DocsICP FilingConsole
Documentation
Home Page Resource Access Management Identity Permission Governance Privileged access management Avoid granting RAM important permissions to too many RAM identities

Avoid granting RAM important permissions to too many RAM identities

Updated at:
Copy as MD
Product
My Favorites

Risk description

Follow the principle of least privilege for RAM identities. Grant only necessary permissions. A RAM identity with write permissions for RAM can create new identities or modify the permissions of existing ones. This can lead to excessive authorization, which threatens the security and confidentiality of the resources in your Alibaba Cloud account.

Risk level

High-severity threat.

Best practices

The requirement is met if three or fewer RAM identities in your Alibaba Cloud account have write permissions. Examples of these permissions include ram:*, ram:Create*, ram:Update*, and ram:Delete*.

Remediation suggestions

  • For user identities, divide permissions based on job roles, such as system administrator, network administrator, database administrator, and security administrator. Create access policies for these roles by importing templates and customizing them as needed. For more information, see Create a custom policy by importing a policy template.

  • For applications, do not grant RAM-related permissions unless necessary. To grant fine-grained permissions, create custom permission policies based on the APIs and resources that the application needs to access. For more information, see Create a custom permission policy.

Remediation difficulty

Medium.

Previous：Avoid granting Admin permissions to too many RAM identitiesNext：Avoid granting high-risk Expenses and Costs permissions to too many RAM identities