ApsaraMQ for RabbitMQ uses two-step authentication: AccessKey pair-based identity verification, followed by Resource Access Management (RAM)-based permission checks.
AccessKey pair-based identity authentication
ApsaraMQ for RabbitMQ performs AccessKey pair-based identity verification only during connection establishment. If an AccessKey pair expires after a connection is established, subsequent operations are not affected.
RAM-based permission authentication
After identity verification, ApsaraMQ for RabbitMQ checks RAM user permissions when you send messages, declare queues and exchanges, or start consumers. If RAM user permissions change after connection establishment, these operations may be blocked. Consumer permissions are checked only at startup. After consumers start, the broker does not stop pushing messages to them.
Manage permissions with System policies for Amqp and Custom policies of ApsaraMQ for RabbitMQ.