Resource Access Management:Limitations

Handling Policy Limit Exceedance

If the number of policies attached to a RAM user, RAM user group, or RAM role reaches the limit, or the content of a custom policy exceeds the character limit, use the following methods.

• Increase the quota: Log on to the Quota Center console, enter Resource Access Management as the product name, and search for Number of System Policies That a RAM Role Can Bind or Number of Custom Policies That a RAM Role Can Bind. Then submit a quota increase request.

  • By default, each RAM role can have up to 20 system policies, which can be increased to 40, and up to 10 custom policies, which can be increased to 20.

  • The maximum length of a custom policy is 6,144 characters and cannot be increased.

• Consolidate policies: On the Policies page of the RAM console, click Create Policy, switch to the Json Editor mode, and consolidate the Action elements from multiple system policies into a single custom policy. You can use wildcards, such as oss:Get*, to simplify the action list and reduce character usage.

• If a quota increase is still not enough, for example, when the number of read-only system policies that you need exceeds the increased limit, merge policies to further reduce the number of policy slots used. For example, merge the read-only permissions of API Gateway, Data Transmission Service (DTS), and Auto Scaling (ESS) into one custom policy:

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "apigateway:Describe*",
          "apigateway:List*",
          "dts:Describe*",
          "dts:List*",
          "ess:Describe*",
          "ess:List*"
        ],
        "Resource": "*"
      }
    ]
  }

  This example consolidates the read-only permissions of three services into one custom policy, which saves two policy slots compared with attaching three read-only system policies separately. The number of services that one custom policy can consolidate is not fixed. It is constrained by the character limit on the content of a custom policy, so evaluate it against the actual length of your Action list.

• Handle the character limit: The content of a custom policy cannot exceed 6,144 characters, and this limit cannot be adjusted. If the merged content still exceeds the limit, split it into multiple custom policies, or use wildcards instead of specific Action names to shorten the content.

• Coverage of ReadOnlyAccess: The system policy AliyunReadOnlyAccess uses wildcards such as *:Describe*, *:List*, *:Get*, and *:Read* to cover most read-only operations. Actions that do not follow these naming conventions, such as hbr:BrowseFiles, alikafka:DashboardList, actiontrail:Lookup*, dm:Desc*, and hbr:Search*, are not covered automatically and must be added separately to a custom policy.

• Use a single all-product read-only policy instead of one read-only policy per product: To grant a RAM user read-only permissions on all Alibaba Cloud products, attach the AliyunReadOnlyAccess system policy. For example, you do not need to separately attach the OSS and ECS read-only system policies AliyunOSSReadOnlyAccess and AliyunECSReadOnlyAccess. Attaching one policy per product quickly consumes the system policy quota, which is 20 system policies per RAM user. After the limit is reached, attaching another policy returns the LimitExceeded.User.Policy error. The single AliyunReadOnlyAccess policy covers the read-only operations of most Alibaba Cloud products and occupies only one system policy slot.