Help Center/ DataArts Fabric/ Best Practices/ Example of Configuring Permissions for Using the Inference Service
Updated on 2025-07-18 GMT+08:00

Example of Configuring Permissions for Using the Inference Service

Description

Assume that a company needs to use the DataArts Fabric service and has the following requirements:

  • As the IAM permission administrator, Tom needs to authorize services on the DataArts Fabric page and configure IAM permissions for different roles.
  • As a development engineer, John needs to create a workspace and a Ray cluster.
  • As an algorithm engineer, Robert needs to use the inference file stored in OBS to create a personal inference model or uses the public inference model for experiments.
  • As a test engineer, William needs to query and use the work achievements of other colleagues.

Prerequisites

  • They all have available Huawei Cloud accounts.
  • Tom has the IAM administrator and DataArtsFabricFullPolicy permissions.

Identity and Permission Description

Table 1 Identity and permission description

Employee

Identity

Permissions

Tom

IAM permission administrator

DataArtsFabricFullPolicy and IAM Agency Management FullAccess (used to create an agency for DataArts Fabric) are required.

John

Development engineer

  • DataArtsFabricFullPolicy is required to create workspaces. To specify LakeFormation Metastore during the workspace creation, LakeFormation ReadOnly Access is also required.
  • To create a Ray cluster, DataArtsFabricFullPolicy includes only the permission to create an order for purchasing Ray resources, but does not include the payment permission. Payment must be performed by a fee administrator specified by the customer.

Robert

Algorithm engineer

DataArtsFabricFullPolicy and required OBS permissions are required. To use model files in OBS in DataArts Fabric, some OBS permissions need to be granted by the user permission administrator Tom.

William

Test engineer

DataArtsFabricReadOnlyPolicy policy is required to perform read-only operations.

Procedure

  1. Tom: Log in to the DataArts Fabric console and grant permissions. For details, see Creating an IAM User and Assigning Permissions to Use DataArts Fabric.

    • Grant the DataArtsFabricFullPolicy and LakeFormation ReadOnly Access permissions to John.
    • Grant the DataArtsFabricFullPolicy permissions and OBS OperateAccess permissions for the OBS bucket my-obs-bucket to Robert.
    • Grant the DataArtsFabricReadOnlyPolicy permissions to William.

  2. John: Create a workspace on the DataArts Fabric console and specify MetaStore. For details, see Creating a Workspace.
  3. John: In the new workspace, purchase Ray resources and generate an order. For details, see Purchasing a Ray Resource.
  4. Tom: Go to the order payment page and pays for the order. After the payment is complete, the Ray cluster is automatically created. For details, see Purchasing a Ray Resource.
  5. John: Execute a job on the Ray cluster. For details, see Creating a Ray Job.
  6. Robert: Create a model on the Model page and specify the OBS address of the model file. For details, see Creating a Model.
  7. Robert: Use the model to build an inference service and completes the test and debugging in the playground. For details, see Using an Inference Service for Inference.
  8. William: Check the running result of the Ray job and tests the inference service built by Robert in the playground. For details, see Managing Ray Jobs and Performing Inference in the Playground.