DocsICP FilingConsole
Documentation
Home Page Resource Access Management Identity Permission Governance Important permission management Avoid granting Admin permissions to too many RAM identities

Avoid granting Admin permissions to too many RAM identities

Updated at:
Copy as MD
Product
My Favorites

Risk description

Follow the principle of least privilege when you manage permissions for RAM identities. Grant only the permissions that are required. Admin permissions allow you to perform any operation on any resource in your account. In the policy, the Resource and Action elements are both set to *. For example, the AdministratorAccess system policy grants Admin permissions. Avoid granting Admin permissions to too many RAM identities, such as Resource Access Management (RAM) users, RAM roles, and RAM user groups. This helps prevent business disruptions if an identity is compromised.

Risk level

High risk.

Best practices

Limit the number of RAM identities with Admin permissions to three or fewer in your Alibaba Cloud account.

Remediation suggestions

  • For human users, grant permissions based on job functions, such as system administrator, network administrator, database administrator, and security administrator. Create custom permission policies for these roles and adjust them as needed. For more information, see Create a custom permission policy.

  • For programmatic access, avoid granting Admin permissions. Instead, create custom permission policies that grant access only to the specific APIs and resources that the program requires. This provides fine-grained authorization. For more information, see Create a custom permission policy.

Remediation difficulty

Medium.

Previous：Important permission managementNext：Avoid granting RAM important permissions to too many RAM identities