Use the following examples to create custom access control policies for your resource directory.
Deny modification and deletion of RAM users, user groups, and roles
Policy:
{
"Statement": [
{
"Action": [
"ram:Attach*",
"ram:Detach*",
"ram:BindMFADevice",
"ram:CreateAccessKey",
"ram:CreateLoginProfile",
"ram:CreatePolicyVersion",
"ram:DeleteAccessKey",
"ram:DeleteGroup",
"ram:DeleteLoginProfile",
"ram:DeletePolicy",
"ram:DeletePolicyVersion",
"ram:DeleteRole",
"ram:DeleteUser",
"ram:DisableVirtualMFA",
"ram:AddUserToGroup",
"ram:RemoveUserFromGroup",
"ram:SetDefaultPolicyVersion",
"ram:UnbindMFADevice",
"ram:UpdateAccessKey",
"ram:UpdateGroup",
"ram:UpdateLoginProfile",
"ram:UpdateRole",
"ram:UpdateUser"
],
"Resource": "*",
"Effect": "Deny",
"Condition": {
"StringNotLike": {
"acs:PrincipalARN":"acs:ram:*:*:role/resourcedirectoryaccountaccessrole"
}
}
}
],
"Version": "1"
}This policy denies modification and deletion of RAM users, user groups, and roles, and prevents permission changes.
Only ResourceDirectoryAccountAccessRole (the default role for accessing resource directory members) can perform these operations. Remove the condition to block all RAM users and RAM roles, or change the PrincipalARN value to allow specific users or roles.
Deny modification of ResourceDirectoryAccountAccessRole and its permissions
Policy:
{
"Version": "1",
"Statement": [
{
"Effect": "Deny",
"Action": [
"ram:UpdateRole",
"ram:DeleteRole",
"ram:AttachPolicyToRole",
"ram:DetachPolicyFromRole"
],
"Resource": "acs:ram:*:*:role/resourcedirectoryaccountaccessrole"
}
]
}Deny modification and deletion of specific RAM users
Policy:
{
"Version": "1",
"Statement": [{
"Action": [
"ram:AttachPolicyToUser",
"ram:DetachPolicyFromUser",
"ram:AddUserToGroup",
"ram:RemoveUserFromGroup",
"ram:UpdateUser",
"ram:DeleteUser",
"ram:CreateLoginProfile",
"ram:UpdateLoginProfile",
"ram:DeleteLoginProfile",
"ram:CreateAccessKey",
"ram:DeleteAccessKey",
"ram:UpdateAccessKey",
"ram:BindMFADevice",
"ram:UnbindMFADevice",
"ram:DisableVirtualMFA"
],
"Resource": [
"acs:ram:*:*:user/Alice"
],
"Effect": "Deny",
"Condition": {
"StringNotLike": {
"acs:PrincipalARN": "acs:ram:*:*:role/resourcedirectoryaccountaccessrole"
}
}
}]
}This policy denies modification, deletion, and permission changes for the RAM user Alice. You can scope the policy to a specific Alibaba Cloud account, such as acs:ram:*:18299873****:user/Alice.
This policy only allows the role ResourceDirectoryAccountAccessRole, which the resource directory uses by default to access member accounts, to perform this operation. You can delete the Condition to prohibit all RAM users and RAM roles from performing this operation. You can also add or modify the value of PrincipalARN to customize the restriction.
Deny enabling console logon for existing RAM users
Policy:
{
"Statement": [
{
"Action": [
"ram:CreateLoginProfile",
"ram:UpdateLoginProfile"
],
"Resource": [
"*"
],
"Effect": "Deny",
"Condition": {
"StringNotLike": {
"acs:PrincipalARN": "acs:ram:*:*:role/resourcedirectoryaccountaccessrole"
}
}
}
],
"Version": "1"
}This policy prevents console logon from being enabled for existing RAM users. New RAM users are not affected.
This policy allows only ResourceDirectoryAccountAccessRole — the role that the resource directory uses by default to access member accounts — to perform this operation. You can delete this Condition to prevent all RAM users and RAM roles from performing this operation. You can also add or modify the value of PrincipalARN to customize the restriction
Require MFA for resource deletion
Policy:
{
"Statement": [
{
"Action": "ecs:DeleteInstance",
"Effect": "Deny",
"Resource": "*",
"Condition": {
"Bool": {
"acs:MFAPresent": "false"
}
}
}
],
"Version": "1"
}This policy uses the example of requiring a RAM user or RAM role to use multi-factor authentication (MFA) when deleting an ECS instance. To delete other resources, modify the Action section of the policy to the operation of the corresponding resource.
Deny modification of user-based SSO settings
Policy:
{
"Statement": [
{
"Action": [
"ram:SetSamlSsoSettings"
],
"Resource": [
"*"
],
"Effect": "Deny",
"Condition": {
"StringNotLike": {
"acs:PrincipalARN": "acs:ram:*:*:role/resourcedirectoryaccountaccessrole"
}
}
}
],
"Version": "1"
}This policy allows only ResourceDirectoryAccountAccessRole — the role that the resource directory uses by default to access member accounts — to perform this operation. You can delete this Condition to prevent all RAM users and RAM roles from performing this operation. You can also add or modify the value of PrincipalARN to customize the restriction.
Deny modification of role-based SSO settings
Policy:
{
"Statement": [
{
"Action": [
"ram:CreateSAMLProvider",
"ram:DeleteSAMLProvider",
"ram:UpdateSAMLProvider"
],
"Resource": [
"*"
],
"Effect": "Deny",
"Condition": {
"StringNotLike": {
"acs:PrincipalARN": "acs:ram:*:*:role/resourcedirectoryaccountaccessrole"
}
}
}
],
"Version": "1"
}This policy allows only ResourceDirectoryAccountAccessRole — the role that the resource directory uses by default to access member accounts — to perform this operation. You can delete this Condition to prevent all RAM users and RAM roles from performing this operation. You can also add or modify the value of PrincipalARN to customize the restriction.
Deny disabling or modifying ActionTrail event delivery
Policy:
{
"Statement": [
{
"Action": [
"actiontrail:UpdateTrail",
"actiontrail:DeleteTrail",
"actiontrail:StopLogging"
],
"Resource": [
"*"
],
"Effect": "Deny",
"Condition": {
"StringNotLike": {
"acs:PrincipalARN": "acs:ram:*:*:role/resourcedirectoryaccountaccessrole"
}
}
}
],
"Version": "1"
}This policy allows only ResourceDirectoryAccountAccessRole — the role that the resource directory uses by default to access member accounts — to perform this operation. You can delete this Condition to prevent all RAM users and RAM roles from performing this operation. You can also add or modify the value of PrincipalARN to customize the restriction.
Deny access to specific network services
Policy:
{
"Statement": [
{
"Action": [
"vpc:*HaVip*",
"vpc:*RouteTable*",
"vpc:*VRouter*",
"vpc:*RouteEntry*",
"vpc:*VSwitch*",
"vpc:*Vpc*",
"vpc:*Cen*",
"vpc:*NetworkAcl*"
],
"Resource": "*",
"Effect": "Deny",
"Condition": {
"StringNotLike": {
"acs:PrincipalARN": "acs:ram:*:*:role/resourcedirectoryaccountaccessrole"
}
}
},
{
"Action": [
"vpc:*VpnGateway*",
"vpc:*VpnConnection*",
"vpc:*CustomerGateway*",
"vpc:*SslVpnServer*",
"vpc:*SslVpnClientCert*",
"vpc:*VpnRoute*",
"vpc:*VpnPbrRoute*"
],
"Resource": "*",
"Effect": "Deny",
"Condition": {
"StringNotLike": {
"acs:PrincipalARN": "acs:ram:*:*:role/resourcedirectoryaccountaccessrole"
}
}
}
],
"Version": "1"
}This policy denies access to VPC and VPN Gateway. To deny access to other network services, replace the Action value with the corresponding actions.
This policy allows only ResourceDirectoryAccountAccessRole — the role that the resource directory uses by default to access member accounts — to perform this operation. You can delete this Condition to prevent all RAM users and RAM roles from performing this operation. You can also add or modify the value of PrincipalARN to customize the restriction.
Deny creation of internet-facing resources (EIPs and NAT gateways)
Policy:
{
"Version": "1",
"Statement": [
{
"Action": [
"vpc:AllocateEipAddress",
"vpc:AllocateEipAddressPro",
"vpc:AllocateEipSegmentAddress",
"vpc:CreateNatGateway"
],
"Resource": [
"*"
],
"Effect": "Deny",
"Condition": {
"StringNotLike": {
"acs:PrincipalARN": "acs:ram:*:*:role/resourcedirectoryaccountaccessrole"
}
}
}
]
}This policy allows only ResourceDirectoryAccountAccessRole — the role that the resource directory uses by default to access member accounts — to perform this operation. You can delete this Condition to prevent all RAM users and RAM roles from performing this operation. You can also add or modify the value of PrincipalARN to customize the restriction.
Deny access to hybrid connectivity services
Policy:
{
"Statement": [
{
"Action": [
"vpc:*PhysicalConnection*",
"vpc:*VirtualBorderRouter*",
"cen:*",
"vpc:*VpnGateway*",
"vpc:*VpnConnection*",
"vpc:*CustomerGateway*",
"vpc:*SslVpnServer*",
"vpc:*SslVpnClientCert*",
"vpc:*VpnRoute*",
"vpc:*VpnPbrRoute*",
"smartag:*"
],
"Resource": "*",
"Effect": "Deny"
}
],
"Version": "1"
}This policy denies access to hybrid connectivity services: Express Connect, Cloud Enterprise Network (CEN), VPN Gateway, and Smart Access Gateway.
Deny access to specific Expenses and Costs features
Policy:
{
"Statement": [
{
"Action": [
"bss:DescribeOrderList",
"bss:DescribeOrderDetail",
"bss:PayOrder",
"bss:CancelOrder"
],
"Resource": "*",
"Effect": "Deny",
"Condition": {
"StringNotLike": {
"acs:PrincipalARN": "acs:ram:*:*:role/resourcedirectoryaccountaccessrole"
}
}
}
],
"Version": "1"
}This policy denies access to the Orders feature of the Expenses and Costs service. To deny other features, replace the Action value with the corresponding actions.
This policy allows only ResourceDirectoryAccountAccessRole — the role that the resource directory uses by default to access member accounts — to perform this operation. You can delete this Condition to prevent all RAM users and RAM roles from performing this operation. You can also add or modify the value of PrincipalARN to customize the restriction.
Deny modification of CloudMonitor settings
Policy:
{
"Version": "1",
"Statement": [
{
"Action": [
"cms:Put*",
"cms:Update*",
"cms:Create*",
"cms:Modify*",
"cms:Disable*",
"cms:Enable*",
"cms:Delete*",
"cms:Send*",
"cms:Subscribe*",
"cms:Unsubscribe*",
"cms:Remove*",
"cms:CreateAction",
"cms:Pause*",
"cms:Stop*",
"cms:Start*",
"cms:BatchCreate*",
"cms:ProfileSet",
"cms:ApplyMonitoringTemplate"
],
"Resource": "*",
"Effect": "Deny",
"Condition": {
"StringNotLike": {
"acs:PrincipalARN": "acs:ram:*:*:role/resourcedirectoryaccountaccessrole"
}
}
}
]
}This policy allows only ResourceDirectoryAccountAccessRole — the role that the resource directory uses by default to access member accounts — to perform this operation. You can delete this Condition to prevent all RAM users and RAM roles from performing this operation. You can also add or modify the value of PrincipalARN to customize the restriction.
Deny purchase of reserved instances
Policy:
{
"Version": "1",
"Statement": [
{
"Action": [
"ecs:PurchaseReservedInstancesOffering"
],
"Resource": "*",
"Effect": "Deny"
}
]
}Deny ECS instance creation outside a specified VPC
Policy:
{
"Version": "1",
"Statement": [
{
"Action": [
"ecs:CreateInstance",
"ecs:RunInstances"
],
"Resource": "*",
"Effect": "Deny",
"Condition": {
"StringNotLike": {
"vpc:VPC": "acs:vpc:cn-shenzhen:*:vpc/vpc-wz95ya85js0avrkabc****"
}
}
}
]
}acs:vpc:cn-shenzhen:*:vpc/vpc-wz95ya85js0avrkabc**** is the specified VPC. Replace it with your own VPC ARN.
Deny domain name purchases
Policy:
{
"Version": "1",
"Statement": [
{
"Action": [
"domain:CreateOrderActivate"
],
"Resource": "*",
"Effect": "Deny"
}
]
}Deny access to the ticket system
Policy:
{
"Version": "1",
"Statement": [
{
"Action": [
"support:*",
"workorder:*"
],
"Resource": "*",
"Effect": "Deny"
}
]
}Deny ECS access in a specific region
Policy:
{
"Version": "1",
"Statement": [{
"Effect": "Deny",
"Action": [
"ecs:*"
],
"Resource": "acs:ecs:us-east-1:*:*"
}]
}This policy denies ECS access in the US (Virginia) region.
Deny resource sharing outside the resource directory
Policy:
{
"Version": "1",
"Statement": [
{
"Effect": "Deny",
"Action": [
"resourcesharing:CreateResourceShare",
"resourcesharing:UpdateResourceShare"
],
"Resource": "*",
"Condition": {
"Bool": {
"resourcesharing:RequestedAllowExternalTargets": "true"
}
}
}
]
}This policy denies the creation of resource shares that allow sharing with accounts outside the current resource directory.
Deny resource sharing with unauthorized accounts
Policy:
{
"Version": "1",
"Statement": [
{
"Effect": "Deny",
"Action": [
"resourcesharing:AssociateResourceShare",
"resourcesharing:CreateResourceShare"
],
"Resource": "*",
"Condition": {
"StringNotLike": {
"resourcesharing:Target": [
"rd-3G****/r-Wm****/*",
"rd-3G****/r-Wm****",
"192796193830****"
]
}
}
}
]
}This policy allows resource sharing only with account 192796193830**** and all members in folder rd-3G****/r-Wm****. Adjust the resourcesharing:Target value as needed.
Deny acceptance of resource sharing invitations from external accounts
Policy:
{
"Version": "1",
"Statement": [
{
"Effect": "Deny",
"Action": "resourcesharing:AcceptResourceShareInvitation",
"Resource": "*"
}
]
}This policy denies acceptance of resource sharing invitations from accounts outside the current resource directory. Resource sharing within the same directory does not use invitations and is unaffected.
Allow sharing of specific resource types only
Policy:
{
"Version": "1",
"Statement": [
{
"Effect": "Deny",
"Action": [
"resourcesharing:CreateResourceShare",
"resourcesharing:AssociateResourceShare"
],
"Resource": "*",
"Condition": {
"StringNotEquals": {
"resourcesharing:RequestedResourceType": ["VSwitch","Image","Snapshot"]
}
}
}
]
}This policy allows sharing of only vSwitches, images, and snapshots. For resource type codes, see the Resource type column in Services that work with Resource Sharing.
Allow sharing of specific resources only
Policy:
{
"Version": "1",
"Statement": [
{
"Effect": "Deny",
"Action": [
"resourcesharing:CreateResourceShare",
"resourcesharing:AssociateResourceShare"
],
"Resource": "*",
"Condition": {
"StringNotEquals": {
"resourcesharing:ResourceArn": [
"acs:vpc:cn-shanghai:131993166204****:vswitch/vsw-7xv4sfwo86u2etl64****",
"acs:ecs:cn-shanghai:131993166204****:snapshot/s-7xviog7aq4tenbqj****"
]
}
}
}
]
}This policy allows sharing of only vSwitch vsw-7xv4sfwo86u2etl64**** and snapshot s-7xviog7aq4tenbqj**** within Alibaba Cloud account 131993166204****. For resource ARNs, see the Resource ARN column in Services that work with Resource Sharing.
Require IPAM pools for VPC creation
Policy:
{
"Statement": [
{
"Action": [
"vpc:CreateVpc",
"vpc:AssociateVpcCidrBlock"
],
"Resource": "*",
"Effect": "Deny",
"Condition": {
"Null": {
"vpc:Ipv4IpamPoolId": "true"
}
}
}
],
"Version": "1"
}This policy allows VPC creation only through IP Address Manager (IPAM) pools.
Require a specific IPAM pool for VPC creation
Policy:
{
"Statement": [
{
"Action": [
"vpc:CreateVpc",
"vpc:AssociateVpcCidrBlock"
],
"Resource": "*",
"Effect": "Deny",
"Condition": {
"ForAllValues:StringNotLikeIfExists": {
"vpc:Ipv4IpamPoolId": "ipam-pool-bp1dt0ttxkrzpq5nr****"
}
}
}
],
"Version": "1"
} This policy allows VPC creation only through IPAM pool ipam-pool-bp1dt0ttxkrzpq5nr****.