Help Center/ ModelArts/ API Reference/ Permissions Policies and Supported Actions/ Workspace Management
Updated on 2026-07-24 GMT+08:00
View PDF
Share

Workspace Management

Scenario-Level Authorization Examples

New IAM console: Provides system-defined identity policies based on IAM 5.0. You can create custom policies on the new IAM console and assign them to the user group you belong to. However, because some modules have not yet fully integrated with IAM 5.0, you still need to create custom policies on the old IAM console. Configure the following IAM 3.0 policies and assign them to the user group that you belong to. For details, see the table below.
Table 1 Workspace management policies in the new IAM console

Policy Name

Description

Type

Additional IAM 3.0 Policies Required

ModelArtsWorkspaceReadOnlyPolicy

ModelArts Workspace read-only policy.

System-defined

 
{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "modelarts:exemlProject:delete",
                "modelarts:fusionJob:getWorkspacesCleanupTask",
                "modelarts:fusionJob:workspacesCleanup",
                "modelarts:model:delete",
                "modelarts:workflow:delete",
                "modelarts:workspace:delete",
                "modelarts:workspace:get",
                "modelarts:pool:list"
            ]
        }
    ]
}

ModelArtsWorkspaceAllPolicy

ModelArts Workspace all policy.

System-defined

 
{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "modelarts:exemlProject:delete",
                "modelarts:fusionJob:getWorkspacesCleanupTask",
                "modelarts:fusionJob:workspacesCleanup",
                "modelarts:model:delete",
                "modelarts:workflow:delete",
                "modelarts:workspace:delete",
                "modelarts:workspace:get",
                "modelarts:pool:list"
            ]
        }
    ]
}
Old IAM console: System-defined identity policies based on IAM 3.0 are not provided. You need to create custom identity policies on the old IAM console for scenario-level authorization. For details, see the table below.
Table 2 Workspace management policies in the old IAM console

Scenario

Example

Read/Write (IAM 3.0)

Policies that need to be created separately for ModelArts:

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "modelarts:authorization:create",
                "modelarts:authorization:delete",
                "modelarts:authorization:list",
                "modelarts:exemlProject:delete",
                "modelarts:fusionJob:getWorkspacesCleanupTask",
                "modelarts:fusionJob:workspacesCleanup",
                "modelarts:model:delete",
                "modelarts:pool:list",
                "modelarts:workflow:delete",
                "modelarts:workspace:checkAuthorizations",
                "modelarts:workspace:create",
                "modelarts:workspace:delete",
                "modelarts:workspace:get",
                "modelarts:workspace:getAuthMode",
                "modelarts:workspace:getQuotas",
                "modelarts:workspace:getUserList",
                "modelarts:workspace:getUserRoles",
                "modelarts:workspace:list",
                "modelarts:workspace:update",
                "modelarts:workspace:updateAuthMode",
                "modelarts:workspace:updateQuotas"
            ]
        }
    ]
}

Policies that need to be created separately for IAM:

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:quotas:listQuotasForProject",
                "iam:quotas:listQuotas",
                "iam:agencies:createAgency",
                "iam:agencies:listAgencies",
                "iam:permissions:listRolesForAgency",
                "iam:permissions:grantRoleToAgencyOnDomain",
                "iam:permissions:grantRoleToAgency",
                "iam:agencies:deleteAgency",
                "iam:users:listUsers",
                "iam:roles:listRoles",
                "iam:roles:createRole",
                "iam:roles:updateRole",
                "iam:agencies:getAgency",
                "iam:groups:listGroups",
                "iam:permissions:listRolesForAgencyOnDomain",
                "iam:permissions:listRolesForAgencyOnProject",
                "iam:permissions:listRolesForAgency"
            ]
        }
    ]
}

API-Level Authorization

Table 3 Fine-grained permissions for workspace management

Permission

API

Actions (IAM 3.0)

Actions (IAM 5.0)

Dependency

IAM Project

Enterprise Project

Creating workspaces

POST /v1/{project_id}/workspaces

modelarts:workspace:create

modelarts:workspace:create

eps:enterpriseProjects:list

√

√

Obtaining workspaces

GET /v1/{project_id}/workspaces

modelarts:workspace:list

modelarts:workspace:list

eps:enterpriseProjects:list

√

√

Obtaining workspace details

GET /v1/{project_id}/workspaces/{workspace_id}

modelarts:workspace:get

modelarts:workspace:get

eps:enterpriseProjects:list

√

√

Modifying workspaces

PUT /v1/{project_id}/workspaces/{workspace_id}

modelarts:workspace:update

modelarts:workspace:update

eps:enterpriseProjects:list

√

√

Deleting workspaces

DELETE /v1/{project_id}/workspaces/{workspace_id}

modelarts:workspace:delete

modelarts:service:delete

modelarts:model:delete

modelarts:tensorboard:delete

modelarts:trainJob:delete

modelarts:exemlProject:deletemodelarts:notebook:delete

modelarts:dataset:delete

modelarts:notebook:delete

modelarts:workspace:delete

modelarts:service:delete

modelarts:model:delete

modelarts:tensorboard:delete

modelarts:trainJob:delete

modelarts:exemlProject:deletemodelarts:notebook:delete

modelarts:dataset:delete

modelarts:notebook:delete

eps:enterpriseProjects:list

√

√

Obtaining workspace quotas

GET /v1/{project_id}/workspaces/{workspace_id}/quotas

modelarts:workspace:getQuotas

modelarts:workspace:getQuotas

eps:enterpriseProjects:list

√

√

Modifying workspace quotas

PUT /v1/{project_id}/workspaces/{workspace_id}/quotas

modelarts:workspace:updateQuotas

modelarts:workspace:updateQuotas

eps:enterpriseProjects:list

√

√