Restrict authorization for RAM identities to resource groups by using service-level system policies
Threat description
For permission management of Resource Access Management (RAM) identities, follow the principle of least privilege. Grant only the required permissions. You can divide cloud resources into resource groups based on dimensions, such as applications and environments. Grant permissions based on resource groups to narrow the permission scope and avoid threats that arise from excessive permissions.
Risk Level
Medium.
Best practices
A RAM identity in your Alibaba Cloud account is considered compliant if it is granted a service-level system policy, such as AliyunECSFullAccess, and its authorization scope is limited to a resource group.
Administration recommendations
Plan your resource groups based on dimensions, such as applications and environments.
For more information, see Create a resource group.
Grant permissions to the RAM identity. Set the resource scope to Resource Group Level and select a service-level system policy, such as AliyunECSFullAccess.
For more information, see Grant permissions to a RAM identity on a resource group.
Remove the service-level system policies granted to the RAM identity at the Account Level.
For more information, see Remove permissions from a RAM user, Remove permissions from a RAM role, or Remove permissions from a RAM user group.
Verify that the permissions of the RAM identity are effective within the corresponding resource group.
Administration difficulty
Administration can be complex.