All Products
Document Center

Create and grant permissions to RAM user groups

Last Updated: Nov 12, 2020

This topic describes how to create and grant permissions to the RAM user groups CloudAdminGroup, SystemAdminGroup, BillingAdminGroup, and CommonUserGroup.

  1. Log on to the RAM console as the admin user.

  2. In the left-side navigation pane, click Groups under Identities.

  3. On the Groups page, click Create Group.

  4. In the Create Group panel, enter CloudAdminGroup in Group Name and cloud admin group in Display Name.

  5. Click OK.

  6. Now the RAM user group CloudAdminGroup is created.

  7. Click Close.

  8. In the Group Name/Display Name column, find the CloudAdminGroup group.

  9. In the Actions column, click Add Permissions. In the Add Permissions panel, the Principal field is automatically filled in.

  10. In the Authorization Policy Name column, select AdministratorAccess and click OK.

  11. In the Add Permissions panel, click Complete.

  12. Repeat the preceding steps to create the SystemAdminGroup, BillingAdminGroup, and CommonUserGroup groups and grant the groups the following permissions:

    • SystemAdminGroup: Create a custom policy named SystemAdministratorAccess. For more information, see Create custom policies for system administrators.

    • BillingAdminGroup: Select the AliyunBSSFullAccess and AliyunFinanceConsoleFullAccess system policies.

    • CommonUserGroup: Do not grant permissions.