How does EIP work with RAM
Resource Access Management (RAM) lets you control who can manage elastic IP addresses (EIPs) in your Alibaba Cloud account. Instead of sharing your account credentials, grant specific RAM users, user groups, or roles only the permissions they need.
Permission model
RAM uses policies to define what a principal—a RAM user, RAM user group, or RAM role—can do with a resource. Attaching a policy to a principal grants that principal the permissions defined in the policy.
Resource ownership
Each Alibaba Cloud resource has exactly one owner: the Alibaba Cloud account. The account has full control over all resources it owns, regardless of who created them.
The resource owner and the resource creator are not always the same entity. For example, if a RAM user creates an EIP, the Alibaba Cloud account is the resource owner—not the RAM user.
RAM user permissions
RAM users have no permissions by default. To manage EIPs, a RAM user must have one or more explicit allow policies attached by the Alibaba Cloud account. Creating a resource does not automatically grant the creator any permissions on that resource.
Policy types
RAM supports two types of policy:
| Policy type | Created by | Modifiable | Use when |
|---|---|---|---|
| System policy | Alibaba Cloud | No | Your use case matches a predefined permission set |
| Custom policy | You | Yes | System policies are too broad or don't cover your requirements |
System policies cover common EIP permission scenarios. Alibaba Cloud creates and maintains these policies. When Alibaba Cloud updates a system policy, the update takes effect automatically—you don't need to re-attach the policy. For the full list, see System policies for EIP.
Custom policies give you fine-grained control. Define exactly which EIP operations to allow or deny, and on which resources. For syntax and examples, see Custom policies for EIP.
Attach policies to a principal
Attach one or more policies—system policies, custom policies, or both—to a RAM user, a RAM user group, or a RAM role. When you update an attached policy, the changes take effect immediately. You do not need to re-attach the policy.
What's next
System policies for EIP — view all predefined policies available for EIP
Custom policies for EIP — write fine-grained policies for specific EIP operations