Limitations

Handle exceeded policy limits

If the number of policies attached to a RAM user, RAM user group, or RAM role reaches the limit, or the content of a custom policy exceeds the character limit, use the following methods. Apply for a quota increase first for the limits that support it, and merge or shorten policies when the increase is not enough or the limit cannot be adjusted.

• Increase the quota: Go to Quota Center, search for "Number of system policies that can be attached to a RAM role" or "Number of custom policies that can be attached to a RAM role", and submit a quota increase request. You can increase the system policy limit from 20 to 40 and the custom policy limit from 10 to 20.

• Merge policies: On the policy management page of the RAM console, click Create Policy, switch to Script edit mode, and merge the Actions of multiple system policies into one custom policy. You can use wildcards such as oss:Get* to simplify the Action list and reduce the number of characters.

  If a quota increase is still not enough, for example, when the number of read-only system policies that you need exceeds the increased limit, merge policies to further reduce the number of policy slots used. For example, merge the read-only permissions of API Gateway, Data Transmission Service (DTS), and Auto Scaling (ESS) into one custom policy:

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "apigateway:Describe*",
          "apigateway:List*",
          "dts:Describe*",
          "dts:List*",
          "ess:Describe*",
          "ess:List*"
        ],
        "Resource": "*"
      }
    ]
  }

  This example consolidates the read-only permissions of three services into one custom policy, which saves two policy slots compared with attaching three read-only system policies separately. The number of services that one custom policy can consolidate is not fixed. It is constrained by the character limit on the content of a custom policy, so evaluate it against the actual length of your Action list.

• Handle the character limit: The content of a custom policy cannot exceed 6,144 characters, and this limit cannot be adjusted. If the merged content still exceeds the limit, split it into multiple custom policies, or use wildcards instead of specific Action names to shorten the content.

• Coverage of ReadOnlyAccess: The system policy AliyunReadOnlyAccess uses wildcards such as *:Describe*, *:List*, *:Get*, and *:Read* to cover most read-only operations. Actions that do not follow these naming conventions, such as hbr:BrowseFiles, alikafka:DashboardList, actiontrail:Lookup*, dm:Desc*, and hbr:Search*, are not covered automatically and must be added separately to a custom policy.

• Use a single all-product read-only policy instead of one read-only policy per product: To grant a RAM user read-only permissions on all Alibaba Cloud products, attach the AliyunReadOnlyAccess system policy. For example, you do not need to separately attach the OSS and ECS read-only system policies AliyunOSSReadOnlyAccess and AliyunECSReadOnlyAccess. Attaching one policy per product quickly consumes the system policy quota, which is 20 system policies per RAM user. After the limit is reached, attaching another policy returns the LimitExceeded.User.Policy error. The single AliyunReadOnlyAccess policy covers the read-only operations of most Alibaba Cloud products and occupies only one system policy slot.