Implement access control by using RAM

Authorization policies

Prerequisites

You have logged on to the RAM console using your Alibaba Cloud account.

Procedure

In the following example, the Alibaba Cloud account creates a RAM user in the RAM console and grants user-defined or system permissions to the RAM user.

1. Create a RAM user
2. (Optional) Create a custom authorization policy
3. Authorize the RAM user

Create a RAM user

You can perform the following steps to create a RAM user in the RAM console:

1. In the left-side navigation pane, click Users under Identities.
2. Click Create User.
   Note To create multiple RAM users at a time, click Add User.
3. Specify the Logon Name and Display Name parameters.
4. Under Access Mode, select Console Password Logon or Programmatic Access.
   • Console Password Logon: If you select this check box, you must also complete the basic security settings for logon, including deciding whether to automatically generate a password or customize the logon password, whether the user must reset the password upon the next logon, and whether to enable multi-factor authentication (MFA).
   • Programmatic Access: If you select this check box, an AccessKey pair is automatically created for the RAM user. The user can access Alibaba Cloud resources by calling an API operation or by using a development tool.
   Note We recommend that you select only one access mode for the RAM users to ensure the security of your Alibaba Cloud account. This prevents RAM users who have terminated their employment contracts with the company from accessing Alibaba Cloud resources.
5. Click OK.

(Optional) Create a custom authorization policy

In addition to the system policies provided by Alibaba Cloud, you can create custom policies in the RAM console by performing the following steps:

1. In the left-side navigation pane, click Policies under Permissions.
2. On the page that appears, click Create Policy.
3. On the Create Custom Policy page, specify the Policy Name and Note parameters.
4. Set Configuration Mode. You can select Visualized or Script.
   • If you select Visualized, click Add Statement. On the page that appears, configure permissions, API operations, and resources.
   • If you select Script, edit policy scripts based on Policy structure and grammar.
   If you select Script, you must specify values of the Action and Resource parameters in Statement based on the authentication list section in Authentication rules. For more information about values of other parameters, see the following topic in RAM documentation: Policy structure and grammar.

   • The following sample policy configured using scripts allows a RAM user to create pay-as-you-go instances.

     {
         "Statement": [
             {
                 "Effect": "Allow",
                 "Action": [
                         "ecs:DescribeImages", 
                       "vpc:DescribeVpcs", 
                       "vpc:DescribeVSwitches", 
                       "ecs:DescribeSecurityGroups", 
                       "ecs:DescribeKeyPairs",
                       "ecs:DescribeTags", 
                       "ecs:RunInstances"
               ],
                 "Resource": "*"
             }
         ],
         "Version": "1"
     }

   • The following sample policy configured using scripts allows a RAM user to create subscription instances. bss-related API operations can be called to view and pay subscription orders and the corresponding system policy is AliyunBSSOrderAccess.

     {
         "Statement": [
             {
                 "Effect": "Allow",
                 "Action": [
                         "ecs:DescribeImages", 
                       "vpc:DescribeVpcs", 
                       "vpc:DescribeVSwitches", 
                       "ecs:DescribeSecurityGroups", 
                       "ecs:DescribeKeyPairs",
                       "ecs:DescribeTags", 
                       "ecs:RunInstances",
                       "bss:DescribeOrderList",
                       "bss:DescribeOrderDetail",
                       "bss:PayOrder",
                       "bss:CancelOrder"
               ],
                 "Resource": "*"
             }
         ],
         "Version": "1"
     }

   • The following sample policy configured using scripts allows a RAM user to query instance and disk information after the RAM user creates an ECS instance.

     {
         "Statement": [
             {
                 "Effect": "Allow",
                 "Action": [
                         "ecs:DescribeInstances", 
                         "ecs:DescribeDisks"
               ],
                 "Resource": "*"
             }
         ],
         "Version": "1"
     }

5. Click OK.

Authorize the RAM user

You can perform the following steps to authorize the RAM user in the RAM console:

1. In the left-side navigation pane, click Users under Identities.
2. In the User Logon Name/Display Name column, find the target RAM user.
3. Click Add Permissions. On the page that appears, the principal is automatically filled in.
4. In the Policy Name column, select the target policies by clicking the corresponding rows.
   Note You can click X in the section on the right side of the page to delete the selected policy.
5. Click OK.
6. Click Finished.