What is a system policy?
A policy defines a set of permissions described by using the policy structure and syntax. Policies describe authorized resource sets, operation sets, and authorization conditions. Alibaba Cloud Resource Access Management (RAM) provides system policies and custom policies. System policies are created and maintained by Alibaba Cloud. You can use but not modify them. Custom policies can be created, updated, and deleted based on your business requirements. During service iteration, CloudShell adds new permissions to system policies to support new features and capabilities. Updates to a system policy affect all RAM identities to which the policy is attached, including RAM users, RAM user groups, and RAM roles. For more information, see Overview of RAM policies.
System policies help new users quickly get started with Alibaba Cloud products on the management console, though they also support advanced methods such as API operations or CLI commands. If you are familiar with advanced methods, we recommend that you use custom policies for finer-grained access control, thereby improving security.
System policies can be classified into service system policies, service role policies, and service-linked role policies. Some cloud services provide only one or two of these types. For more information, see the policy types described in the following section.
Service system policies
AliyunCloudShellFullAccess
The AliyunCloudShellFullAccess policy provides full access to CloudShell through the management console. You can attach this policy to RAM identities.
References
By default, RAM identities do not have any permissions. RAM identities can access cloud resources only after an account administrator grants the required permissions. To ensure resource security, we recommend that you grant only the minimum required permissions based on the principle of least privilege. For more information, see the following topics: