DocsICP FilingConsole
Documentation
Home Page Domain Names Security and Compliance Access control Identity-based policies Custom policies for Domain

Custom policies for Domain

Updated at:
Copy as MD
Product
My Favorites

If system policies do not meet your requirements, you can create custom policies to implement least-privilege access. Custom policies provide fine-grained permission control and help improve resource access security.

What is a custom policy?

Resource Access Management (RAM) policies are classified into system policies and custom policies. You can manage custom policies based on your business requirements.

  • After you create a custom policy, you must attach the policy to a RAM user, RAM user group, or RAM role. This way, the permissions that are specified in the policy can be granted to the principal.

  • You can delete a RAM policy that is not attached to a principal. If the RAM policy is attached to a principal, before you can delete the RAM policy you must detach the RAM policy from the principal.

  • Custom policies support version control. You can manage custom policy versions based on the version management mechanism provided by RAM.

References

Grant read-only permissions by creating a custom policy

You can create a custom policy in the RAM console to grant read-only permissions to a RAM user. This allows the authorized RAM user to view domain names that belong to the Alibaba Cloud account but not manage them.

  1. In the left-side navigation pane, choose Permissions > Policies.

  2. On the Policies page, click Create Policy.

  3. On the Create Policy page, click the JSON Editor tab.

  4. Enter the following policy script in the editor and click OK. 

    {
   "Version": "1",
   "Statement": [
     {
       "Action": [
         "domain:Query*"
       ],
       "Resource": "acs:domain:*:*:*",
       "Effect": "Allow"
     }
    ]
}

  5. Specify the Policy Type and an optional Description.

    The Policy Name is required. It must be 128 characters or less and can contain only letters, digits, and hyphens (-).

    For more information about related settings, see Create a custom policy on the JSON editor tab.

  6. Click OK.

    You can view the custom policy that you created in one of the following ways:

    • Method 1: On the Policies page, select Custom Policy from the Policy Type drop-down list.

    • Method 2: In the Attach Policy panel, select Custom Policy.

Grant permissions to manage a single domain

You can create a custom policy in the RAM console to authorize a RAM user to manage a single domain name. This allows the authorized RAM user to manage only a specific domain name, such as example.com.

Note

  • Authorization is supported only for the actions listed in the policy. For more information about the authorization rules for each action, see Domain API authorization rules.

  • After authorization, the RAM user can log on to the Alibaba Cloud Domain Names console and view all domain names that belong to the Alibaba Cloud account. However, the RAM user can manage only the specific domain name for which permissions are granted.

  1. In the left-side navigation pane, choose Permissions > Policies.

  2. On the Policies page, click Create Policy.

  3. On the Create Policy page, click the JSON Editor tab.

  4. Enter the following policy script in the editor. Replace example.com with your domain name. Then, click OK. 

    {
  "Version": "1",
  "Statement": [
    {
      "Action": [
      "domain:DnsModification",
      "domain:SecuritySetting",
      "domain:RealNameVerificationOperation",
      "domain:DnsHostModification",
      "domain:CreateOrderActivate",
      "domain:CreateOrderRenew",
      "domain:CreateOrderRedeem",
      "domain:CreateOrderTransfer",
      "domain:DomainTransferInOperation",
      "domain:DomainTransferOutOperation",
      "domain:QualificationAuditOperation",
      "domain:EnsSetting",
      "domain:DnsSecSetting",
      "domain:SaveArtExtension",
      "domain:CreateOrderPendingDelete"
      ],
      "Resource": "acs:domain:*:*:domain/example.com",
      "Effect": "Allow"
    },
    {
      "Action": [
      "domain:Query*"
      ],
      "Resource": "acs:domain:*:*:*",
      "Effect": "Allow"
    }
  ]
}

  5. Specify the Policy Type and an optional Description.

    The Policy Name is required. It must be 128 characters or less and can contain only letters, digits, and hyphens (-).

    For more information about related settings, see Create a custom policy on the JSON editor tab.

  6. Click OK.

    You can view the custom policy that you created in one of the following ways:

    • Method 1: On the Policies page, select Custom Policy from the Policy Type drop-down list.

    • Method 2: In the Attach Policy panel, select Custom Policy.

Previous：Identity-based policiesNext：Authorize a RAM user to manage domains