Platform for AI (PAI) system policy reference
Lists all system policies that PAI supports, with the permissions each policy grants to RAM identities.
What is a system policy
An access policy is a collection of permissions described in a specific syntax. It defines the authorized resources, actions, and conditions. Resource Access Management (RAM) provides two types of access policies:
System policies: Created and maintained by Alibaba Cloud. Use them without modification.
Custom policies: Created, updated, and deleted by you to fit specific requirements.
As PAI evolves, new permissions are added to system policies to support new features. These updates apply automatically to all RAM identities—RAM users, RAM user groups, and RAM roles—that have been granted the policies.
System policies fall into three categories: product system policies, service role policies, and service-linked role policies. Not all categories apply to every product. The available types for PAI are listed in this topic.
For a full overview of RAM access policies, see Overview of access policies.
System policies enable quick start and apply to console access, OpenAPI, and command-line interface (CLI) access. However, for better data security, use custom policies for OpenAPI or CLI access to grant only the specific permissions that each user or application requires.
Policy quick reference
| Policy | Scope | Access level |
|---|---|---|
| AliyunPAIFullAccess | Platform for AI (PAI) | Full management |
| AliyunPAIReadOnlyAccess | Platform for AI (PAI) | Read-only |
| AliyunDatasetAccFullAccess | Dataset Accelerator (PAI-DatasetAcc) | Full management |
| AliyunDatasetAccReadOnlyAccess | Dataset Accelerator (PAI-DatasetAcc) | Read-only |
| AliyunPAIEASFullAccess | Elastic Algorithm Service (PAI-EAS) | Full management |
| AliyunPAIEASReadOnlyAccess | Elastic Algorithm Service (PAI-EAS) | Read-only |
| AliyunServiceRolePolicyForPaiLangStudio | PAI | Service-linked role only |
| AliyunServiceRolePolicyForPAIABTest | PAIABTest | Service-linked role only |
Follow the Principle of Least Privilege (PoLP). Grant only the permissions required for the task.
Product system policies
Product system policies grant access to PAI and its sub-services.
Platform for AI (PAI)
AliyunPAIFullAccess Grants full management permissions for Platform for AI (PAI). View policy details
AliyunPAIReadOnlyAccess Grants read-only permissions for Platform for AI (PAI). View policy details
Dataset Accelerator (PAI-DatasetAcc)
AliyunDatasetAccFullAccess Grants full management permissions for Dataset Accelerator (PAI-DatasetAcc). View policy details
AliyunDatasetAccReadOnlyAccess Grants read-only permissions for Dataset Accelerator (PAI-DatasetAcc). View policy details
Elastic Algorithm Service (PAI-EAS)
AliyunPAIEASFullAccess Grants full management permissions for Elastic Algorithm Service (PAI-EAS). View policy details
AliyunPAIEASReadOnlyAccess Grants read-only permissions for Elastic Algorithm Service (PAI-EAS). View policy details
FeatureStore (PAI-FeatureStore)
AliyunPAIFeatureStoreFullAccess
Grant the AliyunPAIFeatureStoreFullAccess policy to a RAM identity. This policy grants permissions required to manage FeatureStore.
AliyunPAIFeatureStoreReadOnlyAccess
Grant the AliyunPAIFeatureStoreReadOnlyAccess policy to a RAM identity. This policy grants read-only permissions for FeatureStore.
Industry plugin (PAI-Plugin)
AliyunPaiPluginFullAccess
Grant the AliyunPaiPluginFullAccess policy to a RAM identity. This policy grants permissions required to manage Plugin.
AliyunPaiPluginReadOnlyAccess
Grant the AliyunPaiPluginReadOnlyAccess policy to a RAM identity. This policy grants read-only permissions for Plugin.
AutoML (PAI-AutoML)
AliyunPAIAutoMLFullAccess
Grant the AliyunPAIAutoMLFullAccess policy to a RAM identity. This policy grants permissions required to manage AutoML.
AliyunPAIAutoMLReadOnlyAccess
Grant the AliyunPAIAutoMLReadOnlyAccess policy to a RAM identity. This policy grants read-only permissions for AutoML.
Service-linked role policies
Service-linked role policies are attached exclusively to service-linked roles. Do not attach them to RAM users, RAM user groups, or RAM roles.
AliyunServiceRolePolicyForPaiLangStudio
PAI uses the service-linked role AliyunServiceRoleForPaiLangStudio to access resources in other Alibaba Cloud services. AliyunServiceRolePolicyForPaiLangStudio is the authorization policy for that role. This policy is defined and managed by PAI—it cannot be modified or deleted.
AliyunServiceRolePolicyForPAIABTest
PAIABTest uses the service-linked role AliyunServiceRoleForPAIABTest to access resources in other Alibaba Cloud services. AliyunServiceRolePolicyForPAIABTest is the authorization policy for that role. This policy is defined and managed by PAIABTest—it cannot be modified or deleted.
Authorization reference
By default, RAM identities have no permissions. An Alibaba Cloud account administrator must grant permissions before a RAM identity can access account resources.
To grant permissions to a RAM identity, see the relevant guide: