DocsICP FilingConsole
Documentation
Home Page Resource Access Management Identity Permission Governance Privileged access management Avoid granting high-risk OSS and SLS permissions to too many RAM identities

Avoid granting high-risk OSS and SLS permissions to too many RAM identities

Updated at:
Copy as MD
Product
My Favorites

Threat description

Manage permissions for RAM identities by following the principle of least privilege. Grant only the necessary permissions. A RAM identity with oss:Delete* or log:Delete* permissions can delete data stored in Object Storage Service (OSS) or Simple Log Service (SLS). Improper management can lead to data loss. A RAM identity with permissions such as oss:PutBucketAcl, oss:PutObjectAcl, or oss:PutBucketPolicy can modify access permissions for files in an OSS bucket. This can expose OSS files to external access and may result in unauthorized data access.

Risk level

High risk.

Best practices

The requirement is met if your Alibaba Cloud account has three or fewer RAM identities with oss:Delete*, oss:Put*Acl, oss:Put*Policy, log:Delete*, or log:Update* permissions.

Remediation suggestions

  • For user identities, assign permissions based on job functions, such as system administrator, network administrator, database administrator, and security administrator. You can create access policies for these roles by importing policy templates and adjusting them as needed. For more information, see Create a custom permission policy by importing a policy template.

  • For applications, do not grant permissions to delete buckets, delete Logstores, delete Log projects, or modify bucket policies unless necessary. For fine-grained authorization, create custom permission policies based on the APIs and resources that the application needs to access. For more information, see Create a custom permission policy.

Remediation difficulty

Medium.

Previous：Avoid granting high-risk Expenses and Costs permissions to too many RAM identitiesNext：Fine-grained access control