Resource Access Management:Secure your cloud resources

Avoid using the root user of an Alibaba Cloud account

When you register with Alibaba Cloud, an Alibaba Cloud account is created. Individual developers can add personal real-name verification. Enterprise accounts support real-name verification, billing, contract, and invoice information.

Each Alibaba Cloud account has a root user that logs on with the account username and password. Using the root user poses these risks:

• Full permissions exposure: The root user has full account permissions. A leaked username and password exposes all resources.

• Password leak risk: If multiple employees share the root user, each knows the account credentials, increasing leak probability.

• No audit trail: If multiple employees share the root user, individual operators cannot be identified in logs.

Creating an AccessKey pair for the root user introduces additional risks:

• Full permissions exposure: The root user AccessKey pair has full account permissions. A leak exposes all resources.

• Operational dilemma on leak: An AccessKey pair is a permanent credential. If the root user AccessKey pair is used for online workloads and gets leaked, disabling it disrupts those workloads. Leaving it active means unlimited permissions remain exposed.

To secure your Alibaba Cloud account:

• Keep the account credentials with the administrator only. Do not share them among multiple employees.

• Bind a Universal 2nd Factor (U2F) security key to the root user for an extra layer of protection beyond the account password.

• Log on with the Alibaba Cloud account credentials only when necessary.

• Avoid using the AccessKey pair of an Alibaba Cloud account.

Use RAM identities to access Alibaba Cloud

Assign RAM identities to employees and programs that need access to Alibaba Cloud resources. Create RAM users and attach policies to enforce fine-grained access control without using your Alibaba Cloud account for routine O&M. For more information, see Create a RAM user.

• Access from employees: SSO is recommended. If SSO is unavailable, bind an MFA device when enabling password-based console logon. Do not share a RAM user among multiple employees — shared credentials increase leak risks, prevent audit identification, and complicate management.

• Access from programs: STS tokens (temporary credentials) are recommended for programs deployed on Alibaba Cloud to reduce credential leak risks. For more information, see Best practices for accessing Alibaba Cloud OpenAPI. If programs are not deployed on Alibaba Cloud or AccessKey pairs are needed for development and debugging, create AccessKey pairs for RAM users. For more information, see Create a RAM user AccessKey. Each RAM user supports up to two AccessKey pairs — one for business and one for rotation. For more information, see Rotate an AccessKey for a RAM user.

Use SSO

SSO is recommended for employee access. After SSO is enabled, all internal accounts are authenticated through your enterprise identity system, and RAM users access Alibaba Cloud using their internal accounts. No passwords need to be set for RAM users in Alibaba Cloud, which reduces leak risks. For more information, see SSO overview.

Configure a password policy for RAM users

If SSO is unavailable, create RAM users for employees to log on with passwords. Configure a password policy in the RAM console to specify password length, required character types, and validity period. For more information, see Configure a password policy for RAM users. If a RAM user is authorized to change their password, they must create a strong password and rotate it regularly.

Enable MFA for RAM users

Enable MFA for RAM users to add an extra layer of protection beyond usernames and passwords.

After you enable MFA and bind an MFA device, a RAM user must provide two authentication factors when they log on to Alibaba Cloud or perform sensitive operations on the console:

1. First factor: Enter the username and password.

2. Second factor: Enter the verification code generated by a virtual MFA device or sent to a security email address, or perform passkey authentication.

From March 17, 2025, logon MFA is enabled for all RAM users by default. We recommend keeping this default to reduce password leak risks. If you do not want all RAM users to perform MFA on every console logon, set the MFA for RAM user sign-in parameter to Only when sign-in abnormally. RAM users must still bind MFA devices, but MFA is required only when Alibaba Cloud detects anomalies, reducing authentication frequency. For more information, see Bind an MFA device for a RAM user.

Use a passkey for logon

Passkeys are a secure authentication method that can replace passwords. RAM users can use passkeys for logon and MFA. For more information, see What is a passkey?. Passkeys leverage built-in device authentication — fingerprint, facial recognition, or PIN — for logon or MFA. For more information, see Register a passkey or security key.

• Passkey-based logon does not require MFA.

• Bind an MFA device as a fallback for password-based logon when the passkey is unavailable.

Group RAM users

If your account has multiple RAM users, group them by responsibility and grant permissions at the group level. For more information, see Overview, Create a RAM user group, and Grant permissions to a RAM user group.

Limit source IP addresses used for console logon

Configure network access control policies to allow only specified IP addresses or CIDR blocks to log on to the Alibaba Cloud Management Console, restricting access to trusted network environments. For more information, see Network access control.

Use temporary credentials for access from programs

An AccessKey pair (AccessKey ID + AccessKey secret) is a permanent credential for Alibaba Cloud accounts and RAM users. Improper use risks credential leaks — for example, if developers hard-code plaintext AccessKey pairs and push code to a public repository like GitHub.

Instead of permanent AccessKey pairs, assume a RAM role to obtain a temporary STS token. STS tokens automatically expire after the RAM role's maximum session duration, significantly reducing credential leak risks.

For programs deployed on Alibaba Cloud, use STS tokens instead of AccessKey pairs. For more information, see Best practices for accessing Alibaba Cloud OpenAPI.

Avoid hard-coded plaintext AccessKey pairs

If developers hard-code plaintext AccessKey pairs in code and push it to a repository like GitHub or share it, the credentials are leaked.

If an AccessKey pair is required, use the Alibaba Cloud Credentials tool, Key Management Service (KMS), or system environment variables to manage it. For more information, see Manage and use RAM secrets. If an AccessKey pair is leaked, replace it at your earliest opportunity. For more information, see Best practices for accessing Alibaba Cloud OpenAPI.

Remove RAM users and AccessKey pairs that are no longer required

If RAM users and AccessKey pairs of resigned employees or former partners are not removed, they can still access enterprise cloud resources, and credential thefts may go undetected.

From September 2024, Alibaba Cloud gradually implements automatic disabling of idle RAM users and AccessKey pairs. The feature disables eligible AccessKey pairs on a daily basis. A RAM user is idle if it has not logged on within two years. An AccessKey pair is idle if it has not been used within two years.

Limit source IP addresses used for AccessKey pair-based API calls

Configure AccessKey pair-based network access control policies to allow only specified IP addresses to call API operations, restricting API calls to trusted network environments. For more information, see Network ACL policy for AccessKey pairs.

• If an AccessKey pair is or may be leaked, configure a network access control policy to allow API calls only from trusted networks and block suspicious external calls.

• Audit network conditions for each account and configure account-level or AccessKey pair-level network access control policies to prevent suspicious external calls.