Creating an IAM User and Granting ModelArts Studio (MaaS) Permissions

The agency created in Configuring ModelArts Agency Authorization for Using ModelArts Studio (MaaS) almost has all permissions of dependent services. If your Huawei Cloud account meets your permissions requirements, you can skip this section.

ModelArts allows you to configure fine-grained permissions for refined management of resources and permissions. This type of feature is commonly used in scenarios with large-scale enterprise users. If you want to precisely control the scope of permissions granted to an agency, use custom authorization for MaaS.

This section describes how to configure fine-grained permissions for IAM users.

Operation Scenarios

Identity and Access Management (IAM) provides permissions management for secure access to your Huawei Cloud services and resources.

IAM is free of charge. You pay only for the cloud resources in your account. When you successfully sign up for Huawei Cloud, your account is automatically created. Your account has full access permissions for your cloud services and resources and makes payments for the use of these resources. For details, see What Is IAM?

Authorization Process

Creating a user group and assigning permissions: If you do not want to create an account for every person in your enterprise, you can use IAM. Only the enterprise's administrator needs to create an account. The account can be used to create user groups and assign permissions. Then, the IAM users created for the enterprise personnel can be added to different user groups based on their job responsibilities. For details, see Creating a User Group and Assigning Permissions.

Creating an IAM user and logging in: Create an IAM user and add it to the user group to obtain permissions. Log in to the ModelArts Studio (MaaS) console as an IAM user and use resources within the permissions scope. For details, see Creating an IAM User and Logging In.

Billing

IAM manages user access to ModelArts resources at no cost.

Prerequisites

You have logged in to the console as an administrator.
You have learned about the permissions that can be added to user groups for using ModelArts and dependent services so that you can select them based on your requirements. For details about the permissions supported by MaaS, see Table 1.

**Table 1** Service authorizations
Target Service	Authorization Description	IAM Permission	Policy Type	Mandatory
ModelArts	This permission allows IAM users to use ModelArts. The IAM users with the ModelArts CommonOperations permission can only use resources, but cannot create, update, or delete any dedicated resource pool. You are advised to assign this permission to IAM users.	ModelArts CommonOperations	System-defined policy	Yes
ModelArts	The IAM users with the ModelArts FullAccess permission have all access permissions, including creating, updating, and deleting dedicated resource pools. Exercise caution when assigning this permission.	ModelArts FullAccess	System-defined policy	No Select either ModelArts FullAccess or ModelArts CommonOperations.
Object Storage Service (OBS)	This permission allows IAM users to use OBS. ModelArts data management, development environments, training jobs, and model deployment require OBS for forwarding data.	OBS OperateAccess	System-defined policy	Yes
Software Repository for Container (SWR)	This permission allows IAM users to use SWR. ModelArts custom images require the SWR FullAccess permission.	SWR OperateAccess	System-defined policy	Yes
Cloud Eye	This permission allows IAM users to use Cloud Eye. Using Cloud Eye, you can view the statuses of ModelArts real-time services and model loads, and set monitoring alarms.	CES FullAccess	System-defined policy	Yes
Simple Message Notification (SMN)	This permission allows IAM users to use SMN. SMN is used with Cloud Eye.	SMN FullAccess	System-defined policy	Yes
Virtual Private Cloud (VPC)	When creating a ModelArts dedicated resource pool, IAM users require VPC permissions so that they can customize networks.	VPC FullAccess	System-defined policy	No
Identity and Access Management (IAM)	This permission is used to check whether an agency is missing.	iam:permissions:listRolesForAgencyOnDomain iam:permissions:listRolesForAgencyOnProject iam:permissions:listRolesForAgency iam:agencies:getAgency iam:agencies:listAgencies	Custom policy	Yes If the permission is not configured, a dialog box will be displayed when an IAM user accesses the MaaS console, prompting the user to configure the permission.

Configuring Common Operation Permissions for MaaS

Create a user group.
1. Log in to the IAM console as an administrator. In the navigation pane, choose User Groups.
2. In the upper right corner, click Create User Group. Enter a user group name and description and click OK.
Configure permissions for the user group.

In the user group list, locate the created user group, click Authorize in the Operation column, and perform the following operations.
1. Assign permissions for using ModelArts. Choose a system policy from the drop-down list box and type ModelArts into the search box. Select either ModelArts FullAccess or ModelArts CommonOperations. Permission description:
  - The IAM users with the ModelArts CommonOperations permission can only use resources, but cannot create, update, or delete any dedicated resource pool. You are advised to assign this permission to IAM users.
  - The IAM users with the ModelArts FullAccess permission have all access permissions, including creating, updating, and deleting dedicated resource pools. Exercise caution when assigning this permission.
  Figure 1 Assigning permissions for using ModelArts
2. Configure permissions on other dependencies based on Table 1.
  For example, search for OBS OperateAccess in the search box and select it. Before creating models in MaaS, create an OBS bucket to store model weights, training data, and permanent log files.
  
  Figure 2 Assigning the OBS OperateAccess permission
  
  Repeat this step to select all mandatory permissions. Select optional permissions as required. IAM permissions are different from other permissions. You need to create custom policies and add custom policies to user groups. For details, see Scenario 3: Adding Missing Permissions Using an IAM Account.
3. After selecting the required permissions, click Next to set the minimum authorization scope. Select Region-specific projects, select the region to be authorized, and click OK.
4. After a successful message appears, check the authorization information and click Finish. It takes 15 to 30 minutes for the authorization to take effect.
Create an IAM user. In the navigation pane on the left of the IAM console, choose Users. In the right pane, click Create User in the upper right corner. On the Create User page, add multiple users. Set parameters as prompted and click Next.
Add the IAM user account created in the previous step to the user group. On the Add User to Group page, select a user group and click Create. The system adds the created users to the user group.
Use the IAM user account to log in to Huawei Cloud and verify the permissions. For more information, see Logging In to Huawei Cloud as an IAM User.

Log in to the IAM console as the created user, switch to a region where the user has been granted permissions, and verify that the user has the following permissions:
- Choose Service List > ModelArts. In the navigation pane of the ModelArts console, choose your desired type of AI dedicated resource pools and create one. You should not be able to create a new resource pool if the ModelArts CommonOperations permission has taken effect.
- Choose any other service in Service List. (Assume that the current policy contains only ModelArts CommonOperations.) If a message appears indicating that you have insufficient permissions to access the service, the ModelArts CommonOperations permission has taken effect.
- Choose Service List > ModelArts. In the navigation pane of the ModelArts console, choose Algorithm Management and click Create Algorithm. You should be able to access the corresponding OBS path if the OBS permission has taken effect.
- Verify other optional permissions according to Table 1.