The first time you use Dataset Accelerator, you must assign a service-linked role to Dataset Accelerator so that Dataset Accelerator can access the required resources. This topic describes how to grant permissions to a service-linked role of Dataset Accelerator.
Grant permissions to the operation account
You can use the AI acceleration feature of Platform for AI (PAI) to accelerate training and inference. In most cases, you need only permissions for development, training, and inference in related PAI modules when using AI acceleration. No additional authorization is required. To use Dataset Accelerator, you must purchase accelerators by using your Alibaba Cloud account. You can grant the management or read-only permissions on Dataset Accelerator to a RAM user by performing the following steps:
Grant the management permissions on Dataset Accelerator to a RAM user
After you grant a RAM user the permissions to manage Dataset Accelerator, the RAM user can use all features of Dataset Accelerator.
Log on to the RAM console.
Grant the permissions to manage Dataset Accelerator to a RAM user. For more information, see Grant permissions to the RAM user.
Take note of the following items:
In the Add Permissions panel, set the Authorized Scope parameter to Alibaba Cloud Account.
In the Add Permissions panel, set the Select Policy parameter to System Policy and then select the AliyunDatasetAccFullAccess and AliyunPAIFullAccess policies.
Grant the read-only permissions on Dataset Accelerator to a RAM user
After you grant a RAM user the read-only permissions on Dataset Accelerator, the RAM user can query and view the list of accelerators and slots.
Log on to the RAM console.
Grant the read-only permissions on Dataset Accelerator to a RAM user. For more information, see Grant permissions to the RAM user.
Take note of the following items:
In the Add Permissions panel, set the Authorized Scope parameter to Alibaba Cloud Account.
In the Add Permissions panel, set the Select Policy parameter to System Policy and then select the AliyunDatasetAccFullAccess policy.
Grant permissions to the service-linked role
In most cases, the necessary authorization is completed when you activate PAI. If the authorization is not performed, perform the following steps.
Use the console
Go to the Dataset Accelerator page.
Log on to the PAI console.
In the left-side navigation pane, choose AI Acceleration > Dataset Accelerator.
Click Go to the RAM console.
Click Confirm Authorization Policy.
After the role is created, you can go to the Dataset Accelerator page.
Use API operations
If you access Dataset Accelerator by calling API operations, the following message is returned. You can click the Cloud Resource Access Authorization link provided in the response to go to the authorization page.
{
"code":"ServiceRoleNotExistsError",
"data":{
"RequestId":"0526FD22-D8AA-5E24-B778-C67C768D****",
"Message":"The following RAM role does not exist: AliyunPAIDatasetAccDefaultRole. Click the following link to create a service-linked role: https://ram.console.aliyun.com/role/authorize?request=%7B%22ReturnUrl%22%3A%22https%3A%2F%2Fpai.console.aliyun.com%2F%3FregionId%3Dcn-hangzhou%23%2Fdataset-acc%2Finstances%22%2C%22Services%22%3A%5B%7B%22Roles%22%3A%5B%7B%22RoleName%22%3A%22AliyunPAIDatasetAccDefaultRole%22%2C%22TemplateId%22%3A%22AliyunPAIDatasetAccDefaultRole%22%7D%5D%2C%22Service%22%3A%22PAI%22%7D%5D%7D",
"Code":"ServiceRoleNotExistsError",
"Detail":{
"ErrorCode":521884733440157****
}
},
"httpStatusCode":"400",
"message":"The following RAM role does not exist: AliyunPAIDatasetAccDefaultRole. Click the following link to create a service-linked role: https://ram.console.aliyun.com/role/authorize?request=%7B%22ReturnUrl%22%3A%22https%3A%2F%2Fpai.console.aliyun.com%2F%3FregionId%3Dcn-hangzhou%23%2Fdataset-acc%2Finstances%22%2C%22Services%22%3A%5B%7B%22Roles%22%3A%5B%7B%22RoleName%22%3A%22AliyunPAIDatasetAccDefaultRole%22%2C%22TemplateId%22%3A%22AliyunPAIDatasetAccDefaultRole%22%7D%5D%2C%22Service%22%3A%22PAI%22%7D%5D%7D",
"requestId":"0526FD22-D8AA-5E24-B778-C67C768D****",
"successResponse":false
}Reference: Permission-related FAQ
Why do I need to grant permissions to a RAM role?
Dataset Accelerator uses the RAM role AliyunPAIDatasetAccDefaultRole to access your resources on Alibaba Cloud and provide dataset acceleration services.
How do I manage authorized RAM roles?
You can manage RAM roles and view the permissions of the roles in the RAM console. For more information, see View the information about a RAM role.
We recommend that you do not delete the role. Otherwise, you need to grant permissions to the role by using your Alibaba Cloud account again.
