Manage RAM user permissions

Core concepts

Understand these concepts before granting permissions:

Permission policy types

A permission policy is a set of access permissions. RAM supports two types. You can attach multiple policies to a RAM user at once. Always follow the principle of least privilege.
- System policy: Predefined by Alibaba Cloud, such as AliyunECSReadOnlyAccess (read-only access to ECS) and AliyunOSSFullAccess (full access to OSS). See the System policy reference System policy reference for the complete list
- Custom policy: A policy you create for fine-grained requirements that system policies cannot satisfy. You must Create a custom policy before you can grant it. For purchasing-related permissions, see What permissions does a RAM user need to purchase resources?
Authorization behavior and limits
- Effective immediately: Permissions take effect instantly. No waiting period or re-login is required.
- Quantity limits: Each RAM user has a maximum number of attachable system and custom policies. For details, see Limitations.
- Resource group constraints: Verify that the target cloud service, operation, and resource type support resource-group-level authorization. For details, see Cloud services that support resource group-level authorization.

Grant permissions to a RAM user

Console

The RAM console offers two entry points, both supporting single and batch authorization:

Users page: The principal is auto-selected based on the users you choose. Best for user-centric workflows.
Grants page: You manually select principals and can view all authorization records across your account. Best for permission-centric workflows.

Note

Tip: For large-scale management, add RAM users with identical responsibilities to a user group, then grant permissions to the group. Navigate to Identities > User Groups to manage groups.

From the Users page

Log on to the RAM console.
In the left-side navigation pane, choose Identities > Users.
On the Users page, find the target RAM user and click Actions column > Attach Policy.

You can also select multiple RAM users and click Attach Policy below the user list for batch authorization.

In the Grant Permission panel, configure the following settings:

Resource scope:
- Account level: Permissions apply to all resources in your Alibaba Cloud account.
- Resource group level: Permissions apply only within the specified resource group. After logging on, the RAM user must switch to the authorized resource group in the top navigation bar.
  Note
  1. The system marks high-risk system policies (such as AdministratorAccess and AliyunRAMFullAccess) with a warning indicator. These policies typically grant full control over all cloud resources or full management of RAM. Grant these policies with caution.
  2. For resource group authorization examples, see Control RAM user access to specific ECS instances.
Principal:

The principal is the RAM user receiving permissions. From the Users page, the system auto-selects the current user. From the Grants page, you must manually select the user. Batch selection is supported.

Permission policy:

System policy: Search and select. Filter by product name (e.g., ECS, OSS), access level (e.g., ReadOnly, FullAccess), or full policy name.

The following table lists system policy names for commonly requested Alibaba Cloud products to help you quickly find the right policy.

Product	System policy name	Access level
CloudMonitor	`AliyunCloudMonitorReadOnlyAccess`	Read-only
China Gateway (Website Builder)	`AliyunWebsiteBuildFullAccess`	Full access
Apsara DevOps	`AliyunYunxiaoFullAccess`	Full access
Model Studio (Bailian)	`AliyunBailianFullAccess`	Full access
Alibaba Cloud DNS	`AliyunDNSFullAccess`	Full access
SSL Certificates Service	`AliyunYundunCertFullAccess`	Full access
Elastic Desktop Service	`AliyunECDFullAccess`	Full access
Support Center	`AliyunSupportFullAccess`	Full access
Resource Center	`AliyunResourceCenterFullAccess`	Full access
AgentBay	`AliyunAgentBayFullAccess`	Full access
Security Center	`AliyunYundunSASFullAccess`	Full access

If you cannot find the policy for your target product, see the System policy reference for the complete list, or create a custom policy for fine-grained access control.

Custom policy: You must Create a custom policy before you can grant it.

(Optional) Description: Enter the authorization reason or scenario for audit purposes.
Click Confirm.

Review the authorization result and click Close.

From the Grants page

Log on to the RAM console.
In the left-side navigation pane, choose Permissions > Grants.
On the Grants page, click Grant Permission.
In the Grant Permission panel, select the principal and configure the same settings as described above.
Review the authorization result and click Close.

OpenAPI

Grant a custom policy

Call CreatePolicy to create a custom policy. For policy syntax, see Permission policy elements and Overview of sample policies.
Call AttachPolicyToUser to grant the policy at the account level (set PolicyType to Custom).

Alternatively, call AttachPolicy to grant the policy at the resource group level.

Grant a system policy

Call AttachPolicyToUser to attach the system policy to the RAM user (set PolicyType to System). For available PolicyName values, see System policy reference System policy reference.
Alternatively, call AttachPolicy to grant the policy at the resource group level.

View RAM user permissions

Console

Important

The Grants page (Permissions > Grants in the left-side navigation pane) displays a history of authorization operations — records of when policies were granted or revoked. It does not show a RAM user's current effective permissions. If you recently granted permissions but cannot find them on the Grants page, or if you need the complete list of a user's current permissions, go to the user details page and click the Permissions tab as described in the following steps. The Permissions tab displays both individual permissions and permissions inherited from user groups.

Log on to the RAM console.
In the left-side navigation pane, choose Identities > Users.
On the Users page, click the target RAM user name.
Click the Permissions tab to view Individual and Group Permissions.

Note

To assess actual permission usage (last access time, idle policies, or over-privileged access), check the Permission Audit (Beta) tab on the user details page, or Access Analysis on the RAM overview page.

OpenAPI

Call ListPoliciesForUser to query the account-level authorization list for a specified RAM user. This operation does not return resource-group-level authorizations.

Revoke RAM user permissions

Note

Important: Before revoking permissions, check the Permission Audit (Beta) tab to verify the last usage time, or review Access Analysis on the RAM overview page to identify idle policies. This prevents accidentally removing active permissions.

Console

Two entry points:

Users page: Revoke policies from the user details page. Best for user-centric cleanup.
Grants page: Revoke from the full authorization records list. Best for permission-centric cleanup.

From the Users page

Log on to the RAM console.
In the left-side navigation pane, choose Identities > Users.
On the Users page, click the target RAM user name.
Click the Permissions tab. In the Individual section, find the target policy and click Actions column > Revoke Permission.
In the Revoke Permission dialog box, confirm the Principal and Permission Policy details, then click Revoke Permission.

From the Grants page

Log on to the RAM console.
In the left-side navigation pane, choose Permissions > Grants.
On the Grants page, click Actions column > Revoke Permission for the target authorization record.

You can also select multiple records and click Revoke Permission below the list for batch revocation.
In the Revoke Permission dialog box, click Revoke Permission.

OpenAPI

Call DetachPolicyFromUser to revoke a specified permission policy from a RAM user.

Security best practices

Follow the principle of least privilege. Grant only the minimum permissions required for the task.
1. Example 1: Manage specific ECS instances
  - Incorrect: Grant AdministratorAccess or AliyunECSFullAccess.
  - Correct: Create a custom policy that restricts Resource to specific instance IDs. For an example, see Allow managing a specific ECS instance.
2. Example 2: All permissions except billing
  - Incorrect: Grant AdministratorAccess.
  - Correct: Create a custom policy with an explicit deny statement for "Action": "bss:*","bssapi:*","efc:*" "Effect": "Deny". For an example, see Allow managing all resources except billing.
Audit permissions regularly. Use Governance Detection on the RAM overview page to find AccessKeys unused for 90 days and idle RAM users. Use Access Analysis (Beta) to detect over-privileged identities.
Use high-risk policies with caution. Grant AliyunRAMFullAccess and similar policies only when necessary (e.g., for RAM administrators), and monitor all operations by those users.
Prefer RAM roles for temporary access. For short-term authorization (CI/CD pipelines, cross-account access, or third-party operations), create a RAM role and use STS to issue temporary credentials instead of attaching long-lived policies to RAM users. Temporary credentials expire automatically.

FAQ

Can a RAM user view their own permissions?

No. RAM users cannot view their own permission policy list by default. Workarounds:

Trial access: Attempt the desired action. An "insufficient permissions" error indicates missing permissions.
Contact your administrator: Ask the Alibaba Cloud account owner or a RAM user with AliyunRAMFullAccess to check from the RAM console.

Can a RAM user purchase cloud products?

Yes, if the user has been granted the required purchasing permissions. See What permissions does a RAM user need to purchase resources?.

Individual spending limits or separate billing for RAM users are not supported. All charges are consolidated under the Alibaba Cloud account.

How do I grant temporary, revocable permissions to a RAM user?

Do not attach long-lived policies for temporary needs. Instead, create a RAM role with the required permissions, then have the RAM user call AssumeRole via STS to obtain time-limited credentials. For details, see Assume a RAM role.

Temporary credentials expire automatically. This approach works well for CI/CD, cross-account delegation, and third-party operations.

How do I troubleshoot "permission denied" errors for a RAM user?

Navigate to Permissions > Permission Diagnosis in the RAM console. Paste the diagnostic ciphertext (AccessDeniedDetail.EncodedDiagnosticMessage from the error response) or the Request ID, then click Start Diagnosis. The system decodes the denial reason — including the matched policy, condition, or explicit deny — to help you identify the issue.

Troubleshoot access denied errors.

What do I do if I receive a LimitExceeded.User.Policy error when granting permissions to a RAM user?

This error occurs when the RAM user has reached the maximum number of attachable permission policies. By default, each RAM user can have up to 20 system policies and 20 custom policies attached. For current quota values, see Limitations.

To resolve this issue, try one or more of the following approaches:

Consolidate policies: Remove redundant or unnecessary policies. For example, a full access policy (such as AliyunECSFullAccess) already includes all permissions of the corresponding read-only policy (AliyunECSReadOnlyAccess), so you do not need both. You can also merge multiple system policies into a single custom policy to reduce the total count.
Use user groups: Add RAM users with the same responsibilities to a user group and grant permissions to the group instead of individual users. Permissions inherited from a user group do not count toward the individual user's policy attachment quota.
Request a quota increase: Go to Quota Center and search for "Maximum number of system policies that can be attached to a RAM user" or "Maximum number of custom policies that can be attached to a RAM user" to submit a quota increase request.