Use RAM users to delegate permissions for an Alibaba Cloud account - ApsaraMQ for RabbitMQ

Resource Access Management (RAM) allows you to delegate permissions using RAM users. You can grant different permissions to RAM users based on your business needs. This helps you avoid security risks that can arise from exposing the AccessKey of your Alibaba Cloud account.

Background

Company A has enabled the ApsaraMQ for RabbitMQ service. The company needs its employees to manage resources for the ApsaraMQ for RabbitMQ service, such as instances, Vhosts, Queues, and Exchanges. Because employees have different job responsibilities, they require different permissions. The requirements of Company A are as follows:

For security or trust reasons, the company does not want to share the AccessKey of its Alibaba Cloud account directly with employees. Instead, it wants to create separate user accounts for them.
Users can manage resources only within their granted permissions. All resource usage is billed to the company's Alibaba Cloud account, not to individual user accounts.
The company can revoke a user's permissions or delete a user account at any time.

Step 1: Create a RAM user

To create RAM users for its employees, log on to the RAM console with Company A's Alibaba Cloud account.

Procedure

Console

Sign in to the RAM console using your Alibaba Cloud account or as a RAM user with administrative permissions (a user to which the AliyunRAMFullAccess policy is attached).
In the left-side navigation pane, choose Identities > Users.
On the Users page, click Create User.
On the Create User page, in the User Account Information section, configure the user's basic information.
- Logon Name (required): Up to 64 characters. Allows letters, digits, periods (.), hyphens (-), and underscores (_).
- Display Name (optional): The name can be up to 128 characters long.
- Tag (optional): Click , then enter a tag key and tag value to categorize and manage users.
Note
Click Add User to create multiple RAM users in bulk.
In the Access Mode section, select an access mode based on the user type.
Important
- As a security best practice, select only one access mode per user to separate human console access from programmatic application access.
- A leaked AccessKey pair compromises your account. Use Security Token Service (STS) tokens (temporary credentials) instead to reduce risk. Best practices for using access credentials to call Alibaba Cloud APIs.
Console access

Select Console Access.
- Set Logon Password: Auto-generate or set a custom password. Custom passwords must meet the configured complexity requirements. Set a password policy for RAM users.
- Password Reset: Specify whether the user must reset their password at next sign-in.
- Enable MFA: MFA is required for all users by default. To change this setting, see Manage RAM user security settings. Users must bind an MFA device at first sign-in. Bind an MFA device.
Programmatic access

Select Using permanent AccessKey to access.

The system automatically creates an AccessKey ID and AccessKey secret for the RAM user.

Important
The AccessKey secret is shown only at creation and cannot be retrieved later. You must immediately download or copy and save the AccessKey secret. A leaked AccessKey pair compromises all resources under your account. Create an AccessKey pair.

OpenAPI

Create a RAM user for console access

Call GetDefaultDomain to obtain the default logon suffix of an account. The format is <AccountAlias>.onaliyun.com.
Call the CreateUser operation to create a RAM user. The following parameters are required:
1. UserPrincipalName: The logon name for a RAM user. The format is <username>@<AccountAlias>.onaliyun.com, where <username> is the RAM username and <AccountAlias>.onaliyun.com is the default logon suffix.
2. DisplayName: The display name for the RAM user. It can be different from the <username> above.
Call the CreateLoginProfile operation to create a login profile and configure access mode and MFA. Recommended settings:
1. UserPrincipalName: The information of the user created in the previous step.
2. Password: Set per the account's password strength requirements. Call the GetPasswordPolicy operation to query the current password policy.
3. MFABindRequired: Set to true to require MFA for RAM users.
4. Status: Enables or disables console password logon. Default: Active.

Create a RAM user for programmatic access

Call GetDefaultDomain to obtain the default logon suffix for an account. The suffix is in the format <AccountAlias>.onaliyun.com.
Call the CreateUser operation to create a RAM user. The following parameters are required:
1. UserPrincipalName: The logon name of a RAM user in the format <username>@<AccountAlias>.onaliyun.com, where <username> is the RAM username and <AccountAlias>.onaliyun.com is the default logon suffix.
2. DisplayName: The display name for the RAM user, which can be different from the <username> above.
To create an AccessKey pair (AccessKey), call the CreateAccessKey operation and pass only the UserPrincipalName for the user that you created in the previous step.

Important
The CreateAccessKey response contains the AccessKeyId and AccessKeySecret. The AccessKeySecret appears only once and cannot be retrieved later — save it immediately. A leaked AccessKey compromises all resources in your account. For more information, see Create an AccessKey.

Step 2: Grant permissions to RAM users

Grant different permissions to different RAM users.

Log on to the RAM consoleas a RAM administrator.
In the left-side navigation pane, choose Identities > Users.
Find the required RAM user, and click Attach Policy in the Actions column.
In the Attach Policy panel, grant permissions to the RAM user.
1. Select a Resource Scope.
  - Account: The permissions apply to the current Alibaba Cloud account.
  - Resource Group: The permissions apply to the specified resource group.
    Note
    An authorization for a resource group takes effect only if the cloud service supports resource groups. For more information, see Cloud services that support resource groups.
2. Specify a Principal.
  The principal is the RAM user you are granting permissions to.
3. Select Policy.
  A policy is a collection of permissions. There are two types of policies:
  - System Policy: Created and maintained by Alibaba Cloud. You can use these policies but cannot modify them. For more information, see Services that work with RAM.
  - Custom Policy: You can create, update, and delete these policies. For more information, see Create a custom policy.
  To configure fine-grained permissions for ApsaraMQ for RabbitMQ resources such as instances, Vhosts, and queues, create a custom policy. The following example shows a custom policy JSON:
```
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "amqp:*",
      "Resource": "acs:amqp:*:*:instance/<InstanceID>/vhost/<VhostName>"
    }
  ]
}
```
  Replace <InstanceID> with the actual instance ID and <VhostName> with the actual Vhost name. The Resource field supports the following granularity levels:
  - Instance level: acs:amqp:*:*:instance/<InstanceID>
  - Vhost level: acs:amqp:*:*:instance/<InstanceID>/vhost/<VhostName>
  - Queue level: acs:amqp:*:*:instance/<InstanceID>/vhost/<VhostName>/queue/<QueueName>
  Note
  The system automatically identifies high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. When you grant permissions, avoid granting unnecessary high-risk policies.
  Troubleshooting: Insufficient RAM permissions
  If you encounter permission-related errors when connecting to or consuming messages from ApsaraMQ for RabbitMQ, check the following:
  - BrokerUnreachableException or InstanceNotServing (.NET SDK): If your .NET SDK client reports BrokerUnreachableException or InstanceNotServing and the network connection is verified to be normal, check whether the RAM user has operation permissions for the target instance and Vhost. Update the custom policy to grant amqp:* permissions on the relevant resources.
  - AccessDeniedByRamPolicy (delayed queue consumption): If delayed queue consumption is interrupted or messages are accumulating and the error AccessDeniedByRamPolicy is reported, check whether the RAM user has operation permissions for the target instance, Vhost, and specific queues (for example, event_task_result_query and event_task_status). Update the Resource field in your custom policy to include the affected queues.
4. Click Grant permissions.
Click Close.

Next steps

RAM users can access ApsaraMQ for RabbitMQ in the following ways.

Console
1. Open the RAM User Logon page in your browser.
2. On the RAM User Logon page, enter the RAM username, click Next, enter the password, and then click Log On.
  Note
  The RAM username must be in the <$username>@<$AccountAlias> or <$username>@<$AccountAlias>.onaliyun.com format. <$AccountAlias> is the account alias. If no account alias is set, the ID of the Alibaba Cloud account is used by default.
API
Use the RAM user's AccessKey ID and AccessKey Secret in your code to call the API and access ApsaraMQ for RabbitMQ.