If system policies do not meet your business requirements, you can create custom policies based on the principle of least privilege to manage permissions in a fine-grained manner and improve resource access security. This topic provides use scenarios and examples of custom policies for Resource Directory, Resource Group, Resource Sharing, and Resource Center.
What is a custom policy?
Resource Access Management (RAM) policies are classified into system policies and custom policies. You can manage custom policies based on your business requirements.
After you create a custom policy, you must attach the policy to a RAM user, RAM user group, or RAM role. This way, the permissions that are specified in the policy can be granted to the principal.
You can delete a RAM policy that is not attached to a principal. If the RAM policy is attached to a principal, before you can delete the RAM policy you must detach the RAM policy from the principal.
Custom policies support version control. You can manage custom policy versions based on the version management mechanism provided by RAM.
References
Authorization information
Before you create custom policies, understand the access control requirements of your business and the authorization information about Resource Management. For more information, see Authorization information about Resource Directory, Authorization information about Resource Group, Authorization information about Resource Sharing, and Authorization information about Resource Center.
Use scenarios and examples
|
Scenario |
Example |
|
Hierarchical management of resources based on a resource directory |
Perform hierarchical management of resources in a resource directory |
|
Resource group-based authentication |