Reference for using custom policies in CDT
When system policies don't meet your business requirements, create custom policies based on the principle of least privilege. Custom policies give you fine-grained control over which actions are allowed on which CDT resources, and restrict access only to the identities that need it.
System policies vs. custom policies
Resource Access Management (RAM) policies fall into two types:
| System policy | Custom policy | |
|---|---|---|
| Managed by | Alibaba Cloud | You |
| Modifiable | No | Yes |
| Use when | Standard permissions are sufficient | You need fine-grained or use-case-specific access control |
Manage custom policies
Attach a custom policy
After creating a custom policy, attach it to a RAM user, RAM user group, or RAM role. The principal inherits all permissions defined in the policy.
Delete a custom policy
A custom policy can only be deleted when it is not attached to any principal. If the policy is currently attached, detach it from all principals first, then delete the policy.
Manage policy versions
Custom policies support version control. You can manage custom policy versions based on the version management mechanism provided by RAM.