Help Center/ ModelArts/ API Reference/ Permissions Policies and Supported Actions/ Development Environment Permissions
Updated on 2026-07-24 GMT+08:00
View PDF
Share

Development Environment Permissions

Scenario-based Authorization Examples

  • New IAM console: Provides system-defined identity policies based on IAM version 5.0. You can configure scenario-based authorizations directly on the new IAM console.
    Table 1 Policies for operation scenarios in the new IAM console

    Policy

    Description

    Type

    Additional IAM 3.0 Policies Required

    ModelArtsNotebookAllPolicy

    All policies (read/write) for ModelArts "Model development – notebook"

    System-defined identity policy

    -

    ModelArtsNotebookReadOnlyPolicy

    Read-only policy for ModelArts "Model development – notebook"

    System-defined identity policy

    -
  • Old IAM console: Requires you to create custom identity policies on the old IAM console for scenario-based authorization configuration. The created custom policies must then be assigned to the user group that you belong to. For details, see the table below.
    Table 2 Authorization based on target operation scenarios

    Scenario

    Example

    Read/Write (IAM 3.0)

    		 
    {
  "Version": "1.1",
  "Statement": [
    {
      "Action": [
        "modelarts:authorization:list",
        "modelarts:image:create",
        "modelarts:image:delete",
        "modelarts:image:get",
        "modelarts:image:list",
        "modelarts:image:listGroup",
        "modelarts:image:register",
        "modelarts:network:get",
        "modelarts:network:list",
        "modelarts:notebook:create",
        "modelarts:notebook:delete",
        "modelarts:notebook:get",
        "modelarts:notebook:getMountedStorage",
        "modelarts:notebook:list",
        "modelarts:notebook:listAllNotebooks",
        "modelarts:notebook:listMountedStorages",
        "modelarts:notebook:mountStorage",
        "modelarts:notebook:start",
        "modelarts:notebook:stop",
        "modelarts:notebook:umountStorage",
        "modelarts:notebook:update",
        "modelarts:notebook:updateStopPolicy",
        "modelarts:pool:get",
        "modelarts:pool:list",
        "modelarts:tag:list",
        "modelarts:trainJob:create",
        "modelarts:trainJob:get",
        "modelarts:trainJob:list",
        "modelarts:trainJob:logExport",
        "modelarts:trainJob:update",
        "modelarts:trainJobVersion:delete",
        "modelarts:workspace:getQuotas",
        "modelarts:workspace:get",
        "aom:alarm:list",
        "aom:metric:get",
        "aom:metric:list",
        "csms:secret:create",
        "csms:secret:list",
        "csms:secret:get",
        "csms:secret:getVersion",
        "iam:projects:listProjects",
        "iam:users:listUsers",
        "kms:cmk:list",
        "kms:dek:decrypt",
        "kps:domainKeypairs:get",
        "kps:domainKeypairs:list",
        "kps:SSHKeyPair:get",
        "obs:bucket:getBucketAcl",
        "obs:bucket:getBucketLocation",
        "obs:bucket:getBucketPolicy",
        "obs:bucket:headBucket",
        "obs:bucket:listAllMyBuckets",
        "obs:bucket:listBucket",
        "obs:bucket:putBucketAcl",
        "obs:object:abortMultipartUpload",
        "obs:object:deleteObject",
        "obs:object:deleteObjectVersion",
        "obs:object:getObject",
        "obs:object:getObjectAcl",
        "obs:object:getObjectVersion",
        "obs:object:getObjectVersionAcl",
        "obs:object:listMultipartUploadParts",
        "obs:object:modifyObjectMetadata",
        "obs:object:putObject",
        "obs:object:putObjectAcl",
        "sfsturbo:shares:getShare",
        "sfsturbo:shares:showFsDir",
        "swr:instance:createTempCredential",
        "swr:repo:download",
        "swr:repo:upload",
        "swr:repository:uploadArtifact",
        "swr:repository:downloadArtifact",
        "swr:instance:get",
        "swr:namespace:getNamespace",
        "swr:repo:getRepo",
        "swr:repo:getRepoDomain",
        "swr:repo:listRepoTags",
        "swr:repository:deleteTag",
        "swr:repository:getTag",
        "swr:repository:listNamespaces",
        "swr:namespace:listNamespaces",
        "swr:instance:list",
        "swr:instance:listDomainNames",
        "tms:predefineTags:list",
        "vpc:quotas:list",
        "vpc:securityGroups:get",
        "vpc:subnets:get",
        "vpc:vpcs:get",
        "vpc:vpcs:list"
      ],
      "Effect": "Allow"
    }
  ]
}

    Read-only (IAM 3.0)

    		 
    {
  "Version": "1.1",
  "Statement": [
    {
      "Action": [
        "modelarts:tag:list",
        "modelarts:notebook:listMountedStorages",
        "modelarts:notebook:listAllNotebooks",
        "modelarts:notebook:list",
        "modelarts:notebook:getMountedStorage",
        "modelarts:notebook:get"
      ],
      "Effect": "Allow"
    }
  ]
}

API-Level Authorization Description

If you need to use the relevant features of the ModelArts console development environment and perform permissions management, refer to the table below.

Table 3 Fine-grained permissions for development environment

Permission

API

Action

Dependency

IAM Project

Enterprise Project

Creating a notebook instance

POST

/v1/{project_id}/notebooks

modelarts:notebook:create

swr:repo:listRepoTags

swr:repo:getRepo

swr:namespace:getNamespace

swr:repo:getRepoDomain

swr:repository:getTag

swr:instance:get

swr:instance:createTempCredential

kps:SSHKeyPair:get

vpc:vpcs:list

vpc:subnets:get

vpc:securityGroups:get

vpc:quotas:list

vpc:subnets:get

csms:secret:get

csms:secret:getVersion

sfsturbo:shares:getShare

sfsturbo:shares:showFsDir

obs:object:GetObject

obs:bucket:HeadBucket

obs:bucket:GetBucketPolicy

obs:bucket:GetBucketAcl

obs:bucket:PutBucketAcl

kms:dek:decrypt

√

√

Querying notebook instances

GET /v1/{project_id}/notebooks

modelarts:notebook:list

-

√

√

Querying all notebook instances

GET /v1/{project_id}/notebooks/all

modelarts:notebook:listAllNotebooks

-

√

×

Obtaining details about a notebook instance

GET

/v1/{project_id}/notebooks/{id}

modelarts:notebook:get

-

√

√

Updating a notebook instance

PUT /v1/{project_id}/notebooks/{id}

modelarts:notebook:update

csms:secret:get

csms:secret:getVersion

kps:SSHKeyPair:get

√

√

Deleting a notebook instance

DELETE /v1/{project_id}/notebooks/{id}

modelarts:notebook:delete

-

√

√

Saving a running instance as a container image

POST /v1/{project_id}/notebooks/{id}/create-image

modelarts:image:create

swr:namespace:getNamespace

swr:repo:listRepoTags

swr:repository:listNamespaces

swr:repository:getTag

√

√

Obtaining available flavors supported by a notebook instance

GET /v1/{project_id}/notebooks/flavors

-

-

√

√

Querying the list of available flavors supported by a notebook instance

GET /v1/{project_id}/notebooks/{id}/flavors

-

-

√

√

Obtaining the available duration of a running notebook instance

GET /v1/{project_id}/notebooks/{id}/lease

-

-

√

√

Renewing the duration of a notebook instance

PATCH /v1/{project_id}/notebooks/{id}/lease

modelarts:notebook:updateStopPolicy

-

√

√

Starting a notebook instance

POST /v1/{project_id}/notebooks/{id}/start

modelarts:notebook:start

swr:repo:listRepoTags

swr:repo:getRepo

swr:namespace:getNamespace

swr:repo:getRepoDomain

swr:repository:getTag

swr:instance:get

swr:instance:createTempCredential

kps:SSHKeyPair:get

csms:secret:get

csms:secret:getVersion

sfsturbo:shares:getShare

obs:object:GetObject

obs:bucket:HeadBucket

obs:bucket:GetBucketPolicy

obs:bucket:GetBucketAcl

obs:bucket:PutBucketAcl

√

√

Stopping a notebook instance

POST /v1/{project_id}/notebooks/{id}/stop

modelarts:notebook:stop

-

√

√

Obtaining the OBS instance information list

GET /v1/{project_id}/notebooks/{id}/storage

modelarts:notebook:listMountedStorages

-

√

√

Mounting OBS dynamically

POST /v1/{project_id}/notebooks/{instance_id}/storage

modelarts:notebook:mountStorage

-

√

√

Obtaining the details of a dynamically mounted OBS instance

GET /v1/{project_id}/notebooks/{instance_id}/storage/{storage_id}

modelarts:notebook:getMountedStorage

-

√

√

Dynamically unmounting OBS

DELETE /v1/{project_id}/notebooks/{instance_id}/storage/{storage_id}

modelarts:notebook:umountStorage

-

√

√

Adding resource tags

POST /v1/{project_id}/notebooks/{resource_id}/tags/create

modelarts:notebook:update

-

√

√

Deleting resource tags

DELETE /v1/{project_id}/notebooks/{resource_id}/tags/delete

modelarts:notebook:update

-

√

√

Obtaining notebook instance tags

GET /v1/{project_id}/notebooks/tags

modelarts:tag:list

-

√

√

Opening a serverless development environment instance (Codelab)

POST

/v1/{project_id}/notebooks/open

modelarts:notebook:open

swr:repo:listRepoTags

swr:repo:getRepo

swr:namespace:getNamespace

swr:repo:getRepoDomain

swr:repository:getTag

swr:instance:get

swr:instance:createTempCredential

√

√

Batch deleting resource tags via TMS integration

DELETE

/v1/{project_id}/modelarts-notebook/{resource_id}/tags/delete

modelarts:notebook:update

-

√

√

Querying project tags via TMS integration

GET

/v1/{project_id}/modelarts-notebook/tags

modelarts:tag:list

-

√

√

Querying resource tags via TMS integration

GET

/v1/{project_id}/modelarts-notebook/{resource_id}/tags

modelarts:tag:list

-

√

√

Querying the number of resource instances via TMS integration

POST

/v1/{project_id}/modelarts-notebook/resource-instances/count

modelarts:notebook:list

-

√

√

Querying the list of resource instances via TMS integration

POST

/v1/{project_id}/modelarts-notebook/resource-instances/filter

modelarts:notebook:list

-

√

√

Batch creating resource tags via TMS integration

POST

/v1/{project_id}/modelarts-notebook/{resource_id}/tags/create

modelarts:notebook:update

-

√

√