Evaluates whether RAM users have system administrator permissions, Alibaba Cloud service administrator permissions, or equivalent permissions inherited from a user group. A RAM user without any of these permissions is evaluated as Compliant.
Scenarios
Use this rule to enforce the principle of least privilege (PoLP) for RAM users and prevent security risks caused by excessive permissions.
Risk level
Default risk level: medium.
You can change the risk level based on your business requirements.
Compliance evaluation logic
- If a RAM user does not have system administrator permissions, Alibaba Cloud service administrator permissions, or equivalent permissions inherited from a user group, the evaluation result is Compliant.
- If a RAM user has system administrator permissions or Alibaba Cloud service administrator permissions, the evaluation result is Incompliant. If the RAM user does not have system administrator permissions or Alibaba Cloud service administrator permissions, but has permissions inherited from a user group, the evaluation result is also Incompliant. For more information about how to remediate an incompliant configuration, see Incompliance remediation.
Rule details
| Item | Description |
| Rule name | ram-user-no-product-admin-access |
| Rule identifier | ram-user-no-product-admin-access |
| Tag | RAM and User |
| Automatic remediation | Not supported |
| Trigger type | Periodic execution |
| Evaluation frequency | Interval of 24 hours |
| Supported resource type | RAM user |
| Input parameter | None. |
Incompliance remediation
Modify a custom policy. For more information, see Modify a custom policy.