Help Center/ ModelArts/ API Reference/ Permissions Policies and Supported Actions/ Authorization Management
Updated on 2026-07-24 GMT+08:00
View PDF
Share

Authorization Management

Scenario-Level Authorization Examples

  • New IAM console: Provides system-defined identity policies based on IAM 5.0. You can create custom policies on the new IAM console and assign them to the user group you belong to. However, because some modules have not yet fully integrated with IAM 5.0, you still need to create custom policies on the old IAM console. Configure the following IAM 3.0 policies and assign them to the user group that you belong to. For details, see the table below.
    Table 1 Authorization management policies in the new IAM console

    Policy Name

    Description

    Type

    Additional IAM 3.0 Policies Required

    ModelArtsPermissionManagementReadOnlyPolicy

    ModelArts System Setting Workspace Management read-only policy.

    System-defined

    		 
    {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:permissions:listRolesForAgencyOnDomain",
                "iam:permissions:listRolesForAgencyOnProject",
                "iam:permissions:listRolesForAgency"
            ]
        }
    ]
}

    ModelArtsPermissionManagementAllPolicy

    ModelArts System Setting Workspace Management all policy.

    System-defined

    		 
    {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:permissions:listRolesForAgencyOnDomain",
                "iam:permissions:listRolesForAgencyOnProject",
                "iam:permissions:listRolesForAgency"
            ]
        }
    ]
}
  • Old IAM console: System-defined identity policies based on IAM 3.0 are not provided. You need to create custom identity policies on the old IAM console for scenario-level authorization. For details, see the table below.
    Table 2 Authorization management policies in the old IAM console

    Scenario

    Example

    Read/Write (IAM 3.0)

    		 
    {"Version":"1.1","Statement":[{"Action":[
               "modelarts:authorization:list",
               "modelarts:authorization:create",
               "modelarts:authorization:delete",
               "iam:quotas:listQuotasForProject",
               "iam:quotas:listQuotas",
               "iam:agencies:createAgency",
               "iam:agencies:listAgencies",
               "iam:permissions:listRolesForAgency",
              "iam:permissions:grantRoleToAgencyOnDomain",
               "iam:permissions:grantRoleToAgency",
               "iam:agencies:delete",
               "iam:users:listUsers",
               "iam:roles:listRoles",
               "iam:roles:createRole",
               "iam:roles:updateRole",
               "iam:agencies:getAgency",
               "iam:groups:listGroups",
               "iam:permissions:listRolesForAgencyOnDomain",
               "iam:permissions:listRolesForAgencyOnProject",
               "iam:permissions:listRolesForAgency"
               ],
"Effect":"Allow"}

    Read-only (IAM 3.0)

    		 
    {"Version":"1.1","Statement":[{"Action":[
               "modelarts:authorization:list",
               "iam:quotas:listQuotasForProject",
               "iam:quotas:listQuotas",
               "iam:agencies:listAgencies",
               "iam:permissions:listRolesForAgency",
               "iam:users:listUsers",
               "iam:roles:listRoles",
               "iam:agencies:getAgency",
               "iam:groups:listGroups",
               "iam:permissions:listRolesForAgencyOnDomain",
               "iam:permissions:listRolesForAgencyOnProject",
               "iam:permissions:listRolesForAgency"
               ],
"Effect":"Allow"}]}

API-Level Authorization

Table 3 Fine-grained permissions for service management

Permission

API

Action

Dependency

IAM Project

Enterprise Project

Adding authorizations

POST /v1/{project_id}/atelier/authorizations

modelarts:authorization:create

iam:agencies:listAgencies

iam:groups:list

iam:users:list

iam:agencies:getAgency

√

√

Deleting authorizations

DELETE /v1/{project_id}/atelier/authorizations

modelarts:authorization:delete

None

√

√

Listing authorizations

GET /v1/{project_id}/atelier/authorizations

modelarts:authorization:list

None

√

√

Creating an agency

POST /v1/{project_id}/atelier/agency

None

iam:quotas:list

iam:agencies:createAgency

iam:roles:listRoles

iam:permissions:grantRoleToAgency

iam:roles:createRole

√

√

Listing agencies

GET /v1/{project_id}/atelier/agency

None

iam:agencies:listAgencies

√

√

Listing permissions of an agency

GET /v1/{project_id}/atelier/agency/{agency_name}/grants

None

iam:agencies:listAgencies

√

√

None

iam:permissions:listRolesForAgencyOnDomain

iam:permissions:listRolesForAgencyOnProject

iam:permissions:listRolesForAgency

√

√

Listing permissions of an agency

GET /v2/{project_id}/atelier/agency/{agency_id}/grants

None

iam:permissions:listRolesForAgencyOnDomain

iam:permissions:listRolesForAgencyOnProject

iam:permissions:listRolesForAgency

√

√

Updating permissions of an agency

POST /v1/{project_id}/atelier/agency/{agency_name}/grants

None

iam:quotas:list

iam:roles:listRoles

iam:roles:createRole

iam:permissions:grantRoleToAgency

√

√

Listing default agency permissions configured for a service

GET /v1/{project_id}/atelier/agency/default-grants

None

iam:permissions:grantRoleToAgency

√

√

Obtaining agency quotas

GET /v1/{project_id}/atelier/agency/quotas

None

iam:quotas:list

√

√

Deleting agencies

DELETE /v1/{project_id}/atelier/agency/{agency_id}

None

iam:agencies:deleteAgency

√

√

Obtaining an agency ID by agency name

GET /v1/{project_id}/atelier/agency/info

None

iam:agencies:listAgencies

√

√

Listing users

GET /v1/{project_id}/atelier/users

None

iam:users:list

√

√