Introduction

This section describes fine-grained permissions management for ModelArts. If your Huawei Cloud account does not require individual IAM users, skip this section.

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

You can grant users permissions by using roles and policies. Roles are provided by IAM to define service-based permissions that match users' job responsibilities. Policies are more fine-grained, API-based permissions required to perform operations on specific cloud resources under certain conditions, meeting requirements for secure access control.

If you want to allow or deny the access to an API, use fine-grained policies.

An account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions. The required permissions are determined by the actions supported by the API. Only users with the policies allowing for those actions can call the API successfully. For example, if an IAM user wants to create notebook instances using an API, the user must have been granted permissions that allow the modelarts:notebook:create action.