Development Environment

Scenario-based Authorization Examples

New IAM console: Provides system-defined identity policies based on IAM version 5.0. You can configure scenario-based authorizations directly on the new IAM console.

**Table 1** Policies for operation scenarios in the new IAM console
Policy	Description	Type
ModelArtsNotebookAllPolicy	ModelArts Notebook all policy.	System-defined
ModelArtsNotebookReadOnlyPolicy	ModelArts Notebook read-only policy.	System-defined

Old IAM console: Requires you to create custom identity policies on the old IAM console for scenario-level authorization. The created custom policies must then be assigned to the user group that you belong to. For details, see the table below.

**Table 2** Scenario-based authorization
Scenario	Example
Read/Write (IAM 3.0)	{ "Version": "1.1", "Statement": [ { "Action": [ "modelarts:authorization:list", "modelarts:image:create", "modelarts:image:delete", "modelarts:image:get", "modelarts:image:list", "modelarts:image:listGroup", "modelarts:image:register", "modelarts:network:get", "modelarts:network:list", "modelarts:notebook:create", "modelarts:notebook:delete", "modelarts:notebook:get", "modelarts:notebook:getMountedStorage", "modelarts:notebook:list", "modelarts:notebook:listAllNotebooks", "modelarts:notebook:listMountedStorages", "modelarts:notebook:mountStorage", "modelarts:notebook:start", "modelarts:notebook:stop", "modelarts:notebook:umountStorage", "modelarts:notebook:update", "modelarts:notebook:updateStopPolicy", "modelarts:pool:get", "modelarts:pool:list", "modelarts:tag:list", "modelarts:trainJob:create", "modelarts:trainJob:get", "modelarts:trainJob:list", "modelarts:trainJob:logExport", "modelarts:trainJob:update", "modelarts:trainJobVersion:delete", "modelarts:workspace:getQuotas", "modelarts:workspace:get", "aom:alarm:list", "aom:metric:get", "aom:metric:list", "csms:secret:create", "csms:secret:list", "csms:secret:get", "csms:secret:getVersion", "iam:projects:listProjects", "iam:users:listUsers", "kms:cmk:list", "kms:dek:decrypt", "kps:domainKeypairs:get", "kps:domainKeypairs:list", "kps:SSHKeyPair:get", "obs:bucket:getBucketAcl", "obs:bucket:getBucketLocation", "obs:bucket:getBucketPolicy", "obs:bucket:headBucket", "obs:bucket:listAllMyBuckets", "obs:bucket:listBucket", "obs:bucket:putBucketAcl", "obs:object:abortMultipartUpload", "obs:object:deleteObject", "obs:object:deleteObjectVersion", "obs:object:getObject", "obs:object:getObjectAcl", "obs:object:getObjectVersion", "obs:object:getObjectVersionAcl", "obs:object:listMultipartUploadParts", "obs:object:modifyObjectMetadata", "obs:object:putObject", "obs:object:putObjectAcl", "sfsturbo:shares:getShare", "sfsturbo:shares:showFsDir", "swr:instance:createTempCredential", "swr:repo:download", "swr:repo:upload", "swr:repository:uploadArtifact", "swr:repository:downloadArtifact", "swr:instance:get", "swr:namespace:getNamespace", "swr:repo:getRepo", "swr:repo:getRepoDomain", "swr:repo:listRepoTags", "swr:repository:deleteTag", "swr:repository:getTag", "swr:repository:listNamespaces", "swr:namespace:listNamespaces", "swr:instance:list", "swr:instance:listDomainNames", "tms:predefineTags:list", "vpc:quotas:list", "vpc:securityGroups:get", "vpc:subnets:get", "vpc:vpcs:get", "vpc:vpcs:list" ], "Effect": "Allow" } ] }
Read-only (IAM 3.0)	{ "Version": "1.1", "Statement": [ { "Action": [ "modelarts:tag:list", "modelarts:notebook:listMountedStorages", "modelarts:notebook:listAllNotebooks", "modelarts:notebook:list", "modelarts:notebook:getMountedStorage", "modelarts:notebook:get" ], "Effect": "Allow" } ] }

Table 2 Scenario-based authorization

Scenario

Example

Read/Write (IAM 3.0)

{
  "Version": "1.1",
  "Statement": [
    {
      "Action": [
        "modelarts:authorization:list",
        "modelarts:image:create",
        "modelarts:image:delete",
        "modelarts:image:get",
        "modelarts:image:list",
        "modelarts:image:listGroup",
        "modelarts:image:register",
        "modelarts:network:get",
        "modelarts:network:list",
        "modelarts:notebook:create",
        "modelarts:notebook:delete",
        "modelarts:notebook:get",
        "modelarts:notebook:getMountedStorage",
        "modelarts:notebook:list",
        "modelarts:notebook:listAllNotebooks",
        "modelarts:notebook:listMountedStorages",
        "modelarts:notebook:mountStorage",
        "modelarts:notebook:start",
        "modelarts:notebook:stop",
        "modelarts:notebook:umountStorage",
        "modelarts:notebook:update",
        "modelarts:notebook:updateStopPolicy",
        "modelarts:pool:get",
        "modelarts:pool:list",
        "modelarts:tag:list",
        "modelarts:trainJob:create",
        "modelarts:trainJob:get",
        "modelarts:trainJob:list",
        "modelarts:trainJob:logExport",
        "modelarts:trainJob:update",
        "modelarts:trainJobVersion:delete",
        "modelarts:workspace:getQuotas",
        "modelarts:workspace:get",
        "aom:alarm:list",
        "aom:metric:get",
        "aom:metric:list",
        "csms:secret:create",
        "csms:secret:list",
        "csms:secret:get",
        "csms:secret:getVersion",
        "iam:projects:listProjects",
        "iam:users:listUsers",
        "kms:cmk:list",
        "kms:dek:decrypt",
        "kps:domainKeypairs:get",
        "kps:domainKeypairs:list",
        "kps:SSHKeyPair:get",
        "obs:bucket:getBucketAcl",
        "obs:bucket:getBucketLocation",
        "obs:bucket:getBucketPolicy",
        "obs:bucket:headBucket",
        "obs:bucket:listAllMyBuckets",
        "obs:bucket:listBucket",
        "obs:bucket:putBucketAcl",
        "obs:object:abortMultipartUpload",
        "obs:object:deleteObject",
        "obs:object:deleteObjectVersion",
        "obs:object:getObject",
        "obs:object:getObjectAcl",
        "obs:object:getObjectVersion",
        "obs:object:getObjectVersionAcl",
        "obs:object:listMultipartUploadParts",
        "obs:object:modifyObjectMetadata",
        "obs:object:putObject",
        "obs:object:putObjectAcl",
        "sfsturbo:shares:getShare",
        "sfsturbo:shares:showFsDir",
        "swr:instance:createTempCredential",
        "swr:repo:download",
        "swr:repo:upload",
        "swr:repository:uploadArtifact",
        "swr:repository:downloadArtifact",
        "swr:instance:get",
        "swr:namespace:getNamespace",
        "swr:repo:getRepo",
        "swr:repo:getRepoDomain",
        "swr:repo:listRepoTags",
        "swr:repository:deleteTag",
        "swr:repository:getTag",
        "swr:repository:listNamespaces",
        "swr:namespace:listNamespaces",
        "swr:instance:list",
        "swr:instance:listDomainNames",
        "tms:predefineTags:list",
        "vpc:quotas:list",
        "vpc:securityGroups:get",
        "vpc:subnets:get",
        "vpc:vpcs:get",
        "vpc:vpcs:list"
      ],
      "Effect": "Allow"
    }
  ]
}

Read-only (IAM 3.0)

{
  "Version": "1.1",
  "Statement": [
    {
      "Action": [
        "modelarts:tag:list",
        "modelarts:notebook:listMountedStorages",
        "modelarts:notebook:listAllNotebooks",
        "modelarts:notebook:list",
        "modelarts:notebook:getMountedStorage",
        "modelarts:notebook:get"
      ],
      "Effect": "Allow"
    }
  ]
}

API-Level Authorization Description

If you need to use the relevant features of the ModelArts console development environment and perform permissions management, refer to the table below.

**Table 3** Fine-grained permissions for development environment
Permission	API	Action (IAM 3.0)	Action (IAM 5.0)	Dependency	IAM Project	Enterprise Project
Creating notebook instances	POST /v1/{project_id}/notebooks	modelarts:notebook:create	modelarts:notebook:create	swr:repo:listRepoTags swr:repo:getRepo swr:namespace:getNamespace swr:repo:getRepoDomain swr:repository:getTag swr:instance:get swr:instance:createTempCredential kps:SSHKeyPair:get vpc:vpcs:list vpc:subnets:get vpc:securityGroups:get vpc:quotas:list vpc:subnets:get csms:secret:get csms:secret:getVersion sfsturbo:shares:getShare sfsturbo:shares:showFsDir obs:object:GetObject obs:bucket:HeadBucket obs:bucket:GetBucketPolicy obs:bucket:GetBucketAcl obs:bucket:PutBucketAcl kms:dek:decrypt	√	√
Querying notebook instances	GET /v1/{project_id}/notebooks	modelarts:notebook:list	modelarts:notebook:list	-	√	√
Querying all notebook instances	GET /v1/{project_id}/notebooks/all	modelarts:notebook:listAllNotebooks	modelarts:notebook:listAllNotebooks	-	√	×
Obtaining details about a notebook instance	GET /v1/{project_id}/notebooks/{id}	modelarts:notebook:get	modelarts:notebook:get	-	√	√
Updating notebook instances	PUT /v1/{project_id}/notebooks/{id}	modelarts:notebook:update	modelarts:notebook:updateNotebook	csms:secret:get csms:secret:getVersion kps:SSHKeyPair:get	√	√
Deleting notebook instances	DELETE /v1/{project_id}/notebooks/{id}	modelarts:notebook:delete	modelarts:notebook:delete	-	√	√
Saving a running instance as a container image	POST /v1/{project_id}/notebooks/{id}/create-image	modelarts:image:create	modelarts:image:create	swr:namespace:getNamespace swr:repo:listRepoTags swr:repository:listNamespaces swr:repository:getTag	√	√
Obtaining available flavors supported by a notebook instance	GET /v1/{project_id}/notebooks/flavors	-	-	-	√	√
Obtaining the list of available flavors supported by a notebook instance	GET /v1/{project_id}/notebooks/{id}/flavors	-	-	-	√	√
Obtaining the available duration of a running notebook instance	GET /v1/{project_id}/notebooks/{id}/lease	-	-	-	√	√
Renewing the duration of a notebook instance	PATCH /v1/{project_id}/notebooks/{id}/lease	modelarts:notebook:updateStopPolicy	modelarts:notebook:updateStopPolicy	-	√	√
Starting notebook instances	POST /v1/{project_id}/notebooks/{id}/start	modelarts:notebook:start	modelarts:notebook:start	swr:repo:listRepoTags swr:repo:getRepo swr:namespace:getNamespace swr:repo:getRepoDomain swr:repository:getTag swr:instance:get swr:instance:createTempCredential kps:SSHKeyPair:get csms:secret:get csms:secret:getVersion sfsturbo:shares:getShare obs:object:GetObject obs:bucket:HeadBucket obs:bucket:GetBucketPolicy obs:bucket:GetBucketAcl obs:bucket:PutBucketAcl	√	√
Stopping notebook instances	POST /v1/{project_id}/notebooks/{id}/stop	modelarts:notebook:stop	modelarts:notebook:stop	-	√	√
Obtaining the OBS instance information list	GET /v1/{project_id}/notebooks/{id}/storage	modelarts:notebook:listMountedStorages	modelarts:notebook:listMountedStorages	-	√	√
Mounting OBS dynamically	POST /v1/{project_id}/notebooks/{instance_id}/storage	modelarts:notebook:mountStorage	modelarts:notebook:mountStorage	-	√	√
Obtaining the details of a dynamically mounted OBS instance	GET /v1/{project_id}/notebooks/{instance_id}/storage/{storage_id}	modelarts:notebook:getMountedStorage	modelarts:notebook:getMountedStorage	-	√	√
Dynamically unmounting OBS	DELETE /v1/{project_id}/notebooks/{instance_id}/storage/{storage_id}	modelarts:notebook:umountStorage	modelarts:notebook:umountStorage	-	√	√
Adding resource tags	POST /v1/{project_id}/notebooks/{resource_id}/tags/create	modelarts:notebook:update	modelarts:notebook:update modelarts::tagResource	-	√	√
Deleting resource tags	DELETE /v1/{project_id}/notebooks/{resource_id}/tags/delete	modelarts:notebook:update	modelarts:notebook:update modelarts::unTagResource	-	√	√
Obtaining notebook instance tags	GET /v1/{project_id}/notebooks/tags	modelarts:tag:list	modelarts:tag:list	-	√	√
Opening serverless development environment instances (CodeLab)	POST /v1/{project_id}/notebooks/open	modelarts:notebook:open	modelarts:notebook:open	swr:repo:listRepoTags swr:repo:getRepo swr:namespace:getNamespace swr:repo:getRepoDomain swr:repository:getTag swr:instance:get swr:instance:createTempCredential	√	√
Batch deleting resource tags via TMS integration	DELETE /v1/{project_id}/modelarts-notebook/{resource_id}/tags/delete	modelarts:notebook:update	modelarts:notebook:update	-	√	√
Obtaining project tags via TMS integration	GET /v1/{project_id}/modelarts-notebook/tags	modelarts:tag:list	modelarts:tag:list	-	√	√
Obtaining resource tags via TMS integration	GET /v1/{project_id}/modelarts-notebook/{resource_id}/tags	modelarts:tag:list	modelarts:tag:list	-	√	√
Obtaining the number of resource instances via TMS integration	POST /v1/{project_id}/modelarts-notebook/resource-instances/count	modelarts:notebook:list	modelarts:notebook:list	-	√	√
Obtaining the list of resource instances via TMS integration	POST /v1/{project_id}/modelarts-notebook/resource-instances/filter	modelarts:notebook:list	modelarts:notebook:list	-	√	√
Batch creating resource tags via TMS integration	POST /v1/{project_id}/modelarts-notebook/{resource_id}/tags/create	modelarts:notebook:update	modelarts:notebook:update	-	√	√

Parent topic: Permissions Policies and Supported Actions

Previous topic: Workspace Management

Next topic: Workflow

Development Environment

Scenario-based Authorization Examples

API-Level Authorization Description

What is your overall rating for this page?