Use VPC together with RAM
Alibaba Cloud Resource Access Management (RAM) helps you manage user identities and permissions on resource access. If multiple employees or applications in your enterprise need to access virtual private cloud (VPC) resources, you can use RAM to manage permissions in a centralized manner and grant different access permissions as needed. Before you use RAM to manage the permissions on Alibaba Cloud services, we recommend that you learn about the features of RAM that can work with Alibaba Cloud services. This topic describes how to use RAM together with VPCs.
Overview
A policy defines a set of permissions using RAM's policy structure and syntax. Each policy specifies which resources can be accessed, which operations are allowed, and under what conditions.
Permissions
The following section describes the permissions of an Alibaba Cloud account, RAM, and resource owner.
Identity | Default permissions |
Alibaba Cloud account | Full control over all owned resources. Each resource has exactly one Alibaba Cloud account as its owner. |
RAM user | No permissions. A RAM user must be explicitly granted permissions before performing any operations. |
RAM user (as resource creator) | Creating a resource does not grant the RAM user permissions on that resource. The resource owner must explicitly attach an allow policy. |
Permission policy
A policy defines a set of permissions using RAM's policy structure and syntax. Each policy specifies which resources can be accessed, which operations are allowed, and under what conditions.
RAM supports two policy types:
System policy: Predefined and managed by Alibaba Cloud. Use these for standard access control scenarios. See CEN system policies for the full list.
Custom policy: Created by you for finer-grained control. Use these when system policies don't match your requirements. See CEN custom policies for guidance on creating them.
Attach policies to a principal
Attach one or more policies to a RAM user, RAM user group, or RAM role to grant the permissions defined in those policies. Both system policies and custom policies can be attached.
You can attach one or more permission policies to a RAM user, user group, or RAM role.
The attached policies can be either system policies or custom policies.
If an attached policy is updated, the updated policy takes effect automatically without requiring you to reattach it.