If a RAM user or RAM role needs to manage Alibaba Cloud Model Studio, access its knowledge bases, or use features such as Data Management, prompt engineering, and long-term memory through APIs, you must first grant the required RAM permissions.
RAM permissions: RAM permissions are divided into system policies and custom policies. System policies allow you to quickly configure permissions for common scenarios. If you require fine-grained control over permissions, such as restricting a specific RAM user from calling a specific API in the API directory, you can use a custom policy. You can also combine these two types of policies. For more information, see Overview of access policies.
System policies
System policies are a set of permissions created and managed by Alibaba Cloud. You can attach these policies to a RAM user or a RAM role, but you cannot modify them. Alibaba Cloud maintains and updates these policies. Alibaba Cloud Model Studio provides the following system policies:
Read Permission Management to learn how to use and select system policies.
Alibaba Cloud account that has activated Alibaba Cloud Model Studio is granted the AliyunBailianFullAccess system policy and permissions for all workspaces.
| System policy name | System policy description | Control plane permission description | Data permission description |
|---|---|---|---|
| AliyunBailianFullAccess | Grants full permissions for permission management and data permissions.Note: These are not data layer permissions and do not include workspace permissions. | Grants all control plane permissions, including the following:
| Grants data management permissions, including the following:
|
| AliyunBailianReadOnlyAccess | Grants partial read-only permissions on the control plane and partial read-only data permissions.Note: These are not data layer permissions and do not include workspace permissions. | Grants partial read-only permissions on the control plane, including the following:
| Grants read-only data permissions.
|
| AliyunBailianControlFullAccess | Grants some management permissions on the control plane. | Grants some management permissions on the control plane, including the following:
| No permissions. |
| AliyunBailianControlReadOnlyAccess | Grants only read-only permissions on the control plane. | Grants read-only permissions on the control plane, including the following:
| No permissions. |
| AliyunBailianDataFullAccess | Grants only data permissions.Note: These are not data layer permissions and do not include workspace permissions. | No permissions. | Grants data management permissions, including the following:
|
| AliyunBailianDataReadOnlyAccess | Grants only read-only data permissions.Note: These are not data layer permissions and do not include workspace permissions. | No permissions. | Grants read-only data permissions.
|
Custom policies
Custom policies are sets of permissions that you create and manage. They can be created and managed by an Alibaba Cloud account or a RAM user that is granted the AliyunRAMFullAccess system policy. You are responsible for maintaining and updating the versions of your custom policies. The permissions in a custom policy can be updated or deleted at any time.
APIs for knowledge bases, Data Management, prompt engineering, and long-term memory now support custom policies. You can select the required permissions from the list below to create a custom policy and grant it to a RAM user to achieve least privilege. For more information about how to create a custom policy, see Configure a custom policy.
Features | API | Required permission to call the API | Permission description |
|---|---|---|---|
Knowledge base | sfm:CreateIndex | For more information, see Authorization information. | |
GetIndexJobStatus - Query the status of a knowledge base creation task | sfm:GetIndexJobStatus | For more information, see Authorization information. | |
sfm:SubmitIndexJob | For more information, see Authorization information. | ||
SubmitIndexAddDocumentsJob - Submit a task to append data to a knowledge base | sfm:SubmitIndexAddDocumentsJob | For more information, see Authorization information. | |
sfm:Retrieve | For more information, see Authorization information. | ||
ListIndexDocuments - Query the list of files in a knowledge base | sfm:ListIndexFiles | For more information, see Authorization information. | |
sfm:ChunkList | For more information, see Authorization information. | ||
sfm:ListIndex | For more information, see Authorization information. | ||
sfm:DeleteIndex | For more information, see Authorization information. | ||
sfm:DeleteIndexDocument | For more information, see Authorization information. | ||
Data Management | sfm:AddCategory | For more information, see Authorization information. | |
sfm:ListCategory | For more information, see Authorization information. | ||
sfm:DeleteCategory | For more information, see Authorization information. | ||
sfm:ApplyFileUploadLease | For more information, see Authorization information. | ||
sfm:AddFile | For more information, see Authorization information. | ||
sfm:DescribeFile | For more information, see Authorization information. | ||
sfm:ListFile | For more information, see Authorization information. | ||
sfm:DeleteFile | For more information, see Authorization information. | ||
sfm:UpdateFileTag | For more information, see Authorization information. | ||
Prompt engineering | sfm:CreatePromptTemplate | For more information, see Authorization information. | |
Get a prompt template | sfm:GetPromptTemplate | For more information, see Authorization information. | |
Update a prompt template | sfm:UpdatePromptTemplate | For more information, see Authorization information. | |
Delete a prompt template | sfm:DeletePromptTemplate | For more information, see Authorization information. | |
Get a list of prompt templates | sfm:ListPromptTemplates | For more information, see Authorization information. | |
Long-term memory | sfm:CreateMemory | For more information, see Authorization information. | |
sfm:GetMemory | For more information, see Authorization information. | ||
sfm:UpdateMemory | For more information, see Authorization information. | ||
sfm:DeleteMemory | For more information, see Authorization information. | ||
sfm:ListMemories | For more information, see Authorization information. | ||
sfm:CreateMemoryNode | For more information, see Authorization information. | ||
sfm:GetMemoryNode | For more information, see Authorization information. | ||
sfm:UpdateMemoryNode | For more information, see Authorization information. | ||
sfm:DeleteMemoryNode | For more information, see Authorization information. | ||
sfm:ListMemoryNodes | For more information, see Authorization information. |
FAQ
What RAM permissions are required for a RAM user or RAM role to activate features such as model calling and application observability for the first time?
What RAM permissions are required for a RAM user or RAM role to activate features such as model calling and application observability for the first time?
Feature name | Required RAM permissions | |
|---|---|---|
Model calling | Use an Alibaba Cloud account to grant the | |
Application observability | Use an Alibaba Cloud account to grant the | |
Pay for subscription orders | Use your Alibaba Cloud account in the Resource Access Management (RAM) console to configure the | |
Does the AdministratorAccess policy include the AliyunBailianFullAccess system policy?
Does the AdministratorAccess policy include the AliyunBailianFullAccess system policy?
AdministratorAccess policy includes the AliyunBailianFullAccess system policy. A RAM user with the AdministratorAccess system policy has full permissions for permission management and data permissions by default.Note: These are not data layer permissions and do not include workspace permissions.