Application Real-Time Monitoring Service:Grant ARMS permissions to RAM users

Prerequisites

Before you begin, ensure that you have:

• ARMS activated. See Activate ARMS

• RAM activated. See Activate RAM

Step 1: Create a RAM user

1. Log on to the RAM console with an Alibaba Cloud account or a RAM user that has administrative rights.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User.

   

4. In the User Account Information section, configure the following parameters:

   Parameter	Description
   Logon Name	Up to 64 characters. Supports letters, digits, periods (.), hyphens (-), and underscores (_).
   Display Name	Up to 128 characters.
   Tag	Click the icon to add one or more tag key-value pairs for easier management.

   Note

   Click Add User to create multiple RAM users at a time.

5. In the Access Mode section, select an access mode and configure the required parameters.

   For security, select only one access mode per RAM user to separate human access from programmatic access.

   • Console Access

     Best for individual users who log on through the console. Configure these parameters:

     Parameter	Description
     Set Console Password	Select Automatically Regenerate Default Password or Reset Custom Password. Custom passwords must meet complexity requirements. For details, see Configure a password policy for RAM users.
     Password Reset	Specify whether the RAM user must reset the password on next logon.
     Enable MFA	Enable multi-factor authentication (MFA). After enabling, bind an MFA device to the RAM user. For details, see Bind an MFA device to a RAM user.

   • Using permanent AccessKey to access

     Best for programmatic access. The system automatically generates an AccessKey ID and AccessKey secret. For details, see Obtain an AccessKey pair.

     Important

     The AccessKey secret is displayed only at creation time and cannot be retrieved later. Back it up immediately.

     An AccessKey pair is a permanent credential. If leaked, all account resources are at risk. For better security, use Security Token Service (STS) tokens instead. For details, see Best practices for using access credentials to call API operations.

6. Click OK.

7. Complete the security verification as prompted.

Step 2: Grant permissions to the RAM user

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. Find the target RAM user and click Add Permissions in the Actions column.

   

   Note

   To grant permissions to multiple RAM users at once, select them and click Add Permissions at the bottom of the page.

4. In the Grant Permission panel, configure the following parameters:

   1. Resource Scope -- Select the scope of authorization:

      • Account: The current Alibaba Cloud account

      • ResourceGroup: A specific resource group

      Important

      If you select ResourceGroup, make sure the cloud service supports resource groups. For details, see Services that work with Resource Group. For a step-by-step example, see Use a resource group to grant a RAM user the permissions to manage a specific ECS instance.

   2. Principal -- The RAM user to authorize. Automatically set to the current RAM user.

   3. Policy -- Select one or more policies:

      • System policies -- Predefined by Alibaba Cloud. These policies cannot be modified and are maintained by Alibaba Cloud. For details, see Services that work with RAM.

        Note

        The system flags high-risk policies such as AdministratorAccess and AliyunRAMFullAccess. Avoid attaching these unless absolutely necessary.

      • Custom policies -- Create and manage your own policies based on business requirements. For details, see Create a custom policy.

   4. Click Grant permissions.

5. Click Close.

Share credentials and log on

After creating the RAM user, share the logon credentials (username and password, or AccessKey pair) with the intended user.