CloudBox custom permission policy reference
If system policies do not meet your requirements, you can create custom permission policies to achieve least privilege. Custom permission policies provide an effective way to implement fine-grained permission control and enhance resource access security. This topic describes the operations related to custom permission policies for CloudBox.
What is a custom policy
Resource Access Management (RAM) policies come in two types: system policies (managed by Alibaba Cloud) and custom policies (managed by you). Custom policies give you precise control over permissions when system policies do not meet your requirements.
After creating a custom policy, attach it to a RAM user, a user group, or a RAM role to grant the specified permissions to that principal. The policy takes effect only after it is attached.
Manage custom policies
| Operation | Behavior |
|---|---|
| Create and attach | Create a custom policy, then attach it to the target principal. |
| Delete (unattached) | Delete any custom policy that is not currently attached to a principal. |
| Delete (attached) | Detach the policy from all principals first, then delete it. |
| Version management | Custom policies support version control. Use the version management mechanism in RAM to manage policy versions. |