常见场景的委托权限策略

OBS的权限策略

适用场景：在Aura、Ray、Spark和Flink作业场景中，允许AI DataLake读写OBS以存储日志。

• Aura（AuraJobV2）

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "obs:bucket:ListAllMyBuckets",
                  "obs:bucket:ListBucket",
                  "obs:object:GetObjectVersion",
                  "obs:object:DeleteObject",
                  "obs:object:GetObject",
                  "obs:object:PutObject"
              ]
          }
      ]
  }

• Ray

  {
    "Version": "1.1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "obs:bucket:HeadBucket",
          "obs:bucket:ListBucket",
          "obs:bucket:GetBucketLocation",
          "obs:bucket:GetBucketStorage",
          "obs:object:PutObject",
          "obs:object:GetObject",
          "obs:object:DeleteObject"
        ]
      }
    ]
  }

• Spark和Flink
  委托策略中的“Resource”区域，请将bucketName替换为对应桶的名称。

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "obs:bucket:GetBucketPolicy",
                  "obs:bucket:GetLifecycleConfiguration",
                  "obs:bucket:GetBucketLocation",
                  "obs:bucket:ListBucketMultipartUploads",
                  "obs:bucket:GetBucketLogging",
                  "obs:object:GetObjectVersion",
                  "obs:bucket:GetBucketStorage",
                  "obs:bucket:GetBucketVersioning",
                  "obs:object:GetObject",
                  "obs:object:GetObjectVersionAcl",
                  "obs:object:DeleteObject",
                  "obs:object:ListMultipartUploadParts",
                  "obs:bucket:HeadBucket",
                  "obs:bucket:GetBucketAcl",
                  "obs:bucket:GetBucketStoragePolicy",
                  "obs:object:AbortMultipartUpload",
                  "obs:object:DeleteObjectVersion",
                  "obs:object:GetObjectAcl",
                  "obs:bucket:ListBucketVersions",
                  "obs:bucket:ListBucket",
                  "obs:object:PutObject"
              ],
              "Resource": [
                  "OBS:*:*:bucket:bucketName",//请替换bucketName为对应的桶名称
                  "OBS:*:*:object:*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "obs:bucket:ListAllMyBuckets"
              ]
          }
      ]
  }

LakeFormation Catalog元数据的权限策略

适用场景：在Spark和Flink作业场景中，允许AI DataLake访问LakeFormation元数据。

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "lakeformation:table:drop",
                "lakeformation:table:create",
                "lakeformation:database:create",
                "lakeformation:database:drop",
                "lakeformation:database:describe",
                "lakeformation:catalog:alter",
                "lakeformation:table:alter",
                "lakeformation:database:alter",
                "lakeformation:catalog:create",
                "lakeformation:function:describe",
                "lakeformation:catalog:describe",
                "lakeformation:function:create",
                "lakeformation:table:describe",
                "lakeformation:function:drop",               
                "lakeformation:transaction:operate"
            ]
        }
    ]
}

DEW加密功能的权限策略

适用场景：Ray和Flink作业场景使用DEW-CSMS凭证管理能力。

• Ray

  {
    "Version": "1.1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "csms:secret:get",
          "csms:secretVersion:get",
          "kms:dek:crypto",
          "kms:dek:decrypt"
        ]
      }
    ]
  }

• Flink

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "csms:secretVersion:get",
                  "csms:secretVersion:list",
                  "kms:dek:decrypt"
              ]
          }
      ]
  }

DCS Redis的权限策略

适用场景：在Ray作业场景中，允许Ray集群能成功连接DCS Redis。

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dcs:instance:get",
        "dcs:instance:list",
        "dcs:ssl:get",
        "dcs:ssl:modify",
        "dcs:aclaccount:list"
      ]
    }
  ]
}

RayJob权限策略

适用场景：在Ray作业场景中，允许对Ray作业执行创建、查看等相关操作。

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "DataArtsFabric:rayJob:list",
        "DataArtsFabric:rayJob:run",
        "DataArtsFabric:rayJob:show",
        "DataArtsFabric:rayJob:cancel",
        "DataArtsFabric:endpoint:show",
        "DataArtsFabric:endpoint:list",
        "DataArtsFabric:workspace:list",
        "DataArtsFabric:federation:show",
        "DataArtsFabric:federation:list"
      ]
    }
  ]
}

SWR镜像仓库权限策略

适用场景：在Ray作业场景中，允许查看和拉取镜像。

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "swr:repo:listRepoDomains",
        "swr:repo:listRepoTags",
        "swr:repo:getRepo",
        "swr:repo:download",
        "swr:system:createLoginSecret"
      ]
    }
  ]
}

VPCEP终端节点权限策略

适用场景：在RayCluster DCS Redis作业场景中，允许访问和使用VPCEP。

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "vpcep:endpoints:create",
        "vpcep:endpoints:delete",
        "vpcep:endpoints:get",
        "vpcep:endpoints:list",
        "vpcep:epservices:*",
        "vpcep:connections:*",
        "vpcep:permissions:*"
      ]
    }
  ]
}

AOM监控权限策略

适用场景：在Ray作业场景中，允许访问AOM监控指标。

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aom:metric:put",
        "aom:alarm:put"
      ]
    }
  ]
}

LTS日志权限策略

适用场景：在Ray作业场景中，允许访问和使用LTS日志。

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "lts:groups:get",
        "lts:groups:list",
        "lts:groups:create",
        "lts:topics:get",
        "lts:topics:list",
        "lts:topics:create"
      ]
    }
  ]
}