Configure the logon mask and session duration for your account.
Account security best practices
Alibaba Cloud provides multiple layers of security. Combine the following measures based on your requirements.
Security measure | Core function | Use cases |
Highly recommended. Adds a dynamic verification layer beyond your password to block unauthorized access. Configures the secondary verification method used at logon (such as TOTP dynamic codes). Supports disabling SMS verification codes or switching to other methods, improving logon security and flexibility. | All accounts, especially those with critical assets. | |
Follows the principle of least privilege by creating separate Resource Access Management (RAM) users for different members and grant them limited permissions. This avoids sharing your Alibaba Cloud account credentials and effectively isolates risks. | All scenarios that involve team collaboration or permission delegation. | |
Restricts logons to specific static public IP addresses, providing a high level of access control. Incorrect configuration may lock you out of your account. Use with extreme caution. | Users with static public IP addresses and high security requirements. | |
Balances convenience with security. Shorter sessions on public devices reduce hijacking risk. | All users. Adjust based on the network environment (public or corporate). | |
To configure account protection, in the left navigation pane of the Account Center, choose .
Set an IP address whitelist for account logon (logon mask)
To achieve the highest level of logon security, you can set a logon mask (IP whitelist) to restrict account logon to specified public IP addresses or CIDR blocks. After you configure a logon mask, only requests from whitelisted IP addresses can log on to the Alibaba Cloud console.
Best practice: To prevent accidental lockouts, click Add to include a backup, trusted static IP address (such as an IP on a secondary fixed line) as an emergency access channel.
After you set a logon mask, you can log on to the Alibaba Cloud console only from the specified IP addresses or IP address ranges. All other IP addresses are blocked. Proceed with caution.
Procedure
Log on to the Alibaba Cloud Account Center. On the Security Settings page, in the Other Settings section, click Set on the Logon Mask card.
In the Logon Mask text box, enter the target IP address (for example, 192.168.0.1, which means you can log on only from this IP address), and click Save.
Logon attempts from IP addresses outside the whitelist are blocked.
Recover from an IP whitelist lockout
If an IP configuration error locks you out—for example, your public IP address changed—submit a ticket to clear all IP whitelist settings.
How to submit a ticket: Follow Virtual MFA unavailable or logon restricted by IP mask to submit an account recovery ticket.
Ticket review typically takes three business days.
Set the account session duration
The session duration controls how long your browser session stays active after you log on to the Alibaba Cloud management console. You are automatically logged out when it expires.
Default duration: The default session duration for Alibaba Cloud accounts is 48 hours. You can set the duration to a value from 1 to 72 hours.
Scope:
Applies to: Browser-based console sessions for Alibaba Cloud accounts only.
Does not apply to: RAM user logon sessions (configure separately in Manage RAM user security settings) or API/SDK calls made with an AccessKey pair.
Procedure
Log on to the Alibaba Cloud Account Center. On the Security Settings page, in the Other Settings section, click Modify on the Login Status card.
In the pop-up window, set the Logon Persistence Period and click Save.
Log on again for the setting to take effect.
FAQ
What do I do if my Alibaba Cloud account is locked and I cannot log on?
First, identify the cause of the lockout, then take the appropriate action:
IP whitelist (logon mask) lockout: If you configured a logon mask and your public IP address changed, or you added an incorrect IP range, you may be locked out by your own whitelist settings. Refer to the Recover from an IP whitelist lockout section in this topic and submit a ticket to clear the IP whitelist. Ticket review typically takes three business days.
Account suspended for other reasons: Follow the instructions provided in the "What to do if your Alibaba Cloud account is suspended?" document.