Dependencies and Agencies
Function Dependency
Function Dependency Policies
When using ModelArts, you may be required to use other cloud services. For example, before submitting a training job, you must select OBS paths for storing the dataset and logs, respectively. Therefore, when configuring fine-grained authorization policies for a user, the administrator must configure dependent permissions so that the user can use required functions.

- If you use ModelArts as the root user (default IAM user with the same name as the account), the root user has all permissions by default.
- Ensure that the current user has the dependent policy permissions for agency authorization. For example, if you want to grant the SWR Admin permission to a ModelArts agency, ensure that you have the SWR Admin permission.
Application Scenario |
Dependent Service |
Dependent Policy |
Supported Function |
---|---|---|---|
Global configuration |
IAM |
iam:users:listUsers |
Obtain a user list. This action is required by the administrator only. |
Basic function |
IAM |
iam:tokens:assume |
(Mandatory) Use an agency to obtain temporary authentication credentials. |
Basic function |
BSS |
bss:balance:view |
Show the balance of the current account on the page after resources are created on the ModelArts console. |
Application Scenario |
Dependent Service |
Dependent Policy |
Supported Function |
---|---|---|---|
Workspace |
IAM |
iam:users:listUsers |
Authorize an IAM user to use a workspace. |
ModelArts |
modelarts:*:delete* |
Clear resources in a workspace when deleting it. |
Application Scenario |
Dependent Service |
Dependent Policy |
Supported Function |
---|---|---|---|
Lifecycle management of development environment instances |
ModelArts |
modelarts:notebook:create modelarts:notebook:list modelarts:notebook:get modelarts:notebook:update modelarts:notebook:delete modelarts:notebook:start modelarts:notebook:stop modelarts:notebook:updateStopPolicy modelarts:image:delete modelarts:image:list modelarts:image:create modelarts:image:get modelarts:pool:list modelarts:tag:list modelarts:network:get |
Start, stop, create, delete, and update an instance. |
AOM |
aom:metric:get aom:metric:list aom:alarm:list |
||
VPC |
vpc:securityGroups:get vpc:vpcs:list vpc:securityGroups:get vpc:vpcs:list |
||
Dynamically mounting storage |
ModelArts |
modelarts:notebook:listMountedStorages modelarts:notebook:mountStorage modelarts:notebook:getMountedStorage modelarts:notebook:umountStorage |
Dynamically mount storage. |
OBS |
obs:bucket:ListAllMyBuckets obs:bucket:ListBucket |
||
Image management |
ModelArts |
modelarts:image:register modelarts:image:listGroup |
Register and view an image on the Image Management page. |
Saving an image |
SWR |
SWR Admin |
The SWR Admin policy contains the maximum scope of SWR permissions, which can be used to:
|
Using the SSH function |
ECS |
ecs:serverKeypairs:list ecs:serverKeypairs:get ecs:serverKeypairs:delete ecs:serverKeypairs:create |
Configure a login key for a notebook instance. |
DEW |
kps:domainKeypairs:get kps:domainKeypairs:list kps:domainKeypairs:createkmskey |
||
KMS |
kms:cmk:list |
||
Mounting an SFS Turbo file system |
SFS Turbo |
SFS Turbo FullAccess |
Read and write an SFS directory as an IAM user. Mount an SFS file system that is not created by you to a notebook instance using a dedicated resource pool. |
Viewing all Instances |
ModelArts |
modelarts:notebook:listAllNotebooks |
View development environment instances of all users on the ModelArts management console. This action is required by the development environment instance administrator. |
IAM |
iam:users:listUsers |
||
Local VS Code plug-in or PyCharm Toolkit |
ModelArts |
modelarts:notebook:listAllNotebooks modelarts:trainJob:create modelarts:trainJob:list modelarts:trainJob:update modelarts:trainJobVersion:delete modelarts:trainJob:get modelarts:trainJob:logExport modelarts:workspace:getQuotas (This policy is required if the workspace function is enabled.) |
Access a notebook instance from local VS Code and submit training jobs. |
OBS |
obs:bucket:ListAllMybuckets obs:bucket:HeadBucket obs:bucket:ListBucket obs:bucket:GetBucketLocation obs:object:GetObject obs:object:GetObjectVersion obs:object:PutObject obs:object:DeleteObject obs:object:DeleteObjectVersion obs:object:ListMultipartUploadParts obs:object:AbortMultipartUpload obs:object:GetObjectAcl obs:object:GetObjectVersionAcl obs:bucket:PutBucketAcl obs:object:PutObjectAcl obs:object:ModifyObjectMetaData |
||
IAM |
iam:projects:listProjects |
Obtain an IAM project list through local PyCharm for access configurations. |
Application Scenario |
Dependent Service |
Dependent Policy |
Supported Function |
---|---|---|---|
Elastic node server lifecycle management |
ModelArts |
modelarts:devserver:create modelarts:devserver:listByUser modelarts:devserver:list modelarts:devserver:get modelarts:devserver:delete modelarts:devserver:start modelarts:devserver:stop modelarts:devserver:sync |
Create, start, and stop an instance, obtain the instance list, obtain all instances of a tenant, obtain instance details, and synchronize instance status. |
ECS |
ecs:serverKeypairs:createecs:*:get |
||
IAM |
iam:users:getUser iam:users:listUsers iam:projects:listProjects |
||
VPC |
vpc.*.list |
||
EPS |
eps.*.list |
||
EVS |
evs.*.list |
||
IMS |
ims.*.list ims.*.get |
Application Scenario |
Dependent Service |
Dependent Policy |
Supported Function |
---|---|---|---|
Training management |
ModelArts |
modelarts:trainJob:* modelarts:trainJobLog:* modelarts:aiAlgorithm:* modelarts:image:list modelarts:network:get modelarts:workspace:get |
Create a training job and view training logs. |
modelarts:workspace:getQuota |
Obtain a workspace quota. This policy is required if workspace function is enabled. |
||
modelarts:tag:list |
Use Tag Management Service (TMS) in a training job. |
||
IAM |
iam:credentials:listCredentials iam:agencies:listAgencies |
Use the configured agency authorization. |
|
SFS Turbo |
sfsturbo:shares:getShare sfsturbo:shares:getAllShares |
Use SFS Turbo in a training job. |
|
SWR |
SWR Admin |
Use a custom image to create a training job. |
|
SMN |
smn:topic:publish smn:topic:list |
Notify training job status changes through SMN. |
|
OBS |
obs:bucket:ListAllMybuckets obs:bucket:HeadBucket obs:bucket:ListBucket obs:bucket:GetBucketLocation obs:object:GetObject obs:object:GetObjectVersion obs:object:PutObject obs:object:DeleteObject obs:object:DeleteObjectVersion obs:object:ListMultipartUploadParts obs:object:AbortMultipartUpload obs:object:GetObjectAcl obs:object:GetObjectVersionAcl obs:bucket:PutBucketAcl obs:object:PutObjectAcl obs:object:ModifyObjectMetaData |
Run a training job using a dataset in an OBS bucket. |
Application Scenario |
Dependent Service |
Dependent Policy |
Supported Function |
---|---|---|---|
Using a dataset |
ModelArts |
modelarts:dataset:getDataset modelarts:dataset:createDataset modelarts:dataset:createDatasetVersion modelarts:dataset:createImportTask modelarts:dataset:updateDataset modelarts:processTask:createProcessTask modelarts:processTask:getProcessTask modelarts:dataset:listDatasets |
Use ModelArts datasets in a workflow. |
Model management |
ModelArts |
modelarts:model:list modelarts:model:get modelarts:model:create modelarts:model:delete modelarts:model:update |
Manage ModelArts models in a workflow. |
Deploying a service |
ModelArts |
modelarts:service:get modelarts:service:create modelarts:service:update modelarts:service:delete modelarts:service:getLogs |
Manage ModelArts real-time services in a workflow. |
Training jobs |
ModelArts |
modelarts:trainJob:get modelarts:trainJob:create modelarts:trainJob:list modelarts:trainJobVersion:list modelarts:trainJobVersion:create modelarts:trainJob:delete modelarts:trainJobVersion:delete modelarts:trainJobVersion:stop |
Manage ModelArts training jobs in a workflow. |
Workspace |
ModelArts |
modelarts:workspace:get modelarts:workspace:getQuotas |
Use ModelArts workspaces in a workflow. |
Managing data |
OBS |
obs:bucket:ListAllMybuckets (Obtaining a bucket list) obs:bucket:HeadBucket (Obtaining bucket metadata) obs:bucket:ListBucket (Listing objects in a bucket) obs:bucket:GetBucketLocation (Obtaining the bucket location) obs:object:GetObject (Obtaining object content and metadata) obs:object:GetObjectVersion (Obtaining object content and metadata) obs:object:PutObject (Uploading objects using PUT method, uploading objects using POST method, copying objects, appending an object, initializing a multipart task, uploading parts, and merging parts) obs:object:DeleteObject (Deleting an object or batch deleting objects) obs:object:DeleteObjectVersion (Deleting an object or batch deleting objects) obs:object:ListMultipartUploadParts (Listing uploaded parts) obs:object:AbortMultipartUpload (Aborting multipart uploads) obs:object:GetObjectAcl (Obtaining an object ACL) obs:object:GetObjectVersionAcl (Obtaining an object ACL) obs:bucket:PutBucketAcl (Configuring a bucket ACL) obs:object:PutObjectAcl (Configuring an object ACL) |
Use OBS data in a workflow. |
Executing a workflow |
IAM |
iam:users:listUsers (Obtaining users) iam:agencies:getAgency (Obtaining details about a specified agency) iam:tokens:assume (Obtaining an agency token) |
Call other ModelArts services when a workflow is running. |
Integrating DLI |
DLI |
dli:jobs:get (Obtaining job details) dli:jobs:list_all (Viewing a job list) dli:jobs:create (Creating a job) |
Integrate DLI into a workflow. |
Integrating MRS |
MRS |
mrs:job:get (Obtaining job details) mrs:job:submit (Creating and executing a job) mrs:job:list (Viewing a job list) mrs:job:stop (Stopping a job) mrs:job:batchDelete (Batch deleting jobs) mrs:file:list (Viewing a file list) |
Integrate MRS into a workflow. |
Application Scenario |
Dependent Service |
Dependent Policy |
Supported Function |
---|---|---|---|
Model management |
SWR |
SWR Admin |
Use a custom engine when you import a model from a custom image or OBS. SWR shared edition does not support fine-grained permissions. Therefore, the administrator permission is required. |
OBS |
obs:bucket:ListAllMybuckets (Obtaining a bucket list) obs:bucket:HeadBucket (Obtaining bucket metadata) obs:bucket:ListBucket (Listing objects in a bucket) obs:bucket:GetBucketLocation (Obtaining the bucket location) obs:object:GetObject (Obtaining object content and metadata) obs:object:GetObjectVersion (Obtaining object content and metadata) obs:object:PutObject (Uploading objects using PUT method, uploading objects using POST method, copying objects, appending an object, initializing a multipart task, uploading parts, and merging parts) obs:object:DeleteObject (Deleting an object or batch deleting objects) obs:object:DeleteObjectVersion (Deleting an object or batch deleting objects) obs:object:ListMultipartUploadParts (Listing uploaded parts) obs:object:AbortMultipartUpload (Aborting multipart uploads) obs:object:GetObjectAcl (Obtaining an object ACL) obs:object:GetObjectVersionAcl (Obtaining an object ACL) obs:bucket:PutBucketAcl (Configuring a bucket ACL) obs:object:PutObjectAcl (Configuring an object ACL) |
Import a model from OBS. Specify an OBS path for model conversion. |
Application Scenario |
Dependent Service |
Dependent Policy |
Supported Function |
---|---|---|---|
Real-time services |
LTS |
lts:logs:list (Obtaining the log list) |
Show LTS logs. |
OBS |
obs:bucket:GetBucketPolicy (Obtaining a bucket policy) obs:bucket:HeadBucket (Obtaining bucket metadata) obs:bucket:ListAllMyBuckets (Obtaining a bucket list) obs:bucket:PutBucketPolicy (Configuring a bucket policy) obs:bucket:DeleteBucketPolicy (Deleting a bucket policy) |
Mount external volumes to a container when services are running. |
|
Batch services |
OBS |
obs:object:GetObject (Obtaining object content and metadata) obs:object:PutObject (Uploading objects using PUT method, uploading objects using POST method, copying objects, appending an object, initializing a multipart task, uploading parts, and merging parts) obs:bucket:CreateBucket (Creating a bucket) obs:bucket:ListBucket (Listing objects in a bucket) obs:bucket:ListAllMyBuckets (Obtaining a bucket list) |
Create batch services and perform batch inference. |
Edge services |
CES |
ces:metricData:list: (Obtaining metric data) |
View monitoring metrics. |
IEF |
ief:deployment:delete (Deleting a deployment) |
Manage edge services. |
|
AOM metric alarm events |
AOM |
aom:alarm:list |
View AOM monitoring information. |
Application Scenario |
Dependent Service |
Dependent Policy |
Supported Function |
---|---|---|---|
Managing datasets and labels |
OBS |
obs:bucket:GetBucketLocation obs:bucket:PutBucketAcl obs:object:PutObjectAcl obs:object:GetObjectVersion obs:object:GetObject obs:object:GetObjectVersionAcl obs:object:DeleteObject obs:object:ListMultipartUploadParts obs:bucket:HeadBucket obs:object:AbortMultipartUpload obs:object:DeleteObjectVersion obs:object:GetObjectAcl obs:bucket:ListAllMyBuckets obs:bucket:ListBucket obs:object:PutObject |
Manage datasets in OBS. Label OBS data. Create a data management job. |
Managing table datasets |
DLI |
dli:database:displayAllDatabases dli:database:displayAllTables dli:table:describeTable |
Manage DLI data in a dataset. |
Managing table datasets |
GaussDB(DWS) |
dws:openAPICluster:list dws:openAPICluster:getDetail dws:cluster:list |
Manage DWS data in a dataset. |
Managing table datasets |
MRS |
mrs:job:submit mrs:job:list mrs:cluster:list mrs:cluster:get |
Manage MRS data in a dataset. |
Auto labeling |
ModelArts |
modelarts:service:list modelarts:model:list modelarts:model:get modelarts:model:create modelarts:trainJobInnerModel:list modelarts:workspace:get modelarts:workspace:list |
Enable auto labeling. |
Team labeling |
IAM |
iam:projects:listProjects (Obtaining tenant projects) iam:users:listUsers (Obtaining users) iam:agencies:createAgency (Creating an agency) iam:quotas:listQuotasForProject (Obtaining the quotas of a project) |
Manage labeling teams. |
Application Scenario |
Dependent Service |
Dependent Policy |
Supported Function |
---|---|---|---|
Managing resource pools |
BSS |
bss:coupon:view bss:order:view bss:balance:view bss:discount:view bss:renewal:view bss:bill:view bss:contract:update bss:order:pay bss:unsubscribe:update bss:renewal:update bss:order:update |
Create, renew, and unsubscribe from a resource pool. |
CCE |
cce:cluster:list cce:cluster:get |
Obtain the CCE cluster list, cluster details, and cluster certificates. |
|
KMS |
kms:cmk:list kms:cmk:getMaterial |
Obtain the key pairs created by the user. |
|
AOM |
aom:metric:get |
Obtain the monitoring data of a resource pool. |
|
OBS |
obs:bucket:ListAllMybuckets obs:bucket:HeadBucket obs:bucket:ListBucket obs:bucket:GetBucketLocation obs:object:GetObject obs:object:PutObject obs:object:DeleteObject obs:object:DeleteObjectVersion |
Obtain AI diagnostic logs. |
|
ECS |
ecs:availabilityZones:list ecs:cloudServerFlavors:get ecs:cloudServerQuotas:get ecs:quotas:get ecs:serverKeypairs:list |
Obtain the AZs, specifications, and quotas, and configure keys. |
|
EVS |
evs:types:get evs:quotas:get |
Query EVS disk types and quotas. |
|
BMS |
bms:serverFlavors:get |
Query BMS specifications. Dependent permissions must be configured in the IAM project view. |
|
DEW |
kps:domainKeypairs:list |
Configure a key pair. Dependent permissions must be configured in the IAM project view. |
|
Network management |
VPC |
vpc:routes:create vpc:routes:list vpc:routes:get vpc:routes:delete vpc:peerings:create vpc:peerings:accept vpc:peerings:get vpc:peerings:delete vpc:routeTables:update vpc:routeTables:get vpc:routeTables:list vpc:vpcs:create vpc:vpcs:list vpc:vpcs:get vpc:vpcs:delete vpc:subnets:create vpc:subnets:get vpc:subnets:delete vpcep:endpoints:list vpcep:endpoints:create vpcep:endpoints:delete vpcep:endpoints:get vpc:ports:create vpc:ports:get vpc:ports:update vpc:ports:delete vpc:networks:create vpc:networks:get vpc:networks:update vpc:networks:delete vpc:securityGroups:get |
Create and delete ModelArts networks, and interconnect VPCs. |
SFS Turbo |
sfsturbo:shares:addShareNic sfsturbo:shares:deleteShareNic sfsturbo:shares:showShareNic sfsturbo:shares:listShareNics |
Interconnect your network with SFS Turbo. |
|
Edge resource pool |
IEF |
ief:node:list ief:group:get ief:application:list ief:application:get ief:node:listNodeCert ief:node:get ief:IEFInstance:get ief:deployment:list ief:group:listGroupInstanceState ief:IEFInstance:list ief:deployment:get ief:group:list |
Add, delete, modify, and search for edge pools. |
Agency authorization
To simplify operations when you use ModelArts, certain operations are automatically performed on the ModelArts backend, for example, downloading the datasets in an OBS bucket to a workspace before a training job is started and dumping training job logs to the OBS bucket.
ModelArts does not save your token authentication credentials. Before performing operations on your resources (such as OBS buckets) in a backend asynchronous job, you are required to explicitly authorize ModelArts through an IAM agency. ModelArts will use the agency to obtain a temporary authentication credential for performing operations on your resources. For details, see Adding Authorization.
As shown in Figure 1, after authorization is configured on ModelArts, ModelArts uses the temporary credential to access and operate your resources, relieving you from some complex and time-consuming operations. The agency credential will also be synchronized to your jobs (including notebook instances and training jobs). You can use the agency credential to access your resources in the jobs.
You can use either of the following methods to authorize ModelArts using an agency:
One-click authorization
ModelArts provides one-click automatic authorization. You can quickly configure agency authorization on the Permission Management page of ModelArts. Then, ModelArts will automatically create an agency for you and configure it in ModelArts.
In this mode, the authorization scope is specified based on the preset system policies of dependent services to ensure sufficient permissions for using services. The created agency has almost all permissions of dependent services. If you want to precisely control the scope of permissions granted to an agency, use the second method.
Custom authorization
The administrator creates different agency authorization policies for different users in IAM, and configures the created agency for ModelArts users. When creating an agency for an IAM user, the administrator specifies the minimum permissions for the agency based on the user's permissions to control the resources that the user can access when they use ModelArts. For details, see Assigning Basic Permissions for Using ModelArts.
Risks in Unauthorized Operations
The agency authorization of a user is independent. Theoretically, the agency authorization scope of a user can be beyond the authorization scope of the authorization policy configured for the user group. Any improper configuration will result in unauthorized operations.
To prevent unauthorized operations, only a tenant administrator is allowed to configure agencies for users to ensure the security of agency authorization.
Minimal Agency Authorization
When configuring agency authorization, an administrator must strictly control the authorization scope.
ModelArts asynchronously and automatically performs operations such as job preparation and clearing. The required agency authorization is within the basic authorization scope. If you use only some functions of ModelArts, the administrator can filter out the basic permissions that are not used according to the agency authorization configuration. Conversely, if you need to obtain resource permissions beyond the basic authorization scope in a job, the administrator can add new permissions to the agency authorization configuration. In a word, the agency authorization scope must be minimized and customized based on service requirements.
Basic Agency Authorization Scope
To customize the permissions for an agency, select permissions based on your service requirements.
Application Scenario |
Dependent Service |
Agency Authorization |
Description |
---|---|---|---|
Performing operations on OBS data in a notebook instance |
OBS |
obs:object:DeleteObject obs:object:GetObject obs:object:GetObjectVersion obs:bucket:CreateBucket obs:bucket:ListBucket obs:bucket:ListAllMyBuckets obs:object:PutObject obs:bucket:GetBucketAcl obs:bucket:PutBucketAcl obs:bucket:PutBucketCORS |
You can use either of the following methods to perform operations on OBS data in a notebook instance:
|
Reporting notebook instance events |
AOM |
aom:alarm:put |
During the lifecycle of a notebook instance, some events are reported to the AOM account. For details, see Viewing Notebook Events. |
Interconnecting VPC with a notebook instance |
VPC |
vpc:ports:create vpc:ports:get vpc:ports:delete vpc:subnets:get |
Add a NIC in the notebook instance for interconnecting with specified services in the VPC. |
Connecting to a notebook instance through VS Code with one click |
ModelArts |
modelarts:notebook:get |
Manage notebook instance details. Click VS Code to obtain the instance details and easily modify the instance information by writing the SSH configuration to the local VS Code. |
Stopping a notebook instance |
ModelArts |
modelarts:notebook:stop |
Stops a running notebook instance. |
Updating the auto stop time of a notebook instance |
ModelArts |
modelarts:notebook:updateStopPolicy |
Update the auto stop time of a notebook instance. |
MindInsight/TensorBoard used in OBS parallel file systems |
ModelArts |
modelarts:notebook:umountStorage modelarts:notebook:getMountedStorage modelarts:notebook:listMountedStorages modelarts:notebook:mountStorage |
If MindInsight or TensorBoard is enabled in a notebook instance, and you need to access the OBS parallel file system, configure the permissions on the left. |
Application Scenario |
Dependent Service |
Agency Authorization |
Description |
---|---|---|---|
Accessing OBS files for training jobs |
OBS |
obs:bucket:HeadBucket obs:bucket:GetBucketLocation obs:bucket:ListBucket obs:bucket:ListAllMyBuckets obs:object:GetObject obs:object:GetObjectVersion obs:object:GetObjectAcl obs:object:GetObjectVersionAcl |
You need to obtain OBS operation permissions when configuring a training job, including the code directory, input, output, and the OBS bucket path for storing logs. |
Starting a training job using a custom container image. |
SWR |
SWR Admin |
When a training job is started using a custom container image, you need to obtain a temporary login command of the SWR container image to download the container image. SWR shared edition does not support fine-grained permissions. Therefore, the administrator permission is required. |
Notification of training job status changes |
SMN |
smn:template:list smn:template:create smn:topic:list smn:topic:publish |
To configure training job status change notifications, you must have the SMN operation permissions to send template-based notifications. |
Mounting SFS Turbo to a training job |
SFS Turbo |
SFS Turbo ReadOnlyAccess |
To mount SFS Turbo to a training job, you must have the SFS Turbo read permission to obtain its details by ID. |
Reporting audit logs |
CTS |
CTS Administrator |
Configure the CTS permission to report events. CTS does not support fine-grained permissions for event reporting. Therefore, you need to configure the administrator permission. |
Application Scenario |
Dependent Service |
Agency Authorization |
Description |
---|---|---|---|
Real-time services |
LTS |
lts:groups:create lts:groups:list lts:topics:create lts:topics:delete lts:topics:list |
Configure LTS for reporting logs of real-time services. |
Batch services |
OBS |
obs:bucket:ListBucket obs:object:GetObject obs:object:PutObject |
This parameter is mandatory when a batch service is used. |
Edge services |
IEF |
ief:deployment:list ief:deployment:create ief:deployment:update ief:deployment:delete ief:node:createNodeCert ief:iefInstance:list ief:node:list |
This parameter is mandatory when an edge service is used. The edge service is deployed through IEF. |
Importing a model from OBS |
OBS |
obs:object:DeleteObject obs:object:GetObject obs:bucket:CreateBucket obs:bucket:ListBucket obs:object:PutObject obs:bucket:GetBucketAcl obs:bucket:PutBucketAcl obs:bucket:PutBucketCORS |
(Mandatory) If a parallel file system is used, you need to configure obs:bucket:HeadBucket. |
Importing a model from the container image |
SWR |
SWR Admin |
(Mandatory) SWR shared edition does not support fine-grained permissions. Therefore, the administrator permission is required. |
Using ModelArts Edge |
IEF |
ief:deployment:list ief:deployment:create ief:deployment:update ief:deployment:delete ief:node:createNodeCert ief:iefInstance:list ief:node:list |
(Optional) This function must be enabled if ModelArts Edge is used. |
AOM metric alarm events |
AOM |
aom:log:get aom:alarm:get aom:metric:put aom:alarm:put aom:event:put aom:event:list aom:event:get |
Enable this function to view alarms and events on AOM. |
Reporting monitoring metrics to CES |
CES |
ces:metricMeta:create |
Enable this function to report monitoring metrics to CES. |
Message subscription and push |
SMN |
smn:topic:list smn:topic:publish smn:application:publish |
(Optional) Enable this function for message subscription and push. |
Application Scenario |
Dependent Service |
Agency Authorization |
Description |
---|---|---|---|
Data labeling and processing |
ModelArts |
modelarts:trainJob:create modelarts:trainJob:update modelarts:trainJob:delete modelarts:trainJob:get modelarts:trainJob:list modelarts:trainJob:logExport modelarts:aiAlgorithm:get modelarts:model:get modelarts:service:list modelarts:model:create modelarts:workspace:list modelarts:workspace:get modelarts:trainJobInnerModel:list |
(Mandatory) Create and query training jobs, as well as querying algorithms. |
Accessing OBS data |
OBS |
obs:bucket:GetBucketLocation obs:bucket:PutBucketAcl obs:object:PutObjectAcl obs:object:GetObjectVersion obs:object:GetObject obs:object:GetObjectVersionAcl obs:object:DeleteObject obs:object:ListMultipartUploadParts obs:bucket:HeadBucket obs:object:AbortMultipartUpload obs:object:DeleteObjectVersion obs:object:GetObjectAcl obs:bucket:ListAllMyBuckets obs:bucket:ListBucket obs:object:PutObject |
(Mandatory) Store, query, and delete data in OBS. |
Accessing DLI data |
DLI |
dli:queue:createQueue dli:queue:dropQueue dli:queue:scaleQueue dli:queue:submitJob dli:database:displayDatabase dli:database:displayAllTables dli:table:describeTable dli:table:showPrivileges dli:table:dropTable |
(Optional) Enable this function if you need to view the DLI data. |
Accessing MRS data |
MRS |
mrs:job:submit mrs:job:list mrs:cluster:list mrs:file:list |
(Optional) Enable this function if you need to view the MRS data. |
Accessing GaussDB(DWS) data |
GaussDB(DWS) |
dws:openAPICluster:list dws:openAPICluster:getDetail dws:cluster:list |
(Optional) Enable this function if you need to view the GaussDB(DWS) data. |
Application Scenario |
Dependent Service |
Agency Authorization |
Description |
---|---|---|---|
Interconnecting a dedicated resource pool with SFS Turbo resources |
SFS Turbo |
sfsturbo:shares:showShareNic sfsturbo:shares:listShareNics sfsturbo:shares:addShareNic sfsturbo:shares:deleteShareNic |
Enable this function as needed. |
Interconnecting ModelArts network with VPC and adding related routes |
VPC |
vpc:vpcs:get vpc:subnets:get vpc:peerings:accept vpc:routes:create vpc:routes:delete vpc:routes:get vpc:routeTables:update vpc:routeTables:get vpc:routeTables:list vpc:routes:list |
Enable this function as needed. |
Using ModelArts Lite Cluster resource pools |
CCE APM |
cce:cluster:get cce:node:get cce:node:list cce:job:get cce:node:create cce:node:delete cce:node:remove cce:addonInstance:get cce:addonInstance:list cce:addonInstance:create cce:addonInstance:update cce:addonInstance:delete apm:icmgr:create |
This function must be enabled if ModelArts Lite Cluster resource pools are used. ModelArts uses an agency to manage CCE clusters, synchronize cluster information, and manage nodes. |
ECS BMS EVS DEW |
ecs:cloudServers:create ecs:cloudServers:delete ecs:cloudServers:get ecs:cloudServers:start ecs:cloudServers:stop ecs:cloudServers:reboot ecs:cloudServers:redeploy ecs:cloudServers:listServerInterfaces ecs:cloudServers:changeVpc ecs:cloudServerFlavors:get ecs:quotas:get ecs:cloudServers:batchSetServerTags ecs:cloudServers:list bms:servers:create bms:serverFlavors:get evs:types:get evs:volumes:list evs:quotas:get evs:volumes:get kps:domainKeypairs:get |
This function must be enabled if ModelArts Lite Cluster resource pools are used. ModelArts uses an agency to manage the lifecycle of BMSs and ECSs. |
|
IMS |
ims:images:get ims:images:share |
This function must be enabled if ModelArts Lite Cluster resource pools are used. Share the node system image with your account before creating a ModelArts Lite Cluster dedicated resource pool node. |
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot