Simplify personnel management with user groups
You can use RAM user groups to group and centrally manage Resource Access Management (RAM) users who have the same responsibilities. You can then grant permissions to the user groups. This approach reduces the number and complexity of access policies, helps you manage RAM users and their permissions more efficiently, and makes it easier to apply the principle of least privilege.
Priority
Medium
What to avoid
Managing permissions for each RAM user individually and copying permissions between multiple RAM users.
Defining user groups that are too broad. This requires granting excessive permissions and increases the threat of over-authorization.
Defining user groups that are too fine-grained. This can cause member overlap and confusion, which complicates management.
Guidelines
Define user groups. Use the following principles to design your user groups:
Define user groups based on job functions. For example, for a network management team, define a network management user group. Then, add users with network management responsibilities to the group for centralized management and authorization.
If two user groups have overlapping permissions, extract the common permissions into a separate custom permission policy. Grant this policy to both user groups. Do not merge the two groups, because this can make the group definition too broad.
To create user groups, use one of the following methods:
If your user groups are defined in your corporate Identity Provider (IdP), integrate your IdP with Alibaba Cloud for single sign-on (SSO). Then, use the System for Cross-domain Identity Management (SCIM) protocol to synchronize user groups from your IdP to RAM user groups. For more information, see Implement unified identity authentication with a single IdP.
If you define user groups directly in Resource Access Management (RAM), see RAM user group overview for more information.
Grant fine-grained permissions to user groups. Follow the principle of least privilege. Grant permissions to RAM user groups based on job functions and resource scopes. For more information, see Grant permissions based on the principle of least privilege and grant permissions to a RAM user group.