Creating a Custom Policy

Precautions

• The permissions to use ModelArts depend on OBS authorization. Therefore, you need to grant OBS system permissions to users.
• A custom policy can contain actions of multiple services that are globally accessible or accessible through region-specific projects.
• To define permissions required to access both global and project-level services, create two custom policies and specify the scope as Global services and Project-level services. Then grant the two policies to the users.
• By default, an IAM user created under the current account has all the operation permissions for ModelArts. To control the permissions of an IAM user, for example, to deny a user the permission to use a function, create a custom policy of ModelArts.

Example Custom Policies of OBS

ModelArts is a project-level service, and OBS is a global service. Therefore, you need to create custom policies for the two services respectively and grant them to users. The permissions to use ModelArts depend on OBS authorization. The following example shows the minimum permissions for OBS, including the permissions for OBS buckets and objects. After being granted the minimum permissions for OBS, users can access OBS from ModelArts without restrictions.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "obs:object:PutObjectAcl",
                "obs:bucket:PutBucketAcl",
                "obs:bucket:PutBucketPolicy",
                "obs:bucket:HeadBucket",
                "obs:bucket:ListAllMyBuckets",
                "obs:bucket:ListBucket",
                "obs:object:DeleteObjectVersion",
                "obs:object:AbortMultipartUpload",
                "obs:object:DeleteObject",
                "obs:object:PutObject",
                "obs:bucket:CreateBucket",
                "obs:object:GetObject",
                "obs:bucket:GetBucketLocation",
                "obs:object:GetObjectVersionAcl",
                "obs:bucket:GetBucketAcl",
                "obs:object:ListMultipartUploadParts",
                "obs:bucket:ListBucketVersions",
                "obs:object:GetObjectVersion",
                "obs:object:GetObjectAcl",
                "obs:bucket:GetBucketPolicy"
            ]
        }
    ]
}

Example Custom Policies of ModelArts

By default, an IAM user created under the current account has all the operation permissions for ModelArts. To control the permissions of an IAM user, for example, to deny a user the permission to use a function, set the parameters as follows:

• Example: Denying ExeML project deletion

  A deny policy must be used in conjunction with other policies to take effect. If the permissions assigned to a user contain both Allow and Deny actions, the Deny actions take precedence over the Allow actions.

  The following method can be used if you need to assign permissions of the ModelArts FullAccess policy to a user but also forbid the user from deleting ExeML projects. Create a custom policy for denying ExeML project deletion, and assign both policies to the group the user belongs to. Then the user can perform all operations on ModelArts except deleting ExeML projects. The following is an example deny policy:

  { 
        "Version": "1.1", 
        "Statement": [ 
              { 
  		  "Effect": "Deny", 
                    "Action": [ 
                          "modelarts:exemlProject:delete" 
                    ] 
              } 
        ] 
  }

• Example: Denying use of development environment functions

  The following is a policy configuration example for this user:

  { 
      "Version": "1.1", 
      "Statement": [ 
  
          { 
              "Effect": "Deny", 
              "Action": [ 
                  "modelarts:notebook:list", 
                  "modelarts:notebook:create" ,
                  "modelarts:notebook:get" ,
                  "modelarts:notebook:update" ,
                  "modelarts:notebook:delete" ,
                  "modelarts:notebook:action" ,
                  "modelarts:notebook:access" 
              ] 
          } 
      ] 
  }