RAM authorization-Platform For AI(PAI)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Platform for AI for RAM permission policies. The RAM code (RamCode) for Platform for AI is pairec , and the supported authorization granularity is OPERATION .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Platform for AI. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
pairec:GetLaboratory	GetLaboratory	get	All Resource ``	None	None
pairec:ListDataDiagnosisJobs	ListDataDiagnosisJobs	get	All Resource ``	None	None
pairec:QueryTrafficControlTaskItemReport	QueryTrafficControlTaskItemReport	none	All Resource ``	None	None
pairec:ListRecallManagementServiceVersions	ListRecallManagementServiceVersions	none	All Resource ``	None	None
pairec:ExportRecallManagementTable	ExportRecallManagementTable	none	All Resource ``	None	None
pairec:GenerateAlgorithmCustomizationScript	GenerateAlgorithmCustomizationScript	none	All Resource ``	None	None
pairec:GetInstanceResource	GetInstanceResource	none	All Resource ``	None	None
pairec:GetEngineConfig	GetEngineConfig	get	All Resource ``	None	None
pairec:DeleteTrafficControlTask	DeleteTrafficControlTask	delete	All Resource ``	None	None
pairec:CloneTrafficControlTask	CloneTrafficControlTask	none	All Resource ``	None	None
pairec:CreateEngineConfig	CreateEngineConfig	create	All Resource ``	None	None
pairec:CreateRecallManagementTable	CreateRecallManagementTable	create	All Resource ``	None	None
pairec:ListInstances	ListInstances	none	All Resource ``	None	None
pairec:CreateRecallManagementServiceVersionConfig	CreateRecallManagementServiceVersionConfig	none	All Resource ``	None	None
pairec:GetScene	GetScene	get	All Resource ``	None	None
pairec:ChangeRecallManagementServiceVersion	ChangeRecallManagementServiceVersion	none	All Resource ``	None	None
pairec:UpdateTrafficControlTarget	UpdateTrafficControlTarget	update	All Resource ``	None	None
pairec:DeleteTrafficControlTarget	DeleteTrafficControlTarget	delete	All Resource ``	None	None
pairec:DeleteRecallManagementService	DeleteRecallManagementService	delete	All Resource ``	None	None
pairec:CreateTrafficControlTask	CreateTrafficControlTask	create	All Resource ``	None	None
pairec:ListCrowds	ListCrowds	list	All Resource ``	None	None
pairec:StartTrafficControlTarget	StartTrafficControlTarget	none	All Resource ``	None	None
pairec:ListABMetrics	ListABMetrics	list	All Resource ``	None	None
pairec:GetService	GetService	get	All Resource ``	None	None
pairec:StopTrafficControlTarget	StopTrafficControlTarget	none	All Resource ``	None	None
pairec:UpdateEngineConfig	UpdateEngineConfig	update	All Resource ``	None	None
pairec:DeleteRecallManagementServiceVersionConfig	DeleteRecallManagementServiceVersionConfig	none	All Resource ``	None	None
pairec:GetSubCrowd	GetSubCrowd	get	All Resource ``	None	None
pairec:UpdateRecallManagementTable	UpdateRecallManagementTable	update	All Resource ``	None	None
pairec:DeployTrafficControlTaskCode	DeployTrafficControlTaskCode	none	All Resource ``	None	None
pairec:CreateLaboratory	CreateLaboratory	create	All Resource ``	None	None
pairec:CloneLaboratory	CloneLaboratory	none	All Resource ``	None	None
pairec:GetTableMeta	GetTableMeta	get	All Resource ``	None	None
pairec:DeleteScene	DeleteScene	delete	All Resource ``	None	None
pairec:QueryRecallManagementTableRecords	QueryRecallManagementTableRecords	none	All Resource ``	None	None
pairec:ChatConversation	ChatConversation	none	All Resource ``	None	None
pairec:UpdateRecallManagementService	UpdateRecallManagementService	update	All Resource ``	None	None
pairec:DeleteLaboratory	DeleteLaboratory	delete	All Resource ``	None	None
pairec:CheckTrafficControlTaskExpression	CheckTrafficControlTaskExpression	none	All Resource ``	None	None
pairec:UpdateDataDiagnosis	UpdateDataDiagnosis	update	All Resource ``	None	None
pairec:GetRecallManagementTable	GetRecallManagementTable	get	All Resource ``	None	None
pairec:ListExperiments	ListExperiments	list	All Resource ``	None	None
pairec:PushAllExperiment	PushAllExperiment	none	All Resource ``	None	None
pairec:UpdateInstanceResource	UpdateInstanceResource	update	All Resource ``	None	None
pairec:CreateExperimentGroup	CreateExperimentGroup	create	All Resource ``	None	None
pairec:CreateScene	CreateScene	create	All Resource ``	None	None
pairec:DeleteLayer	DeleteLayer	delete	All Resource ``	None	None
pairec:UpdateTrafficControlTask	UpdateTrafficControlTask	update	All Resource ``	None	None
pairec:UpdateABMetricGroup	UpdateABMetricGroup	update	All Resource ``	None	None
pairec:OfflineExperimentGroup	OfflineExperimentGroup	none	All Resource ``	None	None
pairec:DeleteExperimentGroup	DeleteExperimentGroup	delete	All Resource ``	None	None
pairec:CheckInstanceResources	CheckInstanceResources	none	All Resource ``	None	None
pairec:DeleteDataDiagnosis	DeleteDataDiagnosis	delete	All Resource ``	None	None
pairec:GetRecallManagementServiceVersionConfig	GetRecallManagementServiceVersionConfig	none	All Resource ``	None	None
pairec:UpdateParam	UpdateParam	update	All Resource ``	None	None
pairec:DeleteEngineConfig	DeleteEngineConfig	none	All Resource ``	None	None
pairec:ListExperimentGroups	ListExperimentGroups	list	All Resource ``	None	None
pairec:DeleteExperiment	DeleteExperiment	delete	All Resource ``	None	None
pairec:CloneFeatureConsistencyCheckJobConfig	CloneFeatureConsistencyCheckJobConfig	none	All Resource ``	None	None
pairec:ListEngineConfigs	ListEngineConfigs	list	All Resource ``	None	None
pairec:CreateDataDiagnosisJobs	CreateDataDiagnosisJobs	create	All Resource ``	None	None
pairec:UpdateTrafficControlTaskTraffic	UpdateTrafficControlTaskTraffic	none	All Resource ``	None	None
pairec:CreateSubCrowd	CreateSubCrowd	create	All Resource ``	None	None
pairec:QueryTrafficControlTargetItemReportDetail	QueryTrafficControlTargetItemReportDetail	none	All Resource ``	None	None
pairec:CreateLayer	CreateLayer	create	All Resource ``	None	None
pairec:ListFeatureConsistencyCheckJobConfigs	ListFeatureConsistencyCheckJobConfigs	list	All Resource ``	None	None
pairec:ListSubCrowds	ListSubCrowds	list	All Resource ``	None	None
pairec:OnlineExperiment	OnlineExperiment	none	All Resource ``	None	None
pairec:ReleaseTrafficControlTask	ReleaseTrafficControlTask	none	All Resource ``	None	None
pairec:StartTrafficControlTask	StartTrafficControlTask	none	All Resource ``	None	None
pairec:CreateFeatureConsistencyCheckJobConfig	CreateFeatureConsistencyCheckJobConfig	create	All Resource ``	None	None
pairec:GenerateTrafficControlTaskCode	GenerateTrafficControlTaskCode	none	All Resource ``	None	None
pairec:SplitTrafficControlTarget	SplitTrafficControlTarget	none	All Resource ``	None	None
pairec:OfflineRecallManagementService	OfflineRecallManagementService	none	All Resource ``	None	None
pairec:DeleteInstanceResource	DeleteInstanceResource	delete	All Resource ``	None	None
pairec:UpdateABMetric	UpdateABMetric	update	All Resource ``	None	None
pairec:ListDataDiagnoses	ListDataDiagnoses	get	All Resource ``	None	None
pairec:GetRecallManagementJob	GetRecallManagementJob	get	All Resource ``	None	None
pairec:GetTrafficControlTarget	GetTrafficControlTarget	get	All Resource ``	None	None
pairec:DeleteParam	DeleteParam	delete	All Resource ``	None	None
pairec:GetTrafficControlTask	GetTrafficControlTask	get	All Resource ``	None	None
pairec:ListRecallManagementJobs	ListRecallManagementJobs	list	All Resource ``	None	None
pairec:CreateFeatureConsistencyCheckJob	CreateFeatureConsistencyCheckJob	create	All Resource ``	None	None
pairec:ListRecallManagementTables	ListRecallManagementTables	list	All Resource ``	None	None
pairec:GetTrafficControlTaskTraffic	GetTrafficControlTaskTraffic	none	All Resource ``	None	None
pairec:StopTrafficControlTask	StopTrafficControlTask	none	All Resource ``	None	None
pairec:UpdateLayer	UpdateLayer	update	All Resource ``	None	None
pairec:ApplyEngineConfig	ApplyEngineConfig	none	All Resource ``	None	None
pairec:ReportABMetricGroup	ReportABMetricGroup	none	All Resource ``	None	None
pairec:GetRecallManagementServiceVersion	GetRecallManagementServiceVersion	none	All Resource ``	None	None
pairec:OnlineLaboratory	OnlineLaboratory	none	All Resource ``	None	None
pairec:CreateRecallManagementService	CreateRecallManagementService	create	All Resource ``	None	None
pairec:CreateTrafficControlTarget	CreateTrafficControlTarget	create	All Resource ``	None	None
pairec:CloneExperimentGroup	CloneExperimentGroup	none	All Resource ``	None	None
pairec:UpdateLaboratory	UpdateLaboratory	update	All Resource ``	None	None
pairec:ListInstanceResourceTables	ListInstanceResourceTables	list	All Resource ``	None	None
pairec:QueryDataDiagnosisStatistics	QueryDataDiagnosisStatistics	get	All Resource ``	None	None
pairec:GetCalculationJob	GetCalculationJob	get	All Resource ``	None	None
pairec:CreateABMetric	CreateABMetric	create	All Resource ``	None	None
pairec:GetInstanceResourceTable	GetInstanceResourceTable	none	All Resource ``	None	None
pairec:CreateInstanceResource	CreateInstanceResource	create	All Resource ``	None	None
pairec:ListLaboratories	ListLaboratories	list	All Resource ``	None	None
pairec:GetExperiment	GetExperiment	get	All Resource ``	None	None
pairec:ListFeatureConsistencyCheckJobs	ListFeatureConsistencyCheckJobs	get	All Resource ``	None	None
pairec:ListInstanceResources	ListInstanceResources	list	All Resource ``	None	None
pairec:GetABMetric	GetABMetric	get	All Resource ``	None	None
pairec:BackflowFeatureConsistencyCheckJobData	BackflowFeatureConsistencyCheckJobData	none	All Resource ``	None	None
pairec:CloneExperiment	CloneExperiment	none	All Resource ``	None	None
pairec:GetDataDiagnosis	GetDataDiagnosis	get	All Resource ``	None	None
pairec:SyncFeatureConsistencyCheckJobReplayLog	SyncFeatureConsistencyCheckJobReplayLog	none	All Resource ``	None	None
pairec:UpdateExperimentGroup	UpdateExperimentGroup	get	All Resource ``	None	None
pairec:CreateCalculationJobs	CreateCalculationJobs	create	All Resource ``	None	None
pairec:ListTrafficControlTargetTrafficHistory	ListTrafficControlTargetTrafficHistory	none	All Resource ``	None	None
pairec:ListTableMetas	ListTableMetas	list	All Resource ``	None	None
pairec:GetRecallManagementService	GetRecallManagementService	get	All Resource ``	None	None
pairec:CloneEngineConfig	CloneEngineConfig	none	All Resource ``	None	None
pairec:UpdateTableMeta	UpdateTableMeta	update	All Resource ``	None	None
pairec:OfflineExperiment	OfflineExperiment	none	All Resource ``	None	None
pairec:GetInstance	GetInstance	get	All Resource ``	None	None
pairec:DeleteABMetricGroup	DeleteABMetricGroup	delete	All Resource ``	None	None
pairec:CreateRecallManagementServiceVersion	CreateRecallManagementServiceVersion	none	All Resource ``	None	None
pairec:ListScenes	ListScenes	list	All Resource ``	None	None
pairec:ListParams	ListParams	list	All Resource ``	None	None
pairec:ListDataDiagnosisReports	ListDataDiagnosisReports	get	All Resource ``	None	None
pairec:CreateABMetricGroup	CreateABMetricGroup	create	All Resource ``	None	None
pairec:OfflineLaboratory	OfflineLaboratory	none	All Resource ``	None	None
pairec:GetLayer	GetLayer	get	All Resource ``	None	None
pairec:UpdateScene	UpdateScene	update	All Resource ``	None	None
pairec:ListABMetricGroups	ListABMetricGroups	list	All Resource ``	None	None
pairec:CreateDataDiagnosis	CreateDataDiagnosis	create	All Resource ``	None	None
pairec:TerminateFeatureConsistencyCheckJob	TerminateFeatureConsistencyCheckJob	none	All Resource ``	None	None
pairec:ListRecallManagementTableVersions	ListRecallManagementTableVersions	none	All Resource ``	None	None
pairec:GetABMetricGroup	GetABMetricGroup	get	All Resource ``	None	None
pairec:ListLayers	ListLayers	list	All Resource ``	None	None
pairec:DeleteRecallManagementTable	DeleteRecallManagementTable	delete	All Resource ``	None	None
pairec:QueryTrafficControlTaskDeployResult	QueryTrafficControlTaskDeployResult	none	All Resource ``	None	None
pairec:UpdateCrowd	UpdateCrowd	update	All Resource ``	None	None
pairec:UpdateRecallManagementConfig	UpdateRecallManagementConfig	none	All Resource ``	None	None
pairec:DeleteCrowd	DeleteCrowd	delete	All Resource ``	None	None
pairec:ListInstanceResourceSchemas	ListInstanceResourceSchemas	none	All Resource ``	None	None
pairec:DeleteRecallManagementServiceVersion	DeleteRecallManagementServiceVersion	none	All Resource ``	None	None
pairec:OnlineRecallManagementService	OnlineRecallManagementService	none	All Resource ``	None	None
pairec:ListRecallManagementServices	ListRecallManagementServices	list	All Resource ``	None	None
pairec:ListTrafficControlTasks	ListTrafficControlTasks	list	All Resource ``	None	None
pairec:DeleteTableMeta	DeleteTableMeta	delete	All Resource ``	None	None
pairec:OnlineExperimentGroup	OnlineExperimentGroup	none	All Resource ``	None	None
pairec:ListCalculationJobs	ListCalculationJobs	list	All Resource ``	None	None
pairec:CreateTableMeta	CreateTableMeta	create	All Resource ``	None	None
pairec:ListCrowdUsers	ListCrowdUsers	list	All Resource ``	None	None
pairec:CreateRecallManagementConfig	CreateRecallManagementConfig	create	All Resource ``	None	None
pairec:CreateParam	CreateParam	create	All Resource ``	None	None
pairec:ListFeatureConsistencyCheckJobFeatureReports	ListFeatureConsistencyCheckJobFeatureReports	list	All Resource ``	None	None
pairec:PublishRecallManagementTable	PublishRecallManagementTable	none	All Resource ``	None	None
pairec:DeleteSubCrowd	DeleteSubCrowd	delete	All Resource ``	None	None
pairec:DeleteABMetric	DeleteABMetric	delete	All Resource ``	None	None
pairec:GetFeatureConsistencyCheckJobConfig	GetFeatureConsistencyCheckJobConfig	get	All Resource ``	None	None
pairec:CreateExperiment	CreateExperiment	create	All Resource ``	None	None
pairec:GetFeatureConsistencyCheckJob	GetFeatureConsistencyCheckJob	get	All Resource ``	None	None
pairec:ListFeatureConsistencyCheckJobScoreReports	ListFeatureConsistencyCheckJobScoreReports	list	All Resource ``	None	None
pairec:GetRecallManagementConfig	GetRecallManagementConfig	get	All Resource ``	None	None
pairec:UpdateFeatureConsistencyCheckJobConfig	UpdateFeatureConsistencyCheckJobConfig	update	All Resource ``	None	None
pairec:UpdateRecallManagementServiceVersionConfig	UpdateRecallManagementServiceVersionConfig	none	All Resource ``	None	None
pairec:CreateCrowd	CreateCrowd	create	All Resource ``	None	None
pairec:UpdateExperiment	UpdateExperiment	update	All Resource ``	None	None
pairec:GetExperimentGroup	GetExperimentGroup	get	All Resource ``	None	None

Resource

The following table lists the resources defined by Platform for AI. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type

ARN

Condition

Platform for AI does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: