Asset Management Permissions

Scenario-based Authorization Examples

• New IAM console: Provides system-defined identity policies based on IAM version 5.0. You can create new custom policies on the new IAM console and assign them to the user group you belong to. However, because some modules have not yet fully integrated with IAM 5.0, you still need to create new custom policies on the old IAM console. Configure the following IAM 3.0 policies and assign them to the user groups that you belong to. For details, refer to the table below.

  Table 1 Authorization based on target operation scenarios

  Scenario	Example	IAM 3.0 Policies Still Required on the Old IAM Console
  Read/Write (IAM 5.0)	{ "Version": "5.0", "Statement": [ { "Action": [ "modelarts:trainJob:list", "modelarts:service:list", "modelarts:image:deleteGroup", "modelarts:image:updateGroup", "modelarts:image:list", "modelarts:image:listGroup", "modelarts:image:get", "modelarts:image:register", "modelarts:image:sync", "modelarts:image:delete", "modelarts:authorization:list", "swr:namespace:getNamespace", "swr:repo:listRepoTags", "swr:repo:deleteRepoTag", "swr:repository:getTag", "swr:repository:deleteTag", "swr:repo:listRepos", "swr:repository:listRepositories", "swr:repository:listArtifacts", "swr:repo:getRepo", "swr:repo:getRepoDomain", "swr:repo:createRepoDomain", "swr:instance:list", "obs:bucket:ListBucket", "obs:object:GetObject", "modelarts:clusterFlavor:list", "modelarts:fusionJob:get", "modelarts:fusionJob:getEventsCategories", "modelarts:tag:list", "modelarts:trainJob:get", "modelarts:trainJob:getFtArtifacts", "modelarts:trainJob:getFtDetail", "modelarts:trainJob:getFtMetrics", "modelarts:workspace:get", "lts:groups:get", "lts:topics:get", "lts:groups:create", "lts:groups:list", "lts:topics:create", "lts:topics:delete", "lts:topics:list", "sfsturbo:shares:getShare", "sfsturbo:shares:showFsDir", "obs:object:DeleteObject", "obs:bucket:CreateBucket", "obs:object:PutObject", "obs:bucket:GetBucketAcl", "obs:bucket:PutBucketAcl", "csms:secretVersion:get", "modelarts:pool:list", "modelarts:pool:get", "modelarts:trainJob:listAll", "obs:bucket:ListAllMyBuckets" ], "Effect": "Allow" } ] }	{ "Version": "1.1", "Statement": [ { "Effect": "Allow", "Action": [ "modelarts:fusionJob:get", "modelarts:service:list", "modelarts:trainJob:get", "modelarts:trainJob:list", "modelarts:trainJob:listAll", "modelarts:workspace:get" ] } ] }
  Read-only (IAM 5.0)	{ "Version": "5.0", "Statement": [ { "Action": [ "modelarts:trainJob:list", "modelarts:service:list", "modelarts:image:list", "modelarts:image:listGroup", "modelarts:image:get", "modelarts:authorization:list", "swr:namespace:getNamespace", "swr:repo:listRepoTags", "swr:repository:getTag", "swr:repo:listRepos", "swr:repository:listRepositories", "swr:repository:listArtifacts", "swr:repo:getRepo", "swr:repo:getRepoDomain", "swr:instance:list", "obs:bucket:ListBucket", "obs:object:GetObject", "modelarts:clusterFlavor:list", "modelarts:fusionJob:get", "modelarts:fusionJob:getEventsCategories", "modelarts:tag:list", "modelarts:trainJob:get", "modelarts:trainJob:getFtArtifacts", "modelarts:trainJob:getFtDetail", "modelarts:trainJob:getFtMetrics", "modelarts:workspace:get", "lts:groups:get", "lts:topics:get", "lts:groups:list", "lts:topics:list", "sfsturbo:shares:getShare", "sfsturbo:shares:showFsDir", "obs:bucket:GetBucketAcl", "csms:secretVersion:get", "modelarts:pool:list", "modelarts:pool:get", "modelarts:trainJob:listAll", "obs:bucket:ListAllMyBuckets" ], "Effect": "Allow" } ] }	{ "Version": "1.1", "Statement": [ { "Effect": "Allow", "Action": [ "modelarts:fusionJob:get", "modelarts:service:list", "modelarts:trainJob:get", "modelarts:trainJob:list", "modelarts:trainJob:listAll", "modelarts:workspace:get" ] } ] }

• Old IAM console: System-defined identity policies based on IAM 3.0 are not provided. You need to create custom identity policies on the old IAM console for scenario-based authorization configuration. For details, see the table below.

  Table 2 Authorization based on target operation scenarios

  Scenario	Example
  Read/Write (IAM 3.0)	{ "Version": "1.1", "Statement": [ { "Action": [ "modelarts:trainJob:list", "modelarts:service:list", "modelarts:image:deleteGroup", "modelarts:image:updateGroup", "modelarts:image:list", "modelarts:image:listGroup", "modelarts:image:get", "modelarts:image:register", "modelarts:image:sync", "modelarts:image:delete", "modelarts:authorization:list", "swr:namespace:getNamespace", "swr:repo:listRepoTags", "swr:repo:deleteRepoTag", "swr:repository:getTag", "swr:repository:deleteTag", "swr:repo:listRepos", "swr:repository:listRepositories", "swr:repository:listArtifacts", "swr:repo:getRepo", "swr:repo:getRepoDomain", "swr:repo:createRepoDomain", "swr:instance:list", "obs:bucket:ListBucket", "obs:object:GetObject", "modelarts:clusterFlavor:list", "modelarts:fusionJob:get", "modelarts:fusionJob:getEventsCategories", "modelarts:tag:list", "modelarts:trainJob:get", "modelarts:trainJob:getFtArtifacts", "modelarts:trainJob:getFtDetail", "modelarts:trainJob:getFtMetrics", "modelarts:workspace:get", "lts:groups:get", "lts:topics:get", "lts:groups:create", "lts:groups:list", "lts:topics:create", "lts:topics:delete", "lts:topics:list", "sfsturbo:shares:getShare", "sfsturbo:shares:showFsDir", "obs:object:DeleteObject", "obs:bucket:CreateBucket", "obs:object:PutObject", "obs:bucket:GetBucketAcl", "obs:bucket:PutBucketAcl", "csms:secretVersion:get", "modelarts:pool:list", "modelarts:pool:get", "modelarts:trainJob:listAll", "obs:bucket:ListAllMyBuckets" ], "Effect": "Allow" } ] }
  Read-only (IAM 3.0)	{ "Version": "1.1", "Statement": [ { "Action": [ "modelarts:trainJob:list", "modelarts:service:list", "modelarts:image:list", "modelarts:image:listGroup", "modelarts:image:get", "modelarts:authorization:list", "swr:namespace:getNamespace", "swr:repo:listRepoTags", "swr:repository:getTag", "swr:repo:listRepos", "swr:repository:listRepositories", "swr:repository:listArtifacts", "swr:repo:getRepo", "swr:repo:getRepoDomain", "swr:instance:list", "obs:bucket:ListBucket", "obs:object:GetObject", "modelarts:clusterFlavor:list", "modelarts:fusionJob:get", "modelarts:fusionJob:getEventsCategories", "modelarts:tag:list", "modelarts:trainJob:get", "modelarts:trainJob:getFtArtifacts", "modelarts:trainJob:getFtDetail", "modelarts:trainJob:getFtMetrics", "modelarts:workspace:get", "lts:groups:get", "lts:topics:get", "lts:groups:list", "lts:topics:list", "sfsturbo:shares:getShare", "sfsturbo:shares:showFsDir", "obs:bucket:GetBucketAcl", "csms:secretVersion:get", "modelarts:pool:list", "modelarts:pool:get", "modelarts:trainJob:listAll", "obs:bucket:ListAllMyBuckets" ], "Effect": "Allow" } ] }

API-Level Authorization Description

If you need to use the relevant features of the ModelArts console asset management and perform permissions management, refer to the table below.