DocsICP FilingConsole
Documentation
Home Page Resource Access Management Identity Permission Governance Privileged access management Avoid granting high-risk Expenses and Costs permissions to too many RAM identities

Avoid granting high-risk Expenses and Costs permissions to too many RAM identities

Updated at:
Copy as MD
Product
My Favorites

Threat description

Follow the principle of least privilege for RAM identity permission management. Grant only the permissions that are necessary. A RAM identity with write permissions for Expenses and Costs (BSS) can modify information such as orders, invoices, contracts, and bills. The identity can also perform financial operations, such as transactions and withdrawals. Improper management of these permissions can lead to asset loss.

Risk level

High risk.

Best practices

The requirement is met if three or fewer RAM identities in your Alibaba Cloud account have write permissions. These permissions include bss:*, bssapi:*, bss:PayOrder, bss:Modify*, bss:Create*, bss:*Order*, and bss:Delete*.

Administration recommendations

  • For user identities, divide permissions based on job roles, such as system administrator, network administrator, database administrator, and security administrator. Create access policies for these roles by importing templates. Then, adjust the policies as needed. For more information, see Create a custom permission policy by importing a template.

  • For application identities, do not grant BSS-related permissions unless necessary. Create custom permission policies for fine-grained authorization based on the APIs and resources that the application needs to access. For more information, see Create a custom permission policy.

Administration difficulty

Medium.

Previous：Avoid granting RAM important permissions to too many RAM identitiesNext：Avoid granting high-risk OSS and SLS permissions to too many RAM identities