Resource Access Management:Create a RAM role and attach the required policies to the role

Step 1: Create a RAM role

The methods that you can use to create a RAM role vary based on the type of the RAM role. The following example describes how to create a RAM role whose trusted entity is an Alibaba Cloud account. For more information, see Create a RAM role for a trusted Alibaba Cloud account, Create a RAM role for a trusted Alibaba Cloud service, and Create a RAM role for a trusted IdP.

Step 2: (Optional) Create a custom policy

RAM provides system policies and custom policies. System policies are provided by Alibaba Cloud and cannot be modified. If system policies cannot meet your business requirements, you can create a custom policy to implement fine-grained access control.

You can create a custom policy by using different methods. In this example, a custom policy is created on the Visual editor tab. For more information, see Create a custom policy.

1. Log on to the RAM console by using an Alibaba Cloud account or a RAM user that has administrative rights.

2. In the left-side navigation pane, choose Permissions > Policies

3. On the Policies page, click Create Policy.

4. On the Create Policy page, click the Visual editor tab.

5. Configure the policy and click Next to edit policy information.

   1. In the Effect section, select Allow or Deny.

   2. In the Service section, select an Alibaba Cloud service.

      Note

      The Alibaba Cloud services that you can select are displayed in the Service section.

   3. In the Action section, select All action(s) or Select action(s).

      The system displays the actions that can be configured based on the Alibaba Cloud service you select in the previous step. If you select Select action(s), you must select actions.

   4. In the Resource section, select All resource(s) or Specified resource(s).

      The system displays the resources that can be configured based on the actions you select in the previous step. If you select Specified resource(s), you must click Add resource to configure one or more Alibaba Cloud Resource Names (ARNs) of resources. You can also click Match all to select all resources for each action that you select.

      Note

      The resource ARNs that are required for an action are tagged with Required. We strongly recommend that you configure the resource ARNs that are tagged with Required. This ensures that the custom policy takes effect as expected.

   5. In the Condition section, click Add condition to configure a condition.

      Conditions include Alibaba Cloud common conditions and service-specific conditions. The system displays the conditions that can be configured based on the Alibaba Cloud service and the actions that you select. You need to only select a condition key and configure the Operator and Value parameters.

   6. Click Add statement and repeat the preceding steps to configure multiple custom policy statements.

6. Specify the Name and Description fields.

7. Check and optimize the content of the custom policy.

   • Basic optimization

     The system automatically optimizes the policy statement. The system performs the following operations during basic optimization:

     • Deletes unnecessary conditions.

     • Deletes unnecessary arrays.

   • (Optional) Advanced optimization

     You can move the pointer over Optional: advanced optimize and click Perform. The system performs the following operations during the advanced optimization:

     • Splits resources or conditions that are incompatible with actions.

     • Narrows down resources.

     • Deduplicates or merges policy statements.

8. Click OK.

Step 3: Grant permissions to the RAM role

When you grant permissions to a RAM role, we recommend that you grant only the required permissions to the RAM role based on the principle of least privilege.

1. Log on to the RAM console by using an Alibaba Cloud account or a RAM user that has administrative rights.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, find the RAM role to which you want to grant permissions, and click Add Permissions in the Actions column.

4. In the Add Permissions panel, grant permissions to the RAM role.

   1. Set the authorization scope.

      • Alibaba Cloud Account: The authorization takes effect on the current Alibaba Cloud account.

      • Specific Resource Group: The authorization takes effect on a specific resource group.

        Note

        If you select Specific Resource Group for Authorized Scope, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group.

   2. Specify the principal.

      The principal is the RAM role to which permissions are granted. By default, the current RAM role is specified. You can also specify a different RAM role.

   3. Select policies.

      Note

      You can attach a maximum of five policies to a RAM role at a time. If you need to attach more than five policies to a RAM role, perform the operation multiple times.

5. Click OK.

6. Click Complete.

Step 4: Assume the RAM role to access Alibaba Cloud by using a trusted entity

1. Obtain an STS token for the RAM role in the Alibaba Cloud Management Console or by calling an operation. For more information, see the following topics:

   • Use the Alibaba Cloud Management Console

   • Call an operation

2. Assume the RAM role to access specific Alibaba Cloud resources.