Platform For AI:Cloud product dependencies and authorization: DSW

Authorize the operating account

DSW is a cloud-based machine learning Integrated Development Environment (IDE). It provides an interactive programming environment for developers of all skill levels. When you use DSW for interactive modeling, you may need to use the following related cloud products. You must activate these products and grant the required permissions in advance.

• PAI sub-product: DSW

  Account type	Scenario	Link to guide
  Root account	A root account can perform all DSW operations without extra authorization.	Not applicable
  RAM user (Recommended)	PAI provides different member roles. You can add RAM users as workspace members with specific roles to grant them permissions on the corresponding sub-products. For more information about the permissions of each role, see Appendix: Roles and permissions.	Create and manage workspaces

• Other dependent cloud products: OSS

  DSW depends on OSS for data storage. Therefore, you must activate OSS and grant the required permissions.

  Scenario	Description	Link to guide
  Activate OSS	Use a root account to activate OSS. No extra authorization is required when you use a root account. To use a RAM user to activate OSS, grant the AliyunOSSFullAccess permission to the RAM user.	Activation: Quick Start Grant permissions to a RAM user: RAM Policy Common operations: Quick Start
  Use OSS	When you use OSS: Authorization: OSS provides detailed RAM control policies. Grant permissions to RAM users as needed. Common operations: Create a bucket to upload files to OSS.

Authorize the PAI service account

Grant general DSW permissions to an Alibaba Cloud account (root account)

To ensure that DSW works properly, you must confirm that the current Alibaba Cloud account has general permissions for DSW. This authorization is usually completed when you activate PAI and create a default workspace. You can check whether the current account has general DSW permissions by following the instructions in Reference: Check whether the AliyunPAIDSWDefaultRole role is associated with the account. If not, follow the steps below to grant the permissions.

1. Go to the DSW page.

   1. Log on to the PAI console.

   2. On the Overview page, select the destination region.

   3. In the navigation pane on the left, click Workspaces. On the Workspaces page, click the name of the workspace that you want to manage to go to the workspace page.

   4. In the navigation pane on the left of the workspace page, choose Model Training > Data Science Workshop (DSW) to go to the DSW page.

2. Grant the AliyunPAIDSWDefaultRole role.

   1. Click Create Instance.

   2. In the Grant Permissions dialog box, click Authorize Now.

   3. On the Cloud Resource Access Authorization page, click Agree to Authorization.

      On the Cloud Resource Access Authorization page, the system automatically configures the service-linked role required by DSW. No manual configuration is required.

Grant PAI permissions to access cloud products: OSS and NAS

PAI provides a one-click authorization method to grant PAI access to cloud products such as OSS and NAS. The procedure is as follows:

1. Log on to the PAI console.

2. In the navigation pane on the left, choose Activation & Authorization > Dependent Services. In the DSW section, find OSS and NAS.

3. In the Actions column, check the authorization status of OSS.

   • If the service is not authorized, click One-click Authorization in the Actions column and follow the on-screen instructions to complete the authorization.

   • If the service is already authorized, you can click View Authorization Information in the Actions column to view the details.

If you do not grant the role the permissions to access OSS (AliyunPAIDLCAccessingOSSRole), an error may occur when you try to mount an OSS dataset:

Reference: Check whether the AliyunPAIDSWDefaultRole role is associated with the account

1. Log on to the RAM console.

2. In the left navigation pane, click Identity Management > Role.

3. On the Roles page, enter AliyunPAIDSWDefaultRole in the search box and search for the role.

   • If the role is found, the DSW service role is already authorized.

   • If the role is not found, you must perform the authorization. For more information, see Grant general DSW permissions to an Alibaba Cloud account (root account).

References

After you complete the authorization process, you can create a DSW instance and use the development environment provided by DSW to develop and train artificial intelligence models. For more information, see Create a DSW instance.