Step 2 Assigning Permissions for Using Cloud Services

An IAM user can use cloud services such as ModelArts and OBS only after they are assigned with permissions from the tenant user. This section describes how to assign the permissions to use cloud services to all IAM users in a user group.

1. On the user group list page of IAM, click Authorize of the target user group. The Authorize User Group page is displayed.
   Figure 1 Authorize
   
   Figure 2 Authorize User Group
   
2. Before assigning permissions, learn about minimum permissions requirements of each ModelArts module, as shown in Table 1.
3. Assign permissions for using ModelArts. Search for ModelArts. Select either ModelArts FullAccess or ModelArts CommonOperations.
   The differences between the options are as follows:

   • The users with the ModelArts CommonOperations permission can only use resources, but cannot create, update, or delete any dedicated resource pool. You are advised to assign this permission to IAM users.
   • The users with the ModelArts FullAccess permission have all access permissions, including creating, updating, and deleting dedicated resource pools. Exercise caution when selecting this option.

   Figure 3 Assigning permissions for using ModelArts
   
4. Assign permissions for using OBS. Search for OBS and select OBS Administrator. ModelArts training jobs use OBS for forwarding data. Therefore, the permissions for using OBS are required.
   Figure 4 Assigning permissions for using OBS
   
5. Assign permissions for using SWR. Search for SWR and select SWR FullAccess. ModelArts custom images require the SWR FullAccess permission.
   Figure 5 Assigning permissions for using SWR
   
6. (Optional) Assign the key management permission. Remote SSH of ModelArts notebook requires the key management permission. Search for DEW and select DEW KeypairFullAccess.

   DEW key management permission is configured in the following regions: CN North-Beijing1, CN North-Beijing4, CN East-Shanghai1, CN East-Shanghai2, CN South-Guangzhou, CN Southwest-Guiyang1, CN-Hong Kong, and AP-Singapore. In other regions, the KMS key management permission is configured. In this example, the CN-Hong Kong region is used. Therefore, the DEW key management permission is to be configured.

   Figure 6 DEW key management permission
   
   Figure 7 KMS key management permission
   
7. (Optional) Assign permissions for using IEF. ModelArts requires the Tenant Administrator permission so that edge services depending on IEF can be used.

   Tenant Administrator has the permission to manage all cloud services, not only the ModelArts service. Exercise caution when assigning the Tenant Administrator permission.

   Figure 8 Assigning permissions for using IEF
   
8. (Optional) Assign permissions for using Cloud Eye and SMN. On the details page of a ModelArts real-time service deployed for inference, the number of calls is available. Click View Details to obtain more information. If you want to view the overall running status of ModelArts real-time services and AI application loads on Cloud Eye, assign Cloud Eye permissions to IAM users.

   To view monitoring data only, select CES ReadOnlyAccess.

   Figure 9 CES ReadOnlyAccess
   

   To set alarm monitoring on Cloud Eye, you also need to add CES FullAccess and SMN permissions.

   Figure 10 Assigning alarm monitoring permissions
   
   Figure 11 Assigning permissions for using SMN
   
9. (Optional) Assign permissions for using VPC. To enable custom network configuration when creating a dedicated resource pool, assign permissions for using VPC.
   Figure 12 Assigning permissions for using VPC
   
10. (Optional) Assign permissions for using SFS and SFS Turbo. To mount an SFS system to a dedicated resource pool as the storage for the development environment or training, assign the permission to use the SFS system.
    Figure 13 Assigning permissions for using SFS and SFS Turbo
    
11. Click View Selected in the upper left corner and confirm the selected permissions.
    Figure 14 Viewing selected permissions
    
12. Click Next and set the minimum authorization scope. Select Region-specific projects, select the region to be authorized, and click OK.
13. A message is displayed, indicating that the authorization is successful. View the authorization information and click Finish. It takes 15 to 30 minutes for the authorization to take effect.