Create a RAM custom policy-Resource Access Management(RAM)-阿里云帮助中心

You can create a custom policy to implement fine-grained permission management.

Creation methods

Using the visual editor
RAM provides a WYSIWYG visual editor. You can generate a custom policy by selecting an effect, service, action, resource, and condition. A built-in intelligent validation feature helps ensure that your policy is valid and effective. This method is straightforward.
Using the script editor
RAM provides a JSON script editor. You must write the custom policy according to the policy syntax and structure. This method offers greater flexibility and is a good choice if you are familiar with policy syntax.
By importing a policy
- Import a policy template: RAM provides policy templates for common scenarios, such as for system administrators, finance staff, and network administrators. You can import a suitable policy template and make minor modifications to quickly create a custom policy.
- Import a system policy: You can import a system policy and modify it to fit your business needs. This is a convenient and fast way to create a custom policy from a standardized template.

Using the visual editor

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.
On the Create Policy page, click the Visual Editor tab.
The visual editor displays a statement form that includes the following fields: Effect (Required, can be set to Allow or Deny, default: Allow), Service (Required), Action (Required), Resource (Required), and Condition (Optional). You must select a service before you can configure Action, Resource, and Condition. At the bottom of the page, you can click Add Statement to add more statements.
Configure the policy.
To learn more about the basic elements of a policy, see Basic elements of a policy.
1. In the Effect section, select Allow or Deny.
2. In the Service section, select a service.
  Note
  The console displays the services that support the visual editor.
3. In the Action section, select All action(s) or Select action(s).
  The system automatically lists the available actions based on the service that you selected in the previous step. If you select Select action(s), you must then select the specific actions.
4. In the Resources section, select All Resources or Specified resource(s).
  The system automatically lists the available resource types based on the actions that you selected. If you select Specified resource(s), you must click Add Resource to specify the ARNs. You can use the Match All feature to quickly select all resources for a configuration item.
  Note
  The UI marks the ARNs for associated actions as Required. Specify these ARNs to ensure that the policy works correctly.
5. In the Condition section, click Add Condition to configure conditions.
  Conditions include Alibaba Cloud common conditions and service-specific conditions. The system automatically lists the available conditions based on the service and actions that you configured. Simply select a condition key and configure its value.
6. Click Add Statement and repeat the preceding steps to configure multiple statements.
At the top of the page, click Optimize, and then click Perform to perform advanced optimization on the policy.
The advanced policy optimization feature performs the following tasks:
- Splits resources or conditions for incompatible actions.
- Narrows the scope of resources.
- Removes duplicate statements or merges statements.
On the Create Policy page, click OK.
In the Create Policy dialog box, enter a policy name and Description, and then click OK.

Using the script editor

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.
On the Create Policy page, click the JSON Editor tab.
The page displays a JSON editor. The default policy template includes a Version element (set to "1") and a Statement array. Each statement includes Effect (defaults to "Allow"), Action, Resource, and Condition elements. You must populate the Action and Resource elements.
Enter the policy content.
To learn more about the policy syntax and structure, see Policy syntax and structure.
At the top of the page, click Optimize, and then click Perform to perform advanced optimization on the policy.
The advanced policy optimization feature performs the following tasks:
- Splits resources or conditions for incompatible actions.
- Narrows the scope of resources.
- Removes duplicate statements or merges statements.
On the Create Policy page, click OK.
In the Create Policy dialog box, enter a policy name and Description, and then click OK.

Common custom policy examples

The following examples demonstrate how to configure custom policies for common authorization scenarios using the script editor.

Account-level operation authorization

Account-level operations, such as creating RAM users and AccessKeys, require that you set the Resource element to "*" and set the authorization scope to Entire Alibaba Cloud Account. These operations cannot be restricted to a specific resource group.

The following example grants permissions to create RAM users and AccessKeys:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:CreateUser",
        "ram:CreateAccessKey"
      ],
      "Resource": "*"
    }
  ]
}

Important

When you attach this policy to a RAM user, you must set the authorization scope to Entire Alibaba Cloud Account. If you set the scope to a specific resource group, the policy does not take effect for account-level operations.

Allow RAM users to change their own passwords

The following example grants a RAM user the minimum permissions required to change their own logon password:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ram:ChangePassword",
      "Resource": "*"
    }
  ]
}

Important

Do not grant AliyunRAMFullAccess for this purpose. AliyunRAMFullAccess provides full administrative permissions on all RAM resources, which far exceeds the minimum privilege required for password changes.

Read-only access to specific resources

The following example grants read-only access to a specific ECS instance. Replace i-xxx with your actual instance ID.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ecs:Describe*",
      "Resource": "acs:ecs:*:*:instance/i-xxx"
    }
  ]
}

Important

In the ARN format, a forward slash (/) is required between the resource type and the resource ID. For example, use instance/i-xxx, not instancei-xxx.

Simple Log Service fine-grained authorization

The following example grants permissions to query logs and create store views in Simple Log Service. Replace exampleproject and examplelogstore with your actual project and Logstore names.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "log:GetLogStoreLogs",
        "log:CreateStoreView"
      ],
      "Resource": [
        "acs:log:*:*:project/exampleproject/logstore/examplelogstore",
        "acs:log:*:*:project/exampleproject"
      ]
    }
  ]
}

Important

If SDK calls fail with permission denied errors after you grant the preceding permissions, add log:GetProject and log:GetLogStore permissions. These are implicit dependency permissions required for the primary actions to work correctly.

Product-specific actions not available in the visual editor

Some actions are not listed in the visual editor and can only be configured using the script editor. Examples include:

Security Center: yundun-sc:DescribeCdnIpList
Milvus console access: CreateConnection, DbmConnect, and other related actions
Operation Orchestration Service (OOS): oos:StartExecution

The following example grants the permission to run OOS executions:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "oos:StartExecution",
      "Resource": "*"
    }
  ]
}

For actions that are not available in the visual editor, click the Script Editor tab and enter the action name manually.

Troubleshooting permission denied errors

When a RAM user receives an AccessForbidden error or a permission denied message in the console, follow these steps to identify and resolve the issue:

Step 1: Use the API Troubleshoot tool to identify missing permissions

Use the Alibaba Cloud API Troubleshoot tool and enter the RequestID from the failed request. The tool identifies the exact AuthAction that is missing, so that you can add the required permission to your custom policy.

Step 2: Verify the authorization scope

Ensure that the authorization scope matches the type of operation:

Account-level operations (such as ram:CreateUser): The authorization scope must be set to Entire Alibaba Cloud Account. Restricting the scope to a specific resource group causes these operations to fail.
Resource group-aware operations: Verify that the policy is attached with the correct resource group scope, or set the scope to Entire Alibaba Cloud Account.

Step 3: Check for implicit dependency permissions

Some operations require additional permissions beyond the primary action. For example:

Simple Log Service queries: In addition to log:GetLogStoreLogs, you may need log:GetProject and log:GetLogStore permissions.
Milvus console login: In addition to the primary management actions, you need CreateConnection and DbmConnect permissions.

Refer to the RAM authorization documentation for the corresponding Alibaba Cloud service to identify all required permissions.

By importing a policy

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.
On the Create Policy page, click Import Policy.
In the upper-right corner of the Import Policy dialog box, select Policy Template or System Policy from the drop-down list.
1. Select a policy template or a system policy.
2. For some policy templates, you must configure parameters based on your business requirements.
3. Select an overwrite rule for the imported policy.
  By default, the imported policy content fully overwrites the existing content. You can also select Do not overwrite, append new statements to the end.
4. Click Import.
In the visual editor or script editor, view and modify the imported policy content.
At the top of the page, click Optimize, and then click Perform to perform advanced optimization on the policy.
The advanced policy optimization feature performs the following tasks:
- Splits resources or conditions for incompatible actions.
- Narrows the scope of resources.
- Removes duplicate statements or merges statements.
On the Create Policy page, click OK.
In the Create Policy dialog box, enter a policy name and Description, and then click OK.

FAQ

Why can't I find certain permissions in the visual editor or why does saving a policy fail?

This issue can occur for the following reasons:

The action is not supported or not yet listed in the visual editor

Some newly released or low-level API actions, such as oos:StartExecution and wildcard patterns like swas-open:*, may not be available in the visual editor. The visual editor may also not properly handle wildcard patterns under certain resource restrictions. To resolve this issue, click the Script Editor tab and enter the action name manually.

The action name is misspelled

Some API action names have singular and plural differences. For example, the correct action name is ecs:ReInitDisks, not ecs:ReInitDisk. Verify the exact action name in the API reference for the corresponding Alibaba Cloud service.

The system policy is not synced

If you cannot find a specific system policy, such as AliyunAccountCenterFullAccess, locate the official JSON content of that system policy and recreate it as a custom policy using the Script Editor.

JSON format validation failure

Verify that your JSON syntax is correct. Common mistakes include:

Defining the Resource field more than once in a single statement. To specify multiple resources, list them as a JSON array within a single Resource field. For example: "Resource": ["acs:ecs:*:*:instance/i-aaa", "acs:ecs:*:*:instance/i-bbb"].
Using incorrect ARN formats. Ensure that the ARN follows the pattern acs:<service>:<region>:<account-id>:<resource-type>/<resource-id>.

Why can't I access the console or perform operations after granting FullAccess or a custom policy?

This issue can occur for the following reasons:

Console access dependency

Some product consoles require basic console access permissions, such as PowerUserAccess, in addition to business-specific permissions. Granting only a business-specific FullAccess policy may not be sufficient to load the console page. Attach the required base access policy to the RAM user.

Authorization scope mismatch

Verify that the authorization scope you selected when attaching the policy matches the Resource definition in the policy. For example, instance-level operations for services such as OceanBase require the authorization scope to be set to Entire Alibaba Cloud Account, with the policy specifying the instance ARN.

Policy priority and conflict

Check whether a Deny statement in another policy overrides the Allow permission, or whether a conflict exists between your custom policies and system policies. For complex scenarios, such as MQTT public network access, if a custom policy does not take effect, try the officially recommended system policy (such as AliyunMQFullAccess) to verify connectivity before further troubleshooting your custom policy.