Authorizing ModelArts to Use SFS Turbo

Context

After creating a network on the console, you can click More in the Operation column and choose Add SFS Turbo or Disassociate on the resource pool network list page. When you associate a network with an SFS Turbo file system, the file system joins the network and becomes available for training and development purposes.

Before you can associate or disassociate an SFS Turbo file system, you must grant ModelArts the permissions to perform operations on SFS Turbo.

To control the permissions, configure the following permission policy items:

• sfsturbo:shares:addShareNic: allows you to add NICs.
• sfsturbo:shares:deleteShareNic: allows you to delete NICs.
• sfsturbo:shares:showShareNic: allows you to obtain NIC details.
• sfsturbo:shares:listShareNics: allows you to obtain NICs.

Constraints

This function is available in certain regions.

Adding an Agency and Granting Permissions for SFS Turbo

1. Log in to the ModelArts console. In the navigation pane on the left, choose Permission Management.
2. Click Add Agency. On the displayed page, configure parameters.
   • Agency Type: Select IAM user, Federated user, Agency, or All users as required.
   • Object Name: Select an object name. Ensure that the user group of this object has completed IAM authorization. Otherwise, subsequent agency configurations cannot take effect.
   • Agency: Select Add agency.
   • Agency Configuration: Select Common. In the service list, select sfsturbo:shares:addShareNic, sfsturbo:shares:deleteShareNic, sfsturbo:shares:showShareNic, and sfsturbo:shares:listShareNics under SFS Turbo.
3. Click Create. After you authorize the agency, any user with the permission can associate or disassociate SFS Turbo.
   Figure 1 Creating an agency and granting certain permissions for ModelArts
   

Adding Permissions to an Existing Agency for SFS Turbo

1. Log in to the management console as a tenant user, hover the cursor over your username in the upper right corner, and choose Identity and Access Management from the drop-down list to switch to the IAM console of the new version.
2. In the navigation pane of the IAM console, choose Identity Policies. Click Create Custom Policy in the upper right corner, configure parameters, and click OK.
   • Policy Name: Enter a custom policy name, for example, Authorizing ModelArts to use SFS Turbo.
   • Policy View: Select Visual editor or JSON.
   • Policy Content: Select Allow. In Select service, search for SFSTurbo and select it. In ReadOnly under Actions, search for sfsturbo:shares:showShareNic and sfsturbo:shares:listShareNics and select them. In ReadWrite under Actions, search for sfsturbo:shares:addShareNic and sfsturbo:shares:deleteShareNic and select them. Select All for All.
   • The sfsturbo:shares:addShareNic action depends on the vpc:subnets:get permission. If the permissions are not granted, click on the right to grant them.
     Figure 2 Policy content
     

     The policy content in JSON view is as follows:

     {
       "Version": "5.0",
       "Statement": [
         {
           "Effect": "Allow",
           "Action": [
             "vpc:subnets:get"
           ]
         },
         {
           "Effect": "Allow",
           "Action": [
             "sfsturbo:shares:addShareNic",
             "sfsturbo:shares:deleteShareNic",
             "sfsturbo:shares:listShareNics",
             "sfsturbo:shares:showShareNic"
           ]
         }
       ]
     }

3. The modelarts_agency agency is used as an example. On the IAM console, click Agencies. Locate modelarts_agency and click Authorize in the Operation column. Choose the custom policy created in 2 and click Next. Then, specify the authorization scope and click OK.

   After you authorize the agency, any user with the permission can associate or disassociate SFS Turbo.

Verification

Log in to the ModelArts console. In the navigation pane on the left, choose Resource Management > Network. Locate the target network and choose More > Add SFS Turbo in the Operation column.

Log in to the ModelArts console. In the navigation pane on the left, choose Resource Management > Network. Locate the target network and choose More > Disassociate SFS Turbo in the Operation column.