Review permissions regularly to ensure least privilege
After granting permissions, audit them regularly. Revoke permissions that are no longer needed to ensure that each identity adheres to the principle of least privilege.
Priority
Medium
What to avoid
Granting too many administrator permissions. Do not grant administrator permissions to all users by default.
Failing to review and reduce permissions regularly. This can lead to permission creep.
Implementation guide
When you first move to the cloud or build new applications, you might use loose permission policies to make testing easier and improve efficiency. For example, in an early development or staging environment, you can grant developers broad product permissions to help them test and select products. As your business and products mature, you should continuously review and revoke unneeded permissions. This practice helps prevent security risks to your cloud assets and data that can result from excessive permissions.
Alibaba Cloud provides access analytics to help you quickly detect excessive permissions. You can use access analytics with EventBridge to quickly configure notification and alerting mechanisms. Pay close attention to the following:
Super administrators: A super administrator is a Resource Access Management (RAM) identity, such as a RAM user or RAM role, with full permissions to manage all resources in an account. An example is a RAM identity granted the `AdministratorAccess` access policy. You should grant permissions based on job functions. For more information, see Grant permissions based on the principle of least privilege. For identities that require cloud operations management, Alibaba Cloud provides a superuser permission template. You can use this template to downgrade a super administrator's permissions. For more information, see Import a policy template. A superuser can manage an enterprise's cloud operations. They can create, view, and operate all Alibaba Cloud services. However, they cannot manage identity permissions, account architecture, or account linking. You can also use other policy templates to define permissions for job functions.
Privileged identities: These are RAM identities, such as RAM users or RAM roles, with important privileges. A RAM identity with these privileges can often elevate its own permissions or the permissions of other RAM identities. This allows them to gain greater access. For a detailed list of privileges, see List of privileges. Audit these identities carefully. Make sure their privileges are justified.
Idle permissions: Use the audit results from access analytics to revoke unused permissions.
For detailed steps on how to audit and reduce permissions, see Detect and reduce excessive permissions using access analytics.