This topic describes how to create a custom policy. Custom policies provide more fine-grained access control than system policies.
Methods to create a custom policy
You can create a custom policy on one of the following two tabs. The elements that you configured for a custom policy on one tab are synchronized to the other tab. Therefore, you can switch between the two tabs when you create a custom policy.
- Visual Editor Beta: We recommend that you create a custom policy on this tab. This tab provides a GUI. You need only to select configuration items in the Effect, Service, Action, Resource, and Condition sections to create a custom policy. When you create a custom policy on this tab, the system checks your configurations. This ensures the validity of the custom policy. On this tab, you can perform simple operations to create a custom policy.
- JSON: This tab provides a JSON script compiler. You must compile a custom policy statement based on the syntax and structure of RAM policies. On this tab, you can create a custom policy in a flexible manner. This method is suitable for users who are familiar with the syntax and structure of RAM policies.
Before you create a custom policy, you must understand the basic elements, syntax, and structure of RAM policies. For more information, see Policy elements and Policy structure and syntax.
Create a custom policy on the Visual Editor Beta tab
- Log on to the RAM console by using your Alibaba Cloud account.
- In the left-side navigation pane, choose .
- On the Policies page, click Create Policy.
- On the Create Policy page, click the Visual Editor Beta tab.
- Configure the parameters for a custom policy and click Next Step.
- Configure the Name and Note parameters.
- Check and optimize the content of the custom policy.
- Basic optimization
The system automatically optimizes the policy statement. The system performs the following operations during basic optimization:
- Delete unnecessary conditions.
- Delete unnecessary arrays.
- Optional:Advanced optimization
You can move the pointer over Optional: Advanced Optimize and click Perform. The system performs the following operations during advanced optimization:
- Split resources or conditions that are incompatible with actions.
- Narrow down resources.
- Deduplicate or merge policy statements.
- Basic optimization
- Click OK.