Configuring Agency Authorization for ModelArts with One Click

Scenario

ModelArts must access other services for AI computing. For example, ModelArts must access OBS to read your data for training. To ensure security, ModelArts requires you to configure an agency before accessing any cloud services. This process involves delegating permissions to ModelArts so it can access those services on your behalf. You must first have the required permissions (granted by IAM), and then delegate ModelArts to access specific cloud services on your behalf to complete AI computing tasks on the ModelArts platform.

ModelArts allows you to quickly add an agency on the Permission Management page. This enables ModelArts to manage service-to-service permissions on your behalf.

Constraints

• The user group to which the user belongs has been authorized using IAM.
• Huawei Cloud account
  • Only a Huawei Cloud account can use an agency to authorize the current account or all IAM users under the current account.
  • Multiple IAM users or accounts can use the same agency.
  • A maximum of 100 agencies can be created under an account.
  • If you use ModelArts for the first time, add an agency. Generally, common user permissions are sufficient for your requirements. You can configure permissions for refined permissions management. On the new ModelArts console, new users can configure ModelArts agency authorization for their accounts in one-click mode.
• IAM user
  • If you have obtained the authorization, you can view the authorization information on the Permission Management page.
  • If you have not been authorized, ModelArts will display a message indicating that you have not been authorized when you access the Add Agency page. In this case, contact your administrator to add authorization.
  • An IAM user with the admin permission can add agencies for itself or other IAM users.

One-Click Authorization

When you use ModelArts for the first time with a Huawei Cloud account or an IAM admin user, a cross-service authorization page appears on the new ModelArts console. Click the authorize button to set up ModelArts authorization quickly.

One-click authorization is only supported on the new ModelArts console in the following regions:

ME-Riyadh

Adding an Agency

If you are not using the ModelArts new console for the first time or you are using the ModelArts old console, you can add an agency on the Permission Management page.

1. Log in to the ModelArts console. In the navigation pane on the left, choose Permission Management.
2. Click Add Agency. On the Add Agency page, configure the parameters.

   Table 1 Parameters

   Parameter	Description
   Agency Type	The options are IAM user, Federated user, Agency, and All users. IAM user: You can use a tenant account to create IAM users and assign permissions for specific resources. Each IAM user has their own identity credentials (password and access keys) and uses cloud resources based on assigned permissions. For details about IAM users, see IAM User. Federated user: A federated user is also called a virtual enterprise user. For details about federated users, see Configuring Federated Identity Authentication. Agency: You can create agencies in IAM. For details about how to create an agency, see Creating an Agency. All users: If you select this option, the agency permissions will be granted to all IAM users under the account, including those created in the future. For individual users, choose All users. When an IAM user gets agency authorization, the order of priority is: IAM user-specific, then all-user. For federated users, the order is: federated user-specific, federated user group-specific, then all-user. Higher-priority authorizations override lower ones.
   Object Name	This parameter is not displayed when Agency Type is set to All users. It is displayed when Agency Type is set to IAM users: IAM user: Select an IAM user and configure an agency for the IAM user. Figure 1 Selecting an IAM user When Agency Type is set Federated users: The object name can be a federated user or user group. Enter the username or user ID of the federated user. Figure 2 Selecting a federated user or user group ModelArts only supports federated users of the virtual user SSO type. This restriction also applies to federated user groups. Permissions granted to a federated user group take effect only for AI jobs. To manage resource pools, the resource administrator must log in to the console using IAM. Add a federated user to only one user group to use the authorization feature. Adding a federated user to multiple groups can cause random authorization effects. When a federated user switches to a new user group, their permissions on ModelArts match those of the new group. After changing user groups for a notebook instance, restart the instance to access or edit notebook instances from the old group. Agency: Select an agency name. You can create an agency under account A and grant the agency permissions to account B. When using account B, you can switch the role in the upper right corner of the console to account A and use the agency permissions of account A. Figure 3 Switch Role
   Agency Type	Add agency: If there is no available agency, create one. If you use ModelArts for the first time, select Add agency. Use existing: If there are agencies in the list, select an available one to authorize the selected user. Click the drop-down arrow next to the agency name to view its permission details.
   Add agency > Agency Name	The system automatically creates an editable agency name. ModelArts creates agency names using these rules: 1. When the agency object type is IAM user, the default agency name is ma_agency_[object_name]. 2. For other agency object types, the default agency name is modelarts_agency. 3. If an agency name generated based on preceding rules already exists, a four-digit random code is automatically suffixed to the name.
   Add agency > Agency Configuration	Users can customize the authorization scope based on service scenarios and grant only the minimum required access. This mode is flexible and secure. This mode applies to scenarios with refined management requirements on the authorization scope. You can select the required permission from the list. Agency template: ModelArts provides preset agency templates for quick and easy configuration. For example, when selecting the agency template for the training module, the system automatically chooses all necessary service and configuration permissions. Service list: You can select services from the list and view and configure the required permissions in the configuration details. Configuration details: View and configure the required permissions.

3. Click Create, enter YES as prompted, and click OK.

   A message will then appear confirming that the agency has been created.

Viewing the Agency List

You can view the configured agency on the Permission Management page. Locate an authorization and click View Permissions in the Operation column to view the permission details.

Modifying the Authorization Scope

1. On the agency list page, click View Permissions to view the permissions of the agency.
2. To modify the authorization scope, click View all permissions at the bottom of the View Permissions dialog box.
   Figure 4 Modifying permissions in IAM
   

3. On the Agencies page of the IAM console, locate the target agency and click Modify in the Operation column to modify the agency information in the Basic Information tab. Set Validity Period as needed. The value can be Unlimited, 1 day, or Custom. If you select Custom, you can then enter the number of days you want the agency to stay valid for, for example, 30.
   Figure 5 Agency information
   

4. On the Permissions page, click Authorize, select policies or roles, and click Next. Select the scope for minimum authorization and click OK.

   When setting the minimum authorization scope, you can select specified projects or all resources. If you select All resources, the selected permissions will be applied to all resources.

Deleting an Authorization

To better manage your authorization, you can delete the authorization of an IAM user or delete the authorizations of all users in batches.

• Deleting an agency of a user

  The agencies configured for the IAM user of the current account are displayed on the Permission Management page. You can locate an agency, click Delete in the Operation column, enter DELETE in the text box, and click OK. After it is deleted, the user cannot use ModelArts functions.

• Batch deleting all agencies

  On the Permission Management page, click Clear Agency above the agency list. Enter DELETE in the text box and click OK. After the deletion, the account and all its IAM users cannot use ModelArts functions.

FAQs

1. How do I configure authorization when I use ModelArts for the first time?

   When you use ModelArts for the first time with a tenant account (administrator) or an IAM admin user, a cross-service authorization page appears on the new ModelArts console. Click the authorize button to set up ModelArts authorization quickly. Other IAM users need to be granted permissions by the administrator. For details, see Creating an IAM User and Granting ModelArts Permissions. When the tenant account (administrator) or an IAM user with the admin permission accesses the ModelArts console of the old version, follow the instructions in Adding an Agency.

2. Why is a message indicating insufficient permissions displayed when I access a page on the ModelArts console?
   Figure 6 Insufficient permissions
   

   The permissions configured for the user agency are insufficient or the module has been upgraded. The authorization information needs to be updated. In this case, you can add agency as prompted.