Failed to Build an Image or Import a File When an IAM user Creates an AI Application

Symptom

When an IAM user creates an AI application, creating an image failed. The failure log indicates that downloading the OBS file failed.

Click to enlarge

When an IAM user creates an AI application, either of the following prompts are displayed: Failed to copy model file due to obs exception. Please Check your obs access right. and User %s does not have obs:object:PutObjectAcl permission. The AI application fails to be created due to OBS import exceptions or permission issues.

Possible Causes

Using ModelArts requires OBS authorization. ModelArts users require OBS system permissions. The IAM permissions of an IAM user are configured by their tenants. If a tenant does not grant the OBS putObjectAcl permission to their IAM users, this issue occurs.

Solution

For details about how to create a custom policy for OBS permissions on which ModelArts depends, see Example Custom Policies of OBS.

Assign custom policy permissions to the target user on the IAM console. For details, see Creating a Custom Policy.

Log in to the IAM console, choose Permissions > Policies/Roles, and click Create Custom Policy in the upper right corner to create a custom policy.

Figure 1 Adding permissions on IAM
Click to enlarge

Figure 2 Creating a custom policy
Click to enlarge

An example custom policy is as follows:

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "obs:bucket:ListAllMybuckets",
                "obs:bucket:ListBucket",
                "obs:object:GetObject",
                "obs:object:GetObjectVersion",
                "obs:object:PutObject",
                "obs:object:GetObjectAcl",
                "obs:object:PutObjectAcl",
                "obs:object:GetObjectVersionAcl"
            ],
            "Effect": "Allow"
        }
    ]
}