Initializing PAI platform permissions

Overview

This document describes a best practice for configuring user permissions for the PAI platform. It involves the following cloud products: VPC, VSW, OSS, NAS, and ACR. It covers the following roles: cloud account administrator, PAI workspace administrator, and PAI workspace user.

Common user roles and operations

Cloud account administrator

This role focuses on configuring permissions, resources, and basic network settings, including the following tasks:

1. Activate the PAI service.

2. Provision network resources required by PAI: VPCs and VSWs.

3. Create PAI resource groups and resource quotas.

4. Create OSS buckets.

5. Create NAS instances and mount targets, including all editions of NAS and CPFS.

6. Create a PAI workspace and assign a PAI workspace administrator.

7. Create an ACR instance and configure VPC access.

PAI workspace administrator

This role focuses on managing users and permissions within a PAI workspace. This administrator also manages PAI-dependent resources, such as specific ACR instances, OSS buckets, and NAS instances. Tasks include:

1. Create PAI datasets.

2. Add users and configure their permissions.

3. Manage workspace configurations.

4. Manage DSW and DLC instances.

5. Manage specific ACR instances by creating and managing namespaces and image repositories.

6. Manage specific OSS buckets.

7. Manage specific NAS instances.

8. Manage the data directory structure on a NAS file system after mounting it to PAI.

9. Manage specific PAI quota groups as needed.

PAI workspace user

1. Use DSW and save images.

2. Use DLC.

3. View specific PAI quota groups as needed.

Permission configuration

Create the pai_workspace_admin policy

Note: Modify the placeholders, such as <xxxx>, and the region information in the policy as needed.

This policy grants the following permissions:

1. Permission to list all OSS buckets.

2. Permission to list objects in a specific OSS bucket.

3. Permission to get objects from subdirectories within a specific OSS bucket.

4. Permission to describe all NAS file systems, including NAS, CPFS, and Intelligent Computing CPFS.

5. Permission to fully control a specific NAS file system.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "oss:ListBuckets",
      "Resource": "acs:oss:*:*:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "oss:ListObjects",
        "oss:GetBucketAcl"
      ],
      "Resource": "acs:oss:oss-<region>:*:<bucket_name>"
    },
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetObject",
        "oss:GetObjectAcl"
      ],
      "Resource": "acs:oss:oss-<region>:*:<bucket_name>/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "nas:DescribeFileSystems",
        "nas:DescribeProtocolMountTarget",
        "nas:DescribeProtocolService"
      ],
      "Resource": "acs:nas:*:*:filesystem/*"
    },
    {
      "Effect": "Allow",
      "Action": "nas:*",
      "Resource": "acs:nas:*:*:filesystem/<filesystem_id>"
    },
    {
      "Effect": "Allow",
      "Action": "cr:*",
      "Resource": [
        "acs:cr:*:*:instance/<acr_instance_id>",
        "acs:cr:*:*:repository/<acr_instance_id>/*",
        "acs:cr:*:*:repository/<acr_instance_id>"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "pai:CreateQuota",
        "pai:UpdateQuota",
        "pai:ScaleQuota",
        "pai:DeleteQuota",
        "pai:GetQuota",
        "pai:ListQuotas"
      ],
      "Resource": "acs:pai:*:*:quota/<quotaid>/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "pai:UpdateQuota",
        "pai:GetQuota",
        "pai:ListQuotas"
      ],
      "Resource": "acs:pai:*:*:quota/<quotaid>"
    }
  ]
}

Create the pai_workspace_user policy

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cr:List*",
                "cr:Get*",
            ],
            "Resource": "*"
        },
         {
            "Effect": "Allow",
            "Action": [
                "pai:GetQuota",
                "pai:ListQuotas"
            ],
            "Resource": "acs:pai:*:*:quota/<quotaid>/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "pai:GetQuota",
                "pai:ListQuotas"
            ],
            "Resource": "acs:pai:*:*:quota/<quotaid>"
        }
    ]
}

Network access control

Create a RAM Policy named PAI_IP_Control. This policy restricts PAI console access to the IP addresses or CIDR blocks specified in the acs:SourceIp condition. For more information, see Access Alibaba Cloud by using specified IP addresses.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "paiplugin:*",
        "eas:*",
        "pai:*",
        "datasetacc:*",
        "featurestore:*",
        "paidlc:*",
        "paiitag:*",
        "paidesigner:*",
        "paitraining:*",
        "paiworkspace:*"
      ],
      "Resource":"*",
      "Condition":{
        "NotIpAddress": {
          "acs:SourceIp":[
            "127.0.0.1"
          ]
        }
      }
    }
  ]
}