Alibaba Cloud assigns each account a unique 16-digit identifier, such as 0123456789012345. This identifier is called an account ID, also known as a UID. The account ID is the primary identifier for resource ownership, billing, and permission management on Alibaba Cloud. It is essential for automated operations and maintenance (O&M), permission management, and cross-account collaboration. This topic describes how to find your account ID.
An account ID is used to verify your identity. Although it is not confidential information such as a password or an AccessKey, you should still use and share it with caution.
Account ID Scenarios
You can use your account ID to specify your identity and resource ownership in the following scenarios:
Billing and bill analysis: In the details of a downloaded bill, fields such as
ResourcePurchaseAccountIdandResourceOwnerAccountIdidentify the account ID for resource purchases or resource ownership.Calling cloud product APIs: When you perform cross-account resource operations, some cloud product APIs require you to pass the account ID as a parameter, such as
OwnerIdorOwnerAccount.Cross-account resource access: In scenarios such as sharing a VPC or configuring a VPC peering connection, the account ID is the unique identifier used to specify the authorization object.
RAM cross-account authorization: When you grant permissions to another Alibaba Cloud account, specify the other account's ID in the
Principalfield of the access policy.Building an Alibaba Cloud Resource Name (ARN): An ARN is a global resource name that Alibaba Cloud defines for each resource. It includes the account ID and is used to precisely locate a resource across all regions. For example:
ECS instance ARN:
acs:ecs:{#regionId}:{#accountId}:instance/{#instanceId}OSS bucket ARN:
acs:oss:<region>:<account-id>:<relative-id>
View your account ID
You can obtain your account ID from the console or using an API, depending on your scenario. The information displayed varies based on your logon identity. The following sections describe how to find the ID when you are logged in as an Alibaba Cloud account, a Resource Access Management (RAM) user, or a RAM role.
Console
Alibaba Cloud account logon
Log in to the console as an Alibaba Cloud account. Hover over your profile picture in the upper-right corner. Your account ID is displayed.
RAM user logon
Log in to the console as a RAM user. Hover over your profile picture in the upper-right corner. The ID of your Alibaba Cloud account is displayed.
Assume a RAM role
Log in to the console by assuming a RAM role. Hover over your profile picture in the upper-right corner. The ID of your Alibaba Cloud account is displayed.
OpenAPI
Call the GetCallerIdentity API to obtain the account ID for the current caller. The API returns a JSON object that contains your identity information. The AccountId field contains the Alibaba Cloud account ID. The returned fields vary based on the caller's identity. The following table describes the key fields in the response:
Key returned API field | Alibaba Cloud account | RAM user | RAM role |
IdentityType | Account | RAMUser | AssumedRoleUser |
AccountId | Your account ID | The ID of the Alibaba Cloud account | The ID of the Alibaba Cloud account |
UserId / RoleId | Same as AccountId | The ID of the RAM user | The ID of the RAM role |
PrincipalId | Same as AccountId | Same as UserId | RoleId:SessionName |
Comparison of account ID and logon name
These two concepts are often confused. Be sure to distinguish between them:
Item | Account ID | Logon name |
Essence | Identity identifier | Logon credential |
Form | A unique, system-generated 16-digit number string | The email address that you use to log on |
Mutability | Cannot be changed | Can be changed. Changing the logon name does not affect the account ID. |
Purpose | Machine identification, access policies, API calls, and bill ownership | Used only for manually logging on to the console |
When you write automation scripts, code, or access policies, you must use the permanent account ID to identify the account. Do not use the logon name, which can be changed.