What is a system policy?
A policy defines a set of permissions that are described based on the policy structure and syntax. You can use policies to describe the authorized resource sets, authorized operation sets, and authorization conditions. Alibaba Cloud Resource Access Management (RAM) provides system policies and custom policies. All system policies are created and updated by Alibaba Cloud. You can use system policies, but you cannot modify them. You can manage and update custom policies based on your business requirements. You can create, update, and delete custom policies. During service iteration, SFM adds new permissions to system policies to support new features and capabilities. The update of a system policy affects all RAM identities to which the policy is attached, including RAM users, RAM user groups, and RAM roles. For more information about RAM policies, see Overview of RAM policies.
NoteSystem policies are designed for new users to quickly get started with Alibaba Cloud products on the management console, though they also enable the use of more advanced methods like API operations or CLI commands. If you are familiar with the advanced methods, we recommend that you use custom policies to implement finer-grained control on who is permitted to call what API operations, thereby improving security.
System policies can be classified into service system policies, service role policies, and service-linked role policies. Some cloud services provide only one or two of the three types of policies. For more information, see the policy types that are described in the following section.
Service system policies
AliyunBailianDataFullAccess
The AliyunBailianDataFullAccess policy: Provides full access to bailian data(BailianData) via Management Console. It can be attached to RAM identities.
AliyunBailianDataReadOnlyAccess
The AliyunBailianDataReadOnlyAccess policy: Provides read-only access to the Bailian data (BailianData) and basic model experience capabilities (creating inference sessions, stopping generation) via Management Console. It can be attached to RAM identities.
AliyunBailianDataReadOnlyAccess
AliyunBailianFullAccess
The AliyunBailianFullAccess policy: Provides full access to bailian (Bailian) via Management Console. It can be attached to RAM identities.
AliyunBailianReadOnlyAccess
The AliyunBailianReadOnlyAccess policy: Provides read-only access to bailian (Bailian) via Management Console. It can be attached to RAM identities.
Service role policies
AliyunOpentrekManagerRolePolicy
The AliyunOpentrekManagerRolePolicy policy is the dedicated authorization policy of the AliyunOpentrekManagerRole service role. By default, SFM will use this role to access your resources in other services. Do not attach this policy to a RAM identity other than the service role. If a service provides precise authorization capabilities, refer to the documentation provided by the service.
AliyunOpentrekManagerRolePolicy
Service-linked role policies
AliyunServiceRolePolicyForAIMiaoBiAccessingOss
SFM assumes the AliyunServiceRolePolicyForAIMiaoBiAccessingOss service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForAIMiaoBiAccessingOss policy is the dedicated authorization policy of the AliyunServiceRoleForAIMiaoBiAccessingOss service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForAIMiaoBiAccessingOss
AliyunServiceRolePolicyForAccessCusOss
SFM assumes the AliyunServiceRolePolicyForAccessCusOss service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForAccessCusOss policy is the dedicated authorization policy of the AliyunServiceRoleForAccessCusOss service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForAccessCusOss
AliyunServiceRolePolicyForAccessDMS
SFM assumes the AliyunServiceRolePolicyForAccessDMS service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForAccessDMS policy is the dedicated authorization policy of the AliyunServiceRoleForAccessDMS service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForAccessDMS
AliyunServiceRolePolicyForAccessOSS
SFM assumes the AliyunServiceRolePolicyForAccessOSS service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForAccessOSS policy is the dedicated authorization policy of the AliyunServiceRoleForAccessOSS service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForAccessOSS
AliyunServiceRolePolicyForBackrouterAccessNet
SFM assumes the AliyunServiceRolePolicyForBackrouterAccessNet service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForBackrouterAccessNet policy is the dedicated authorization policy of the AliyunServiceRoleForBackrouterAccessNet service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForBackrouterAccessNet
AliyunServiceRolePolicyForDataAnalysisGBIAccessingAdb
SFM assumes the AliyunServiceRolePolicyForDataAnalysisGBIAccessingAdb service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForDataAnalysisGBIAccessingAdb policy is the dedicated authorization policy of the AliyunServiceRoleForDataAnalysisGBIAccessingAdb service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForDataAnalysisGBIAccessingAdb
AliyunServiceRolePolicyForQuanMiaoAccessingIMS
SFM assumes the AliyunServiceRolePolicyForQuanMiaoAccessingIMS service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForQuanMiaoAccessingIMS policy is the dedicated authorization policy of the AliyunServiceRoleForQuanMiaoAccessingIMS service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForQuanMiaoAccessingIMS
AliyunServiceRolePolicyForSFMAccessACK
SFM assumes the AliyunServiceRolePolicyForSFMAccessACK service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessACK policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessACK service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessACK
AliyunServiceRolePolicyForSFMAccessACR
SFM assumes the AliyunServiceRolePolicyForSFMAccessACR service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessACR policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessACR service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessACR
AliyunServiceRolePolicyForSFMAccessApiGateway
SFM assumes the AliyunServiceRolePolicyForSFMAccessApiGateway service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessApiGateway policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessApiGateway service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessApiGateway
AliyunServiceRolePolicyForSFMAccessAppFlow
SFM assumes the AliyunServiceRolePolicyForSFMAccessAppFlow service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessAppFlow policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessAppFlow service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessAppFlow
AliyunServiceRolePolicyForSFMAccessCMS
SFM assumes the AliyunServiceRolePolicyForSFMAccessCMS service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessCMS policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessCMS service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessCMS
AliyunServiceRolePolicyForSFMAccessCloudAPI
SFM assumes the AliyunServiceRolePolicyForSFMAccessCloudAPI service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessCloudAPI policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessCloudAPI service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessCloudAPI
AliyunServiceRolePolicyForSFMAccessEB
SFM assumes the AliyunServiceRolePolicyForSFMAccessEB service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessEB policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessEB service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessEB
AliyunServiceRolePolicyForSFMAccessICE
SFM assumes the AliyunServiceRolePolicyForSFMAccessICE service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessICE policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessICE service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessICE
AliyunServiceRolePolicyForSFMAccessIQS
SFM assumes the AliyunServiceRolePolicyForSFMAccessIQS service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessIQS policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessIQS service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessIQS
AliyunServiceRolePolicyForSFMAccessKMS
SFM assumes the AliyunServiceRolePolicyForSFMAccessKMS service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessKMS policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessKMS service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessKMS
AliyunServiceRolePolicyForSFMAccessOSS
SFM assumes the AliyunServiceRolePolicyForSFMAccessOSS service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessOSS policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessOSS service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessOSS
AliyunServiceRolePolicyForSFMAccessPolarDBX
SFM assumes the AliyunServiceRolePolicyForSFMAccessPolarDBX service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessPolarDBX policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessPolarDBX service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessPolarDBX
AliyunServiceRolePolicyForSFMAccessRDS
SFM assumes the AliyunServiceRolePolicyForSFMAccessRDS service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessRDS policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessRDS service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessRDS
AliyunServiceRolePolicyForSFMAccessSLS
SFM assumes the AliyunServiceRolePolicyForSFMAccessSLS service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessSLS policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessSLS service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessSLS
AliyunServiceRolePolicyForSFMAccessingCIP
SFM assumes the AliyunServiceRolePolicyForSFMAccessingCIP service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessingCIP policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessingCIP service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessingCIP
AliyunServiceRolePolicyForSFMAccessingMNS
SFM assumes the AliyunServiceRolePolicyForSFMAccessingMNS service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMAccessingMNS policy is the dedicated authorization policy of the AliyunServiceRoleForSFMAccessingMNS service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMAccessingMNS
AliyunServiceRolePolicyForSFMConnectorAccessDTS
SFM assumes the AliyunServiceRolePolicyForSFMConnectorAccessDTS service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMConnectorAccessDTS policy is the dedicated authorization policy of the AliyunServiceRoleForSFMConnectorAccessDTS service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMConnectorAccessDTS
AliyunServiceRolePolicyForSFMFineTuning
SFM assumes the AliyunServiceRolePolicyForSFMFineTuning service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMFineTuning policy is the dedicated authorization policy of the AliyunServiceRoleForSFMFineTuning service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMFineTuning
AliyunServiceRolePolicyForSFMModelDeveloper
SFM assumes the AliyunServiceRolePolicyForSFMModelDeveloper service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMModelDeveloper policy is the dedicated authorization policy of the AliyunServiceRoleForSFMModelDeveloper service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMModelDeveloper
AliyunServiceRolePolicyForSFMTelemetry
SFM assumes the AliyunServiceRolePolicyForSFMTelemetry service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForSFMTelemetry policy is the dedicated authorization policy of the AliyunServiceRoleForSFMTelemetry service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForSFMTelemetry
AliyunServiceRolePolicyForsfmaccessdts
SFM assumes the AliyunServiceRolePolicyForsfmaccessdts service-linked role to access the resources in other cloud services. The AliyunServiceRolePolicyForsfmaccessdts policy is the dedicated authorization policy of the AliyunServiceRoleForsfmaccessdts service-linked role. This policy is defined and used by SFM. You cannot modify or delete the policy. Do not attach this policy to a RAM identity other than the service-linked role.
AliyunServiceRolePolicyForsfmaccessdts
References
By default, RAM identities do not have any permissions. RAM identities can access cloud resources within an Alibaba Cloud account only after an account administrator grants the required permissions to the RAM identities. To ensure resource security, we recommend that you grant only the required permissions to the RAM identities based on the principle of least privilege. For more information, see the following topics: