常见场景的委托权限策略

访问和使用OBS的权限策略

适用场景：在Ray、Spark作业场景中，允许AI DataLake读写OBS将日志转储。

委托策略中的“Resource”区域，请将bucketName替换为对应桶的名称。

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "obs:bucket:GetBucketPolicy",
                "obs:bucket:GetLifecycleConfiguration",
                "obs:bucket:GetBucketLocation",
                "obs:bucket:ListBucketMultipartUploads",
                "obs:bucket:GetBucketLogging",
                "obs:object:GetObjectVersion",
                "obs:bucket:GetBucketStorage",
                "obs:bucket:GetBucketVersioning",
                "obs:object:GetObject",
                "obs:object:GetObjectVersionAcl",
                "obs:object:DeleteObject",
                "obs:object:ListMultipartUploadParts",
                "obs:bucket:HeadBucket",
                "obs:bucket:GetBucketAcl",
                "obs:bucket:GetBucketStoragePolicy",
                "obs:object:AbortMultipartUpload",
                "obs:object:DeleteObjectVersion",
                "obs:object:GetObjectAcl",
                "obs:bucket:ListBucketVersions",
                "obs:bucket:ListBucket",
                "obs:object:PutObject"
            ],
            "Resource": [
                "OBS:*:*:bucket:bucketName",//请替换bucketName为对应的桶名称
                "OBS:*:*:object:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "obs:bucket:ListAllMyBuckets"
            ]
        }
    ]
}

访问和使用LakeFormation Catalog元数据的权限策略

适用场景：在Spark作业场景中，允许AI DataLake访问LakeFormation元数据，

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "lakeformation:table:drop",
                "lakeformation:table:create",
                "lakeformation:policy:create",
                "lakeformation:database:create",
                "lakeformation:database:drop",
                "lakeformation:database:describe",
                "lakeformation:catalog:alter",
                "lakeformation:table:alter",
                "lakeformation:database:alter",
                "lakeformation:catalog:create",
                "lakeformation:function:describe",
                "lakeformation:catalog:describe",
                "lakeformation:function:create",
                "lakeformation:table:describe",
                "lakeformation:function:drop",               
                "lakeformation:transaction:operate"
            ]
        }
    ]
}