This topic describes how to create a custom policy. Custom policies provide more fine-grained access control than system policies.
Methods to create a custom policy
- Create a custom policy on the Visual editor tab
When you create a custom policy on the Visual editor tab, you need to select configuration items in the Effect, Service, Action, Resource, and Condition sections. Then, the system checks your configurations. This ensures the validity of the custom policy. On this tab, you can perform simple operations to create a custom policy.
- Create a custom policy on the JSON tab
When you create a custom policy on the JSON tab, you must compile a policy document based on the syntax and structure of Resource Access Management (RAM) policies. On this tab, you can create a custom policy in a flexible manner. This method is suitable for users who are familiar with the syntax and structure of RAM policies.
- Create a custom policy by importing a policy template
RAM provides policy templates that are created based on years of business practices and are suitable for common scenarios. For example, RAM provides policy templates that are applicable to system administrators, financial personnel, and network administrators. You need to only import an appropriate policy template and modify the template based on your business requirements. This way, you can create a custom policy in a convenient manner.
- Create a custom policy by importing a system policy template
You can import a system policy template and modify the policy template based on your business requirements. This way, you can create a custom policy in a convenient and efficient manner.
Create a custom policy on the Visual editor tab
- Log on to the RAM console with an Alibaba Cloud account.
- In the left-side navigation pane, choose .
- On the Policies page, click Create Policy.
- On the Create Policy page, click the Visual editor tab.
- Configure the policy and click Next to edit policy information.
- Specify the Name and Description fields.
- Check and optimize the document of the custom policy.
- Basic optimization
The system automatically optimizes the policy statement. The system performs the following operations during basic optimization:
- Deletes unnecessary conditions.
- Deletes unnecessary arrays.
- Optional:Advanced optimization
You can move the pointer over Optional advanced optimize and click Perform. The system performs the following operations during the advanced optimization:
- Splits resources or conditions that are incompatible with actions.
- Narrows down resources.
- Deduplicates or merges policy statements.
- Basic optimization
- Click OK.
Create a custom policy on the JSON tab
- Log on to the RAM console with an Alibaba Cloud account.
- In the left-side navigation pane, choose .
- On the Policies page, click Create Policy.
- On the Create Policy page, click the JSON tab.
- Enter the policy document and click Next to edit policy information. For more information about the syntax and structure of policies, see Policy structure and syntax.
- Specify the Name and Description fields.
- Check and optimize the document of the custom policy.
- Basic optimization
The system automatically optimizes the policy statement. The system performs the following operations during basic optimization:
- Deletes unnecessary conditions.
- Deletes unnecessary arrays.
- Optional:Advanced optimization
You can move the pointer over Optional advanced optimize and click Perform. The system performs the following operations during the advanced optimization:
- Splits resources or conditions that are incompatible with actions.
- Narrows down resources.
- Deduplicates or merges policy statements.
- Basic optimization
- Click OK.
Create a custom policy by importing a policy template
- Log on to the RAM console with an Alibaba Cloud account.
- In the left-side navigation pane, choose .
- On the Policies page, click Create Policy.
- On the Create Policy page, click Import policy template in the upper-right corner.
- In the Import policy template dialog box, import the policy template that you want to use.
- On the Visual editor tab or the JSON tab, view and modify the imported policy document and click Next to edit policy information. By default, the imported policy template is displayed on the Visual editor tab. This way, you can view and modify the template in a visualized manner. You can also modify the template on the JSON tab.
- Specify the Name and Description fields.
- Check and optimize the document of the custom policy.
- Basic optimization
The system automatically optimizes the policy statement. The system performs the following operations during basic optimization:
- Deletes unnecessary conditions.
- Deletes unnecessary arrays.
- Optional:Advanced optimization
You can move the pointer over Optional advanced optimize and click Perform. The system performs the following operations during the advanced optimization:
- Splits resources or conditions that are incompatible with actions.
- Narrows down resources.
- Deduplicates or merges policy statements.
- Basic optimization
- Click OK.
Create a custom policy by importing a system policy template
- Log on to the RAM console with an Alibaba Cloud account.
- In the left-side navigation pane, choose .
- On the Policies page, click Create Policy.
- On the Create Policy page, click Import system policy in the upper-right corner.
- In the Import system policy dialog box, import a system policy template.
- On the Visual editor tab or the JSON tab, view and modify the policy document of the imported system policy template and click Next to edit policy information. By default, the imported system policy template is displayed on the Visual editor tab. This way, you can view and modify the system policy template in a visualized manner. You can also modify the system policy on the JSON tab.
- Specify the Name and Description fields.
- Check and optimize the document of the custom policy.
- Basic optimization
The system automatically optimizes the policy statement. The system performs the following operations during basic optimization:
- Deletes unnecessary conditions.
- Deletes unnecessary arrays.
- Optional:Advanced optimization
You can move the pointer over Optional advanced optimize and click Perform. The system performs the following operations during the advanced optimization:
- Splits resources or conditions that are incompatible with actions.
- Narrows down resources.
- Deduplicates or merges policy statements.
- Basic optimization
- Click OK.