If system policies cannot meet your specific requirements, create custom policies to implement the principle of least privilege — granting each RAM user, user group, or RAM role only the permissions required for their tasks.
What is a custom policy?
Resource Access Management (RAM) policies fall into two categories: system policies and custom policies. Unlike system policies, which are managed by Alibaba Cloud, custom policies are created and maintained by you.
Custom policies give you fine-grained access control over Simple Application Server resources. Key behaviors to know:
Attach before use: A custom policy takes effect only after you attach it to a RAM user, a user group, or a RAM role. Permissions are not applied until the policy is attached to a principal.
Detach before deletion: If a custom policy is attached to a principal, detach it first before deleting the policy. Policies with no attachments can be deleted directly.
Version management: Custom policies support version control. You can manage custom policy versions based on the version management mechanism provided by RAM.