文档首页/ 魔坊（ModelArts）模型训推平台/ API参考/ 权限策略和授权项/ 开发环境权限
更新时间：2026-07-03 GMT+08:00
查看PDF
分享

开发环境权限

场景级授权示例

  • IAM新版控制台：提供基于IAM5.0版本的系统身份策略。用户可以直接在IAM服务新版控制台进行场景级授权配置。
    表1 IAM新版控制台授权管理操作场景的授权

    策略名称

    描述

    类型

    还需配置的IAM3.0的策略

    ModelArtsNotebookAllPolicy

    ModelArts服务"模型开发-Notebook"的所有策略(读写)

    系统身份策略

    -

    ModelArtsNotebookReadOnlyPolicy

    ModelArts服务"模型开发-Notebook"的只读策略

    系统身份策略

    -
  • IAM旧版控制台：需要用户在IAM服务旧版控制台自定义身份策略来进行场景级授权配置，将创建的自定义策略授权给用户所在的用户组。详情参考下表进行配置。
    表2 基于要执行操作场景的授权

    操作场景

    示例

    读写（IAM3.0）

    		 
    {
  "Version": "1.1",
  "Statement": [
    {
      "Action": [
        "modelarts:authorization:list",
        "modelarts:image:create",
        "modelarts:image:delete",
        "modelarts:image:get",
        "modelarts:image:list",
        "modelarts:image:listGroup",
        "modelarts:image:register",
        "modelarts:network:get",
        "modelarts:network:list",
        "modelarts:notebook:create",
        "modelarts:notebook:delete",
        "modelarts:notebook:get",
        "modelarts:notebook:getMountedStorage",
        "modelarts:notebook:list",
        "modelarts:notebook:listAllNotebooks",
        "modelarts:notebook:listMountedStorages",
        "modelarts:notebook:mountStorage",
        "modelarts:notebook:start",
        "modelarts:notebook:stop",
        "modelarts:notebook:umountStorage",
        "modelarts:notebook:update",
        "modelarts:notebook:updateStopPolicy",
        "modelarts:pool:get",
        "modelarts:pool:list",
        "modelarts:tag:list",
        "modelarts:trainJob:create",
        "modelarts:trainJob:get",
        "modelarts:trainJob:list",
        "modelarts:trainJob:logExport",
        "modelarts:trainJob:update",
        "modelarts:trainJobVersion:delete",
        "modelarts:workspace:getQuotas",
        "modelarts:workspace:get",
        "aom:alarm:list",
        "aom:metric:get",
        "aom:metric:list",
        "csms:secret:create",
        "csms:secret:list",
        "csms:secret:get",
        "csms:secret:getVersion",
        "iam:projects:listProjects",
        "iam:users:listUsers",
        "kms:cmk:list",
        "kms:dek:decrypt",
        "kps:domainKeypairs:get",
        "kps:domainKeypairs:list",
        "kps:SSHKeyPair:get",
        "obs:bucket:getBucketAcl",
        "obs:bucket:getBucketLocation",
        "obs:bucket:getBucketPolicy",
        "obs:bucket:headBucket",
        "obs:bucket:listAllMyBuckets",
        "obs:bucket:listBucket",
        "obs:bucket:putBucketAcl",
        "obs:object:abortMultipartUpload",
        "obs:object:deleteObject",
        "obs:object:deleteObjectVersion",
        "obs:object:getObject",
        "obs:object:getObjectAcl",
        "obs:object:getObjectVersion",
        "obs:object:getObjectVersionAcl",
        "obs:object:listMultipartUploadParts",
        "obs:object:modifyObjectMetadata",
        "obs:object:putObject",
        "obs:object:putObjectAcl",
        "sfsturbo:shares:getShare",
        "sfsturbo:shares:showFsDir",
        "swr:instance:createTempCredential",
        "swr:repo:download",
        "swr:repo:upload",
        "swr:repository:uploadArtifact",
        "swr:repository:downloadArtifact",
        "swr:instance:get",
        "swr:namespace:getNamespace",
        "swr:repo:getRepo",
        "swr:repo:getRepoDomain",
        "swr:repo:listRepoTags",
        "swr:repository:deleteTag",
        "swr:repository:getTag",
        "swr:repository:listNamespaces",
        "swr:namespace:listNamespaces",
        "swr:instance:list",
        "swr:instance:listDomainNames",
        "tms:predefineTags:list",
        "vpc:quotas:list",
        "vpc:securityGroups:get",
        "vpc:subnets:get",
        "vpc:vpcs:get",
        "vpc:vpcs:list"
      ],
      "Effect": "Allow"
    }
  ]
}

    只读（IAM3.0）

    		 
    {
  "Version": "1.1",
  "Statement": [
    {
      "Action": [
        "modelarts:tag:list",
        "modelarts:notebook:listMountedStorages",
        "modelarts:notebook:listAllNotebooks",
        "modelarts:notebook:list",
        "modelarts:notebook:getMountedStorage",
        "modelarts:notebook:get"
      ],
      "Effect": "Allow"
    }
  ]
}

接口级授权说明

如果您需要使用ModelArts管理控制台开发环境的相关功能并进行权限管理，可参照如下表格进行操作。

表3 开发环境细化权限说明

权限

对应API接口

授权项

依赖的授权项

IAM项目

企业项目

创建Notebook实例

POST

/v1/{project_id}/notebooks

modelarts:notebook:create

swr:repo:listRepoTags

swr:repo:getRepo

swr:namespace:getNamespace

swr:repo:getRepoDomain

swr:repository:getTag

swr:instance:get

swr:instance:createTempCredential

kps:SSHKeyPair:get

vpc:vpcs:list

vpc:subnets:get

vpc:securityGroups:get

vpc:quotas:list

vpc:subnets:get

csms:secret:get

csms:secret:getVersion

sfsturbo:shares:getShare

sfsturbo:shares:showFsDir

obs:object:GetObject

obs:bucket:HeadBucket

obs:bucket:GetBucketPolicy

obs:bucket:GetBucketAcl

obs:bucket:PutBucketAcl

kms:dek:decrypt

√

√

查询Notebook实例列表

GET /v1/{project_id}/notebooks

modelarts:notebook:list

-

√

√

查询所有Notebook实例列表

GET /v1/{project_id}/notebooks/all

modelarts:notebook:listAllNotebooks

-

√

×

查询Notebook实例详情

GET

/v1/{project_id}/notebooks/{id}

modelarts:notebook:get

-

√

√

更新Notebook实例

PUT /v1/{project_id}/notebooks/{id}

modelarts:notebook:update

csms:secret:get

csms:secret:getVersion

kps:SSHKeyPair:get

√

√

删除Notebook实例

DELETE /v1/{project_id}/notebooks/{id}

modelarts:notebook:delete

-

√

√

通过运行的实例保存成容器镜像

POST /v1/{project_id}/notebooks/{id}/create-image

modelarts:image:create

swr:namespace:getNamespace

swr:repo:listRepoTags

swr:repository:listNamespaces

swr:repository:getTag

√

√

查询Notebook支持的有效规格列表

GET /v1/{project_id}/notebooks/flavors

-

-

√

√

查询Notebook支持的可切换规格列表

GET /v1/{project_id}/notebooks/{id}/flavors

-

-

√

√

查询运行中的Notebook可用时长

GET /v1/{project_id}/notebooks/{id}/lease

-

-

√

√

Notebook时长续约

PATCH /v1/{project_id}/notebooks/{id}/lease

modelarts:notebook:updateStopPolicy

-

√

√

启动Notebook实例

POST /v1/{project_id}/notebooks/{id}/start

modelarts:notebook:start

swr:repo:listRepoTags

swr:repo:getRepo

swr:namespace:getNamespace

swr:repo:getRepoDomain

swr:repository:getTag

swr:instance:get

swr:instance:createTempCredential

kps:SSHKeyPair:get

csms:secret:get

csms:secret:getVersion

sfsturbo:shares:getShare

obs:object:GetObject

obs:bucket:HeadBucket

obs:bucket:GetBucketPolicy

obs:bucket:GetBucketAcl

obs:bucket:PutBucketAcl

√

√

停止Notebook实例

POST /v1/{project_id}/notebooks/{id}/stop

modelarts:notebook:stop

-

√

√

获取动态挂载OBS实例信息列表

GET /v1/{project_id}/notebooks/{id}/storage

modelarts:notebook:listMountedStorages

-

√

√

动态挂载OBS

POST /v1/{project_id}/notebooks/{instance_id}/storage

modelarts:notebook:mountStorage

-

√

√

获取动态挂载OBS实例详情

GET /v1/{project_id}/notebooks/{instance_id}/storage/{storage_id}

modelarts:notebook:getMountedStorage

-

√

√

动态卸载OBS

DELETE /v1/{project_id}/notebooks/{instance_id}/storage/{storage_id}

modelarts:notebook:umountStorage

-

√

√

添加资源标签

POST /v1/{project_id}/notebooks/{resource_id}/tags/create

modelarts:notebook:update

-

√

√

删除资源标签

DELETE /v1/{project_id}/notebooks/{resource_id}/tags/delete

modelarts:notebook:update

-

√

√

查询Notebook资源类型下的标签

GET /v1/{project_id}/notebooks/tags

modelarts:tag:list

-

√

√

打开serverless开发环境实例（codelab）

POST

/v1/{project_id}/notebooks/open

modelarts:notebook:open

swr:repo:listRepoTags

swr:repo:getRepo

swr:namespace:getNamespace

swr:repo:getRepoDomain

swr:repository:getTag

swr:instance:get

swr:instance:createTempCredential

√

√

开发环境对接TMS批量删除资源标签

DELETE

/v1/{project_id}/modelarts-notebook/{resource_id}/tags/delete

modelarts:notebook:update

-

√

√

开发环境对接TMS查询项目下的标签信息

GET

/v1/{project_id}/modelarts-notebook/tags

modelarts:tag:list

-

√

√

开发环境对接TMS查询资源下的标签信息

GET

/v1/{project_id}/modelarts-notebook/{resource_id}/tags

modelarts:tag:list

-

√

√

开发环境对接TMS查询资源实例数量

POST

/v1/{project_id}/modelarts-notebook/resource-instances/count

modelarts:notebook:list

-

√

√

开发环境对接TMS查询资源实例列表

POST

/v1/{project_id}/modelarts-notebook/resource-instances/filter

modelarts:notebook:list

-

√

√

开发环境对接TMS批量创建资源标签

POST

/v1/{project_id}/modelarts-notebook/{resource_id}/tags/create

modelarts:notebook:update

-

√

√