IAM

IAM Permissions

If you need to assign different permissions to employees in your enterprise to access your purchased ModelArts resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, fine-grained permissions management, and access control. IAM helps you secure access to your cloud resources. If your Huawei account can meet your requirements and you do not need an IAM account to manage user permissions, skip this chapter.

IAM is a free service. You only pay for the resources in your account.

With IAM, you can assign permissions to control users' access to specific resources. For example, if the software developers in your enterprise need to own permissions to use ModelArts, yet you do not want them to own high-risk operation permissions such as deleting ModelArts, you can grant permissions using IAM to limit their permission on ModelArts.

For details about IAM, see What is IAM?

Role/Policy-based Authorization

ModelArts supports role/policy-based authorization. By default, new IAM users do not have any permissions. You need to add a user to one or more groups, and assign permissions policies or roles to these groups. Users inherit permissions of the groups to which they are added. This process is called authorization. The users then inherit permissions from the groups and can perform specified operations on cloud services.

ModelArts is a project-level service deployed for specific regions. When you set Scope to Region-specific projects and select the specified projects (for example, ap-southeast-2) in the specified regions (for example, AP-Bangkok), the users only have permissions for ModelArts resources in the selected projects. If you set Scope to All resources, the users have permissions for ModelArts resources in all region-specific projects. When accessing ModelArts, the users need to switch to a region where they have been authorized to use cloud services.

Table 1 lists all system-defined policies supported by ModelArts. If preset ModelArts permissions cannot meet your requirements, create a custom policy by referring to Policy Fields in JSON Format.

ModelArts depends on other cloud services. To check or view the cloud services, configure the corresponding permissions on the ModelArts console. The dependencies are as follows.

If system-defined policies cannot meet your requirements, you can create a custom policy. For details about the actions supported by custom policies, see ModelArts Resource Permissions.

To create a custom policy, choose either visual editor or JSON.

• Visual editor: Select cloud services, actions, resources, and request conditions without the need to know policy syntax.
• JSON: Create a JSON policy or edit an existing one.

For details, see Creating a Custom Policy. This section provides examples of common custom ModelArts policies.

• Example 1: Grant permission to manage images.

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "modelarts:image:register",
                  "modelarts:image:listGroup"
              ]
          }
      ]
  }

• Example 2: Grant permission to deny creating, updating, and deleting a dedicated resource pool.

  A policy with only "Deny" permissions must be used together with other policies. If the permissions granted to an IAM user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.

  {
      "Version": "1.1",
      "Statement": [
          {
              "Action": [
                  "modelarts:*:*"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "swr:*:*"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "smn:*:*"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "modelarts:pool:create",
                  "modelarts:pool:update",
                  "modelarts:pool:delete"
              ],
              "Effect": "Deny"
          }
      ]
  }

• Example 3: Create a custom policy containing multiple actions.

  A custom policy can contain actions of multiple services that are of the global or project-level type. The following is an example policy containing actions of multiple services:

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "modelarts:service:*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "lts:logs:list"
              ]
          }
      ]
  }

Policy Fields in JSON Format

Policy Structure

A policy consists of a version and one or more statements (indicating different actions).

Figure 1 Policy structure

Policy Parameters

The following describes policy parameters. You can create custom policies by specifying the parameters. For details, see Custom Policy Use Cases.

ModelArts Resource Types

Administrators can specify the scope based on ModelArts resource types. The following table lists the resource types supported by ModelArts:

ModelArts Resource Permissions

For details, see "Permissions Policies and Supported Actions" in ModelArts API Reference.

• Data Management Permissions
• DevEnviron Permissions
• Training Job Permissions
• Model Management Permissions
• Service Management Permissions