Help Center/ ModelArts/ Best Practices/ Permissions Management/ Configuration Practices in Typical Scenarios/ Assigning Basic Permissions for Using ModelArts/ Step 2 Assigning Permissions for Using Cloud Services
Updated on 2025-08-12 GMT+08:00
View PDF
Share

Step 2 Assigning Permissions for Using Cloud Services

An IAM user can use cloud services such as ModelArts and OBS only after they are assigned with permissions from the tenant user. This section describes how to assign the permissions to use cloud services to all IAM users in a user group.

  1. On the user group list page of IAM, click Authorize of the target user group. The Authorize User Group page is displayed.
    Figure 1 Authorize
  2. Before assigning permissions, learn about minimum permissions requirements of each ModelArts module, as shown in Table 1.
  3. Assign permissions for using ModelArts. Search for ModelArts in the search box. Select either ModelArts FullAccess or ModelArts CommonOperations.
    The differences between the options are as follows:
    • The users with the ModelArts CommonOperations permission can only use resources, but cannot create, update, or delete any dedicated resource pool. You are advised to assign this permission to IAM users.
    • The users with the ModelArts FullAccess permission have all access permissions, including creating, updating, and deleting dedicated resource pools. Exercise caution when selecting this option.
  4. Assign permissions for using OBS. Search for OBS and select OBS Administrator. ModelArts training jobs use OBS to forward data. Therefore, the permissions for using OBS are necessary.
  5. Assign permissions for using SWR. Search for SWR and select SWR FullAccess. ModelArts custom images require the SWR FullAccess permission.
  6. (Optional) Assign the key management permission. Remote SSH of ModelArts notebook requires the key management permission. Search for DEW and select DEW KeypairFullAccess.

    DEW key management permission is configured in the following regions: CN North-Beijing1, CN North-Beijing4, CN East-Shanghai1, CN East-Shanghai2, CN South-Guangzhou, CN Southwest-Guiyang1, CN-Hong Kong, and AP-Singapore. In other regions, the KMS key management permission is configured. In this example, the CN-Hong Kong region is used. Therefore, the DEW key management permission is to be configured.

  7. (Optional) Assign permissions for using IEF. ModelArts requires the Tenant Administrator permission so that edge services depending on IEF can be used.

    Tenant Administrator has the permission to manage all cloud services, not only ModelArts. Exercise caution when assigning the Tenant Administrator permission.

  8. (Optional) Assign permissions for using Cloud Eye and SMN. On the details page of a ModelArts real-time service deployed for inference, the number of calls is available. Click View Details to obtain more information. If you want to view the overall running status of ModelArts real-time services and AI application loads on Cloud Eye, assign Cloud Eye permissions to IAM users.

    To view monitoring data only, select CES ReadOnlyAccess.

    To set alarm monitoring on Cloud Eye, you also need to add CES FullAccess and SMN permissions.

  9. (Optional) Assign permissions for using VPC. To enable custom network configuration when creating a dedicated resource pool, assign permissions for using VPC.
  10. (Optional) Assign permissions for using SFS and SFS Turbo. To mount an SFS system to a dedicated resource pool as the storage for the development environment or training, assign the permission to use the SFS system.
  11. Click View Selected in the upper left corner and confirm the selected permissions.
  12. Click Next and set the minimum authorization scope. Select Region-specific projects, select the region to be authorized, and click OK.
  13. A message is displayed, indicating that the authorization is successful. View the authorization information and click Finish. It takes 15 to 30 minutes for the authorization to take effect.