts:authorization:list", "modelarts:clusterFlavor:list" "iam:quotas:listQuotasForProject", "iam:quotas:listQuotas", "iam:agencies:listAgencies", "iam:permissions:listRolesForAgency", "iam:users:listUsers", "iam:roles:listRoles", "iam:agencies:getAgency", "iam:groups:listGroups", "iam:permissions:listRolesForAgencyOnDomain", "iam:permissions:listRolesForAgencyOnProject", "iam:permissions:listRolesForAgency" ], "Effect":"Allow"}]}