Configure resources in a private network

1.1 Create a bucket

To store objects in OSS, you must first create a bucket.

1. Log on to the OSS console.

2. In the left navigation bar, click Bucket List to go to the Bucket List page.

3. Click Create Bucket. In the Create Bucket panel, configure the following parameters and leave the others at their default values.

   Parameter	Value
   Bucket Name	Enter bailian-safe-workspace-oss-access.
   Region	Select Region-specific and North China 2 (Beijing).

4. Click Complete Creation.

1.2 Grant bucket permissions

For security, Alibaba Cloud Model Studio can access only authorized buckets that have a specific tag. You must add this tag before granting access.

1. On the Bucket List page, click the bailian-safe-workspace-oss-access bucket.

2. In the left-side navigation pane, choose Bucket Configurations > Bucket Tagging.

3. On the Bucket Tagging page, click Create Tag.

4. Click , add a tag, and configure it with the following values:

   • Tag Key: Enter bailian-safe-workspace-oss-access.

   • Tag Value: Enter ReadAndWrite.

5. Click Save.

1.3 Create a CORS rule

Web browsers enforce a security measure known as the same-origin policy, which restricts how a web page can request resources from a different domain, protocol, or port. By default, this policy blocks requests from your browser to services like OSS to prevent malicious script attacks. To securely bypass this restriction, you can create a Cross-Origin Resource Sharing (CORS) rule that explicitly grants access to specified origins.

1. On the Bucket List page, click the bailian-safe-workspace-oss-access bucket.

2. In the left-side navigation pane, choose Data Security > CORS.

3. Click Create Rule and configure the following parameters. Leave the other parameters at their default values.

   Parameter	Value
   Sources	Enter *bailian.console.aliyun.com.
   Allowed Methods	Select GET, POST, PUT, and DELETE.

4. Click OK.

1.4 Configure OSS

1. Go to the Business Space Management page.

2. Find the Alibaba Cloud Model Studio secure storage workspace that you created, and in the Actions column, click Manage Model Studio Secure Storage.

3. Click Next Step until you reach the Resource Configuration page.

4. If you are configuring OSS for the first time, you must authorize Alibaba Cloud Model Studio to access your OSS resources.

   On the Resource Configuration page, in the OSS Configuration section, click Authorize, and then click Confirm Authorize.

5. Select the bucket you created: bailian-safe-workspace-oss-access.

6. Click Save.

   Important

   • If the OSS bucket service is stopped, the Alibaba Cloud Model Studio secure storage workspace and modules such as Knowledge Base, Audit Log, and History will become unavailable. To restore service, you must reactivate the OSS bucket.

   • If the OSS bucket is released, the Alibaba Cloud Model Studio secure storage workspace will become permanently unavailable and cannot be recovered. You will need to create a new secure storage workspace.

2.1 Purchase an AnalyticDB (ADB) instance

1. Log on to the AnalyticDB for PostgreSQL console.

2. In the upper-right corner of the page, click Purchase Instance. Configure the following parameters and leave the others at their default values.

   Parameter	Value
   Product Type	Select the product type that meets your business requirements.
   Region and Zone	Region: Select China (Beijing). Zone: Select Zone G, H, or I.
   Engine Version	Select 6.0 Standard Edition.
   Instance Series	We recommend that you select High-availability Edition.
   Vector Engine Optimization	Select Enable.
   VPC	Select the same VPC and vSwitch specified in Obtain zone IP addresses and vSwitch CIDR blocks.
   vSwitch

3. Click Buy Now > Enable Now to create the AnalyticDB (ADB) instance.

   The creation process may take several minutes. The instance is ready to use when its status changes to Running.

2.2 Configure ADB

1. Go to the Business Space Management page.

2. Find the Alibaba Cloud Model Studio secure storage workspace that you created, and in the Actions column, click Manage Model Studio Secure Storage.

3. Click Next Step until you reach the Resource Configuration page.

4. If you are configuring AnalyticDB (ADB) for the first time, you must authorize Alibaba Cloud Model Studio to access your ADB resources.

   On the Resource Configuration page, in the ADB Configuration section, click Authorize, and then click Confirm Authorize.

   The authorized role is AliyunServiceRoleForSFMAccessADB, and its permission policy is AliyunServiceRolePolicyForSFMAccessADB.

5. Select the ID of the AnalyticDB (ADB) instance you purchased.

6. Click Save.

3.1 Purchase an Elasticsearch instance

1. Log on to the Alibaba Cloud Elasticsearch console.

2. In the left-side navigation pane, click Elasticsearch Instances.

3. Click Create and configure the following parameters. Leave the others at their default values.

   Parameter	Value
   Product Type	Select the product type that meets your business requirements.
   Region and Zone	Region: Select China (Beijing). Zone: Select Beijing Zone H, G, or L.
   Number of Availability Zones	Select Two Zones.
   VPC	Select the same VPC and vSwitch specified in Obtain zone IP addresses and vSwitch CIDR blocks.
   vSwitch
   Instance Type	Select Performance-enhanced Edition.
   Elasticsearch Version	Select 7.10.
   Username	The default value is "elastic".
   Password	Set a custom password. Make sure to save the password in a secure location. You will need it later when you configure Elasticsearch.

4. Click Buy Now > Enable Now to create the Elasticsearch instance.

5. On the Elasticsearch Instances page, you can view the instance you created.

   The instance creation may take a significant amount of time, typically several hours, depending on the cluster specifications and data size. The instance is ready to use when its Status changes to Normal.

3.2 Add vSwitch CIDR block to whitelist

1. On the Elasticsearch Instances page, click the instance name to open its details page.

2. In the left-side navigation pane, click Security. On the page that appears, find VPC Private Network Access Whitelist and click Edit.

3. Click Add IP Address Whitelist Group and add the vSwitch CIDR block that you obtained in Obtain zone IP addresses and vSwitch CIDR blocks to the whitelist group.

   In the dialog box that appears, set the IP Address Whitelist Group Name (for example, mse_switch_iplist) and enter the vSwitch CIDR blocks in the IP Addresses in Whitelist field (for example, 192.168.0.0/24,172.16.1.0/24). Then, click OK.

3.3 Configure Elasticsearch

1. Go to the Business Workspace Management page.

2. Find the Alibaba Cloud Model Studio secure storage workspace that you created, and in the Actions column, click Manage Model Studio Secure Storage.

3. Click Next Step until you reach the Resource Configuration page.

4. In the Elasticsearch section, configure the following parameters.

   Parameter	Value
   Instance ID	Enter the ID of the Elasticsearch instance you created.
   Account	Enter elastic.
   Password	Enter the password you set when you created the Elasticsearch instance.

5. Click Save.

   Important

   • If billing for the Elasticsearch instance is stopped, the Alibaba Cloud Model Studio secure storage workspace and modules such as Knowledge Base, Audit Log, and History will become unavailable. To restore service, you must renew your subscription for the Elasticsearch instance.

   • If the Elasticsearch instance is released, the Alibaba Cloud Model Studio secure storage workspace will become permanently unavailable and cannot be recovered. You will need to create a new secure storage workspace.