Limitations

Handling quota limits for policies

If the number of policies attached to a RAM role reaches the limit, resolve the issue in the following order.

1. Apply for a quota increase: Go to Quota Center and search for "System policies per RAM role" or "Custom policies per RAM role", then submit an application. You can increase the limit for system policies from 20 to 40 and the limit for custom policies from 10 to 20. The 6,144-character limit on the content of a custom policy cannot be adjusted.

2. Consolidate policies: On the policy management page of the RAM console, click Create Policy, select the Script edit mode, and merge the actions of multiple system policies into a single custom policy. You can use wildcards (such as oss:Get*) to shorten the action list and reduce the number of characters used.

   If a quota increase is still insufficient to cover the number of system policies that you need to attach, consolidate policies to further reduce the number of policy slots used. For example, the read-only system policies that you need to attach may still exceed the increased limit of 40. The following custom policy consolidates the read-only permissions of three services:

   
   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "apigateway:Describe*",
           "apigateway:List*",
           "dts:Describe*",
           "dts:List*",
           "ess:Describe*",
           "ess:List*"
         ],
         "Resource": "*"
       }
     ]
   }
               

   This example consolidates the read-only permissions of three services into one custom policy, which saves two policy slots compared with attaching three separate read-only system policies. The number of services that a single custom policy can consolidate is not fixed, because it depends on the 6,144-character limit on the content of a custom policy. Evaluate it against the actual length of your action list.

3. Handle the character limit: The content of a custom policy cannot exceed 6,144 characters, and this limit cannot be adjusted. If a consolidated policy exceeds this limit, split it into multiple custom policies, or use wildcards instead of listing individual action names to shorten the content.

4. Coverage of AliyunReadOnlyAccess: AliyunReadOnlyAccess uses wildcards such as *:Describe*, *:List*, *:Get*, and *:Read* to cover read-only operations. Actions that do not follow this naming convention (such as hbr:BrowseFiles, alikafka:DashboardList, actiontrail:Lookup*, dm:Desc*, and hbr:Search*) are not covered automatically and must be added separately in a custom policy. If a wildcard-based policy does not grant the expected access, use the Policy Simulator to check how a specific action is evaluated. This helps you determine whether the action name does not match the wildcard or whether the action is explicitly denied. RAM evaluates a Deny statement in any effective policy before an Allow statement. Therefore, an action is still denied if a Deny statement applies to it, even when a wildcard matches the action.

5. Use a single all-product read-only policy instead of one policy per product: To grant a RAM user read-only access to all Alibaba Cloud products, attach the single AliyunReadOnlyAccess system policy instead of attaching a per-product read-only policy (such as AliyunOSSReadOnlyAccess or AliyunECSReadOnlyAccess) one by one. Attaching one policy per product quickly consumes the system policy quota (20 system policies per RAM user), and attaching another policy after the limit is reached returns a LimitExceeded.User.Policy error. The single AliyunReadOnlyAccess policy covers read-only operations for most Alibaba Cloud products and occupies only one system policy slot.