Grant permissions based on the principle of least privilege
Proper permission settings prevent unauthorized access and protect your cloud assets and data. The core principle of cloud permission management is least privilege. Grant an identity only the permissions it needs. The permissions should allow specific operations on specific resources under specific conditions. This ensures that permissions are sufficient but not excessive.
Priority
High
Practices to avoid
Granting administrator permissions without differentiating permissions based on job roles.
For developers, granting account-wide authorization instead of isolating permissions at the resource group level based on their assigned workloads. For example, Application A and Application B are managed by development teams a and b, respectively. If you grant account-level permissions, developers from team a can access and operate on the resources of Application B. This creates a risk of unauthorized access.
For programmatic identities, granting overly permissive access policies, such as a FullAccess permission for a product. Instead, restrict permissions to specific operations on specific resources. This prevents operational errors and reduces the impact if the programmatic identity is compromised.
Failing to regularly review and restrict permissions, which leads to permission creep.
Implementation guide
Cloud permission management controls which operations an identity can perform on which resources under what conditions. Alibaba Cloud provides the following authorization methods:
Identity-based authorization: Granting permissions to Resource Access Management (RAM) users, user groups, or roles.
Resource-based authorization: Some cloud products allow you to attach policies to specific resources. For example, an OSS bucket policy lets you grant access permissions to RAM users from other accounts or to anonymous users with specific IP address conditions.
Control policy: For an organization with multiple accounts in a Resource Directory (RD), a control policy is an access control policy based on the resource structure, such as folders or members. It lets you centrally manage the permission boundaries for resource access at different levels of the resource directory. You can establish organization-wide or specific access control principles. A control policy only defines permission boundaries. It does not grant permissions.
Session policy: During role assumption, you can specify a session policy to define the permissions for that session. This further narrows the scope of the role's permissions. A session policy only constrains permissions. It does not grant them.
Follow the principle of least privilege regardless of the authorization method.
Grant fine-grained permissions. Refer to the following best practices for different identity types.
Permission management for human identities.
Grant permissions based on job roles. In an organization, people with different responsibilities need to access different types of cloud resources. Security administrators often need to access security products, while database administrators typically need to access only database-related products. For the same job role, especially for common roles such as finance staff, database administrators, security administrators, or auditors, the scope of resources they need to access and manage is often consistent. Therefore, you can abstract permissions based on job roles. Alibaba Cloud provides policy templates for common job roles. To quickly create custom permission policies that match your organization's job roles, you can import a Policy Template and modify it as needed. This simplifies authorization and reduces management costs.
Grant permissions based on resource scope. For large organizations, grant permissions based on the resource scope of the business applications managed by personnel, especially developers. This ensures that developers for business application A do not accidentally access or operate on the resources of business application B. This practice prevents unauthorized access and operational errors. It also simplifies the authorization logic and increases the reusability of access policies, striking a balance between least privilege and management efficiency. First, use resource groups to group resources within your Alibaba Cloud account. Place the resources for different business applications into different resource groups. Then, when granting permissions, select the corresponding resource group as the application scope. For specific authorization steps, see Resource grouping and authorization. This method uses the resource group as a container for resource isolation and permission management. For more information, see Best practices for resource groups.
Permission management for programmatic identities.
Fine-grained authorization. The operations that an application needs to perform on Alibaba Cloud resources are generally predictable. You can use custom permission policies to define the minimum permissions required for the programmatic identity. For example, a user community application that displays user profile pictures and supports uploads only needs `GetObject` and `PutObject` permissions for a specific OSS Bucket. You can create custom permission policies using the visual editor or by importing a policy. This simplifies the policy creation process. You can also use the Condition element in access policies to further constrain and converge permissions. For example, you can use the Condition element to allow access to Alibaba Cloud resources only from specified IP addresses or only during a specified time period. This also applies to human identities.
Use a session policy. In some scenarios, you can use a session policy to dynamically converge permissions. This helps avoid creating too many RAM roles and increases the reusability of access policies. For example, a company's client application has its own user system and allows users to upload files to OSS. You need to restrict each user to upload files only to their own folder to achieve resource and permission isolation. If you assign a separate Alibaba Cloud RAM role to each user, the number of roles will grow rapidly. This can exceed quota limits and increase management costs. Instead, you can create a single RAM role for the application to use for file uploads. The role's permissions can be broader, for example, limited to the OSS Bucket level:
{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "oss:PutObject" ], "Resource": [ "acs:oss:*:*:examplebucket/*" ] } ] }When the application calls the AssumeRole API to assume the role and obtain a Security Token Service (STS) token for file uploads, you can use the Policy parameter to narrow the permission scope for the session. For example, a user with the ID 123 needs to upload a file to `examplebucket`. The file path is
oss://examplebucket/user/123/. The session policy can further restrict the permissions of the generated STS token:{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": "oss:PutObject", "Resource": [ "acs:oss:*:*:examplebucket/user/123/*" ] } ] }The permissions of the generated STS token are the intersection of the session policy's permissions and the role's permissions. The token only has permission to upload files to the specified OSS folder. This provides dynamic permission isolation for different users of your application.
Regularly review access policies and remove unnecessary permissions. Alibaba Cloud provides access analytics to help you quickly identify external access and excessive permissions. You can also use EventBridge to quickly configure notification and alerting mechanisms. For more information, see Regularly review permissions to ensure least privilege.
Set permission boundaries. For organizations with multiple Alibaba Cloud accounts, you can use resource directory control policies to restrict the permission scope of RAM identities within member accounts. This helps disable important operations and reduce the risk of identity compromise. For example, you can prohibit members from deleting domain names, modifying DNS records, or deleting log records. For more information, see Set permission boundaries.
Establish a temporary privilege escalation mechanism. When you implement the principle of least privilege, you may encounter situations that require temporary privilege escalation. For example, to prevent accidental resource deletion, you might not grant business teams permission to delete resources. When a team needs to delete a resource, they can submit a request for temporary privilege escalation. This reduces operational errors and balances least privilege with management efficiency.