Creating an IAM User and Granting ModelArts Studio (MaaS) Permissions

Description

Identity and Access Management (IAM) provides permissions management for secure access to your Huawei Cloud services and resources.

IAM is free of charge. You pay only for the cloud resources in your account. When you successfully sign up for Huawei Cloud, your account is automatically created. Your account has full access permissions for your cloud services and resources and makes payments for the use of these resources. For details, see What Is IAM?

Authorization Process

Creating a user group and assigning permissions: If you do not want to create an account for every person in your enterprise, you can use IAM. Only the enterprise's administrator needs to create an account. The account can be used to create user groups and assign permissions. Then, the IAM users created for the enterprise personnel can be added to different user groups based on their job responsibilities. For details, see Creating a User Group and Assigning Permissions.

Creating an IAM user and logging in: Create an IAM user and add it to the user group to obtain permissions. Log in to the ModelArts Studio (MaaS) console as an IAM user and use resources within the permissions scope. For details, see Creating an IAM User and Logging In.

Billing

IAM manages user access to ModelArts resources at no cost.

Prerequisites

• You have logged in to the console as an administrator.
• You have learned about the permissions that can be added to user groups for using ModelArts and dependent services so that you can select them based on your requirements. For details about the permissions supported by MaaS, see Table 1.

Configuring Common Operation Permissions for MaaS

1. Create a user group.

   Log in to the IAM console as an administrator. Choose User Groups and Create User Group. Enter a user group name and click OK.

2. Configure permissions for the user group.

   In the user group list, locate the created user group, click Authorize in the Operation column, and perform the following operations.

   1. Assign permissions for using ModelArts. Choose a system policy and type ModelArts into the search box. Select either ModelArts FullAccess or ModelArts CommonOperations.
      The differences between the options are as follows:

      • The users with the ModelArts CommonOperations permission can only use resources, but cannot create, update, or delete any dedicated resource pool. You are advised to assign this permission to IAM users.
      • The IAM users with the ModelArts FullAccess permission have all access permissions, including creating, updating, and deleting dedicated resource pools. Exercise caution when assigning this permission.

      Figure 1 Assigning permissions for using ModelArts
      
   2. Configure permissions for using other dependent services. For example, to use OBS, search for OBS and select OBS OperateAccess. ModelArts training jobs use OBS to forward data. Therefore, the permissions for using OBS are necessary.

      For permissions of more cloud services, such as SWR, see Table 1.

   3. Click Next and set the minimum authorization scope. Select Region-specific projects, select the region to be authorized, and click OK.
   4. A message is displayed, indicating that the authorization is successful. View the authorization information and click Finish. It takes 15 to 30 minutes for the authorization to take effect.

3. Create an IAM user. In the navigation pane on the left of the IAM console, choose Users. In the right pane, click Create User in the upper right corner. On the Create User page, add multiple users. Set parameters as prompted and click Next.
4. Add the IAM user to the user group. On the Add User to Group page, select a user group and click Create. The system adds the created users to the user group.
5. Log in and verify the permission.

   In the authorized region, perform the following operations:

   • Choose Service List > ModelArts. In the navigation pane of the ModelArts console, choose your desired type of AI dedicated resource pools and create one. You should not be able to create a new resource pool if the ModelArts CommonOperations permission has taken effect.
   • Choose any other service in Service List. (Assume that the current policy contains only ModelArts CommonOperations.) If a message appears indicating that you have insufficient permissions to access the service, the ModelArts CommonOperations permission has taken effect.
   • Choose Service List > ModelArts. In the navigation pane of the ModelArts console, choose Algorithm Management and click Create Algorithm. You should be able to access the corresponding OBS path if the OBS permission has taken effect.
   • Verify other optional permissions according to Table 1.