Set permission boundaries
If your organization has multiple Alibaba Cloud accounts, you can use Resource Directory control policies to limit the permissions of Resource Access Management (RAM) identities within member accounts. This lets you manage access boundaries for resources at all levels of your resource directory. You can establish access control principles for your entire enterprise or for specific parts of it.
Priority
Medium
Not recommended
After you set up a multi-account architecture with Resource Directory, failing to establish unified permission boundaries or control the behavior of member accounts can create security risks and lead to unnecessary costs.
In a multi-account architecture, you need unified permission boundaries. For example, your security baseline might require RAM identities to use multi-factor authentication (MFA) to delete resources. If you configure access policies for RAM identities separately in each member account, it is difficult to maintain a consistent security baseline. This also greatly increases operations and maintenance (O&M) and management costs.
Implementation guide
A Resource Directory control policy is an access control policy based on your resource structure, such as folders or members. It only defines permission boundaries and does not grant permissions. You must still set permissions in a member account using RAM before an identity can access resources.
After you create a resource directory and add members for each department, you must control their behavior. If you do not, you risk violating O&M rules, creating security risks, and incurring unnecessary costs. Resource Directory provides a control policy feature. You can use the management account to create rules centrally and apply them to folders and members in your resource directory. This controls access to resources within each member account and helps ensure security, compliance, and cost control. For example, you can prevent members from requesting domain names or deleting log records. For more information, see Global Access Boundary Control for a Multi-account Organization.
You can use the Cloud Governance Center landing zone setup feature. This feature uses blueprint templates to help you easily set up a multi-account environment. Cloud Governance Center provides preset control policies that are common for enterprises. You can enable these policies with a single click during the setup.
Set up a multi-account architecture and properly isolate different workloads.
Use control policies to establish unified permission boundaries.
When you define a control policy, you can choose from two effects:
Allow: Specifies the allowed access permissions. All other access permissions are implicitly denied.
NoteAfter you enable control policies, folders and members in your resource directory are attached to the FullAliyunAccess system policy by default. This policy allows all operations on all your Alibaba Cloud resources. If you want to customize allowed access permissions, you must define your control policy, attach it to the target, and then detach the FullAliyunAccess policy.
Deny: Specifies the access permissions that are not allowed. All other access permissions are allowed by default.
For most scenarios, use the Deny effect to specify which permissions are not allowed. Use the Allow effect only when you need complete and strict control over permissions and are certain about the exact product permissions that the member accounts require.
For more information about how to create effective control policies, see Examples of custom control policies.