Description
Attaching RAM policies separately to users can make shared permissions and individual exceptions harder to manage. Group-based grants help keep permissions consistent for users with the same responsibilities.
Potential impact
Overlooked direct grants can leave unnecessary access after a role change or departure.
Remediation
Attach shared permissions to a RAM group and add the intended users. Verify that required access remains available before removing duplicate direct grants.
Examples
These excerpts compare direct and group attachments. Referenced users, groups, policies, and group membership settings are omitted.
Before
hcl
resource "alicloud_ram_user_policy_attachment" "attach" {
policy_name = alicloud_ram_policy.policy1.name
policy_type = alicloud_ram_policy.policy1.type
user_name = alicloud_ram_user.user1.name
}
After
hcl
resource "alicloud_ram_group_policy_attachment" "attach" {
policy_name = alicloud_ram_policy.policy2.name
policy_type = alicloud_ram_policy.policy2.type
group_name = alicloud_ram_group.group2.name
}