Grant, view, and revoke permissions for a RAM role-The Beginner's Guide-阿里云帮助中心

Learn how to grant, view, and revoke permissions for a RAM role.

Limitations

Permissions for a service-linked role are predefined by the associated cloud service and cannot be modified. You cannot manually add or remove permissions for a service-linked role.
The number of policies (including system and custom policies) that you can attach to a RAM role is subject to Limitations.

Grant permissions to a RAM role

Console

Requires the AliyunRAMFullAccess system policy.

The console provides multiple entry points.

Entry point	Use cases	Batch operation supported
Identities > Roles page	Grant the same permissions to one or more RAM roles.	Yes
Permissions > Grants page	Grant the same permissions to multiple principals, such as users, user groups, and roles, in a single operation.	Yes

From the Roles page

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, find the target RAM role and click Grant Permission in the Actions column.

You can also select multiple RAM roles and click Grant Permission at the bottom of the role list to grant permissions in bulk.
On the Grant Permission panel, grant permissions to the RAM role.
1. Select a resource scope.
  - Account: The permissions apply within the current Alibaba Cloud account.
  - Resource Group: The permissions apply within the specified Resource Group.
    
    Note
    Resource Group-level permissions require both the cloud service and resource type to support Resource Groups. Cloud services that support Resource Groups.
2. Select a principal.
  
  The system automatically selects the current RAM role as the principal.
3. Select policies.
  
  Select one or more policies to attach.
  - System policies: Predefined by Alibaba Cloud and cannot be modified. For more information, see the "Cloud Services and System Policies" section in Cloud services that work with RAM.
    
    Note
    The console automatically flags high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. When granting permissions, avoid attaching high-risk policies unless necessary.
  - Custom policies: Created and managed by you. You can create, update, and delete custom policies. To learn how to create a custom policy, see Create a custom policy.
4. Click OK.
Click close.

From the Grants page

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Grants.
On the Grants page, click Grant Permission.
On the Grant Permission panel, grant permissions to the RAM role.
1. Select a resource scope.
  - Account: The permissions apply within the current Alibaba Cloud account.
  - Resource Group: The permissions apply within the specified Resource Group.
    
    Note
    Resource Group-level permissions require both the cloud service and resource type to support Resource Groups. Cloud services that support Resource Groups.
2. Select a principal.
  
  Select the RAM roles to grant permissions to.
3. Select policies.
  
  Select one or more policies to attach.
  - System policies: Predefined by Alibaba Cloud and cannot be modified. For more information, see the "Cloud Services and System Policies" section in Cloud services that work with RAM.
    
    Note
    The console automatically flags high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. When granting permissions, avoid attaching high-risk policies unless necessary.
  - Custom policies: Created and managed by you. You can create, update, and delete custom policies. To learn how to create a custom policy, see Create a custom policy.
4. Click OK.
Click close.

API

Call the AttachPolicyToRole operation to attach a policy to a RAM role. Required parameters:

PolicyType: The type of policy to attach. Set the value to System for a system policy or Custom for a custom policy. This parameter is case-sensitive.
PolicyName: The exact name of the policy to attach.
RoleName: The name of the RAM role.

Note

The AttachPolicyToRole operation grants permissions at the Alibaba Cloud account level only. To grant permissions at the Resource Group level, call the Resource Management operation Grant permission to a RAM identity.

View permissions for a RAM role

Requires the AliyunRAMReadOnlyAccess system policy.

Console

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click the name of the target RAM role.
On the Permissions tab, view the policies that are attached to the role.

API

Call the ListPoliciesForRole operation to list policies attached to a RAM role. Required parameter:

RoleName: The name of the RAM role.

Revoke permissions from a RAM role

Requires the AliyunRAMFullAccess system policy.

Console

You can revoke permissions from a RAM role in several ways.

From the Roles page

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click the name of the target RAM role.
On the Permissions tab, find the target policy and click Revoke Permission in the Actions column.

You can also select multiple policies and click Revoke Permission at the bottom of the policy list to revoke multiple permissions in bulk.
On the Revoke Permission dialog box, click Revoke Permission.

From the Grants page

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Grants.
On the Grants page, find the target RAM role and click Revoke Permission in the Actions column.

You can also select multiple RAM roles and click Revoke Permission at the bottom of the role list to revoke permissions from them in bulk.
On the Revoke Permission dialog box, click Revoke Permission.

API

Call the DetachPolicyFromRole operation to detach a policy from a RAM role. Required parameters:

PolicyType: The type of policy to detach. Set the value to System for a system policy or Custom for a custom policy. This parameter is case-sensitive.
PolicyName: The exact name of the policy to detach.
RoleName: The name of the RAM role.