Resource Access Management:Policy evaluation process

Overview

Alibaba Cloud provides multiple types of policies. A complete policy evaluation process includes the following steps:

1. Alibaba Cloud collects all types of policies that are involved in the access request. The policies include control policies, session policies, identity-based policies, and resource-based policies.

2. Alibaba Cloud evaluates policies in sequence. For more information, see the Basic evaluation process section of this topic. After Alibaba Cloud evaluates a policy, Alibaba Cloud decides whether to evaluate the next policy based on the decision. The evaluation continues until a final decision is obtained.

Basic evaluation process

All types of policies are evaluated based on the basic evaluation process, as shown in the following figure.

The basic evaluation process includes the following steps:

1. Alibaba Cloud first checks whether a policy that is involved in a request includes a Deny statement. This is because Deny statements take precedence over Allow statements in policy evaluation.

   • If the policy includes a Deny statement, the evaluation ends. Explicit Deny is returned.

   • If the policy does not include a Deny statement, the evaluation continues.

2. Alibaba Cloud checks whether the policy includes an Allow statement.

   • If the policy includes an Allow statement, the evaluation ends. Allow is returned.

   • If the policy does not include an Allow statement, the evaluation ends. Implicit Deny is returned.

The following table describes the possible decisions.

Standard evaluation process

A standard evaluation process includes the following steps:

1. Control policy evaluation

   Control policies allow you to manage the permission boundaries of the members in a resource directory. If you want to access the resources of a member in a resource directory and a control policy exists, Alibaba Cloud evaluates the control policy based on the basic evaluation process. For more information, see the Basic evaluation process section of this topic. Otherwise, this step is skipped.

   Alibaba Cloud decides whether to evaluate the next policy based on the decision:

   • If Explicit Deny or Implicit Deny is returned, the evaluation ends. The returned decision is the final decision.

   • If Allow is returned, the evaluation continues.

   Important

   The access control policies that are configured within a resource directory also take effect for all the RAM users and RAM roles within the related members in the resource directory. However, the policies do not take effect for the root users of the members. In addition, the management account of a resource directory is outside the resource directory. It does not belong to the resource directory. Therefore, the access control policies also do not take effect on all identities within the management account.

2. Session policy evaluation

   Session policies are policies that you pass as parameters when you programmatically create a temporary session for a RAM role. To programmatically create a role session, call the AssumeRole operation. If a RAM role initiates an access request and a session policy exists, Alibaba Cloud evaluates the session policy based on the basic evaluation process. For more information, see the Basic evaluation process section of this topic. Otherwise, this step is skipped.

   Alibaba Cloud decides whether to evaluate the next policy based on the decision:

   • If Explicit Deny or Implicit Deny is returned, the evaluation ends. The returned decision is the final decision.

   • If Allow is returned, the evaluation continues.

3. Identity-based and resource-based policy evaluation

   Identity-based policies and resource-based policies are evaluated at the same time. Decisions are temporarily saved and then combined at a later time.

   • Identity-based policy evaluation

     For a RAM user, identity-based policies include the policies attached to the RAM usage and the policies inherited from the group to which the RAM user belongs. For a RAM role, identity-based policies are the policies attached to the RAM role. Identity-based policies are classified into account-class identity-based policies and resource group-class identity-based policies. The two classifications have different authorization granularities. During evaluation, account-class identity-based policies have a higher priority than resource group-class identity-based policies.

     The following evaluation process is used to evaluate identity-based policies:

     1. Alibaba Cloud checks whether the RAM identity that initiates the access request has an account-class identity-based policy.

        • If an account-class identity-based policy exists, Alibaba Cloud evaluates the policy based on the basic evaluation process. For more information, see the Basic evaluation process section of this topic. Alibaba Cloud decides whether to evaluate the next policy based on the decision:

          • If Explicit Deny or Allow is returned, the evaluation ends. The returned decision is temporarily saved as Decision A.

          • If Implicit Deny is returned, the evaluation continues.

        • If no account-class identity-based policies exist, the evaluation continues.

     2. Alibaba Cloud checks whether the RAM identity that initiates the access request has a resource group-class identity-based policy.

        • If a resource group-class identity-based policy exists, Alibaba Cloud evaluates the policy based on the basic evaluation process. For more information, see the Basic evaluation process section of this topic. The returned decision is temporarily saved as Decision A.

        • If no resource group-class identity-based policies exist, Implicit Deny is saved as Decision A.

   • Resource-based policy evaluation

     Alibaba Cloud checks whether the resources to be accessed have a resource-based policy.

     • If a resource-based policy exists, Alibaba Cloud evaluates the policy based on the basic evaluation process. For more information, see the Basic evaluation process section of this topic. The returned decision is temporarily saved as Decision B.

     • If no resource-based policies exist, Implicit Deny is saved as Decision B.

     Note

     Alibaba Cloud provides bucket policies for OSS buckets and trust policies for RAM roles. If the resources to be accessed are not OSS buckets or RAM roles, this step is skipped. The returned decision of the identity-based policy is considered as the final decision.

4. Combination of decisions

   Alibaba Cloud combines Decision A and Decision B. The following logic is used to combine the decisions:

   • If an Explicit Deny decision is returned, the final decision is Explicit Deny. The evaluation ends.

   • If an Allow decision is returned, the final decision is Allow. The evaluation ends.

   • If neither an Explicit Deny nor an Allow decision is returned, the final decision is Implicit Deny. The evaluation ends.

   Note

   • Except for the preceding logic, the combination logic also depends on the cloud service to which the resources to be accessed belong. For information about exceptions, see Policy evaluation process of assuming a RAM role.

   • If the resources to be accessed belong to OSS, the bucket access control list (ACL) or object ACL is evaluated after policies are evaluated. For more information, see Authentication.

   If the final decision is Allow, the request is allowed. If the final decision is Explicit Deny or Implicit Deny, the request is denied.