All Products
Search

This Product

    Application Real-Time Monitoring Service:Grant ARMS permissions to RAM users

    Document Center

    Application Real-Time Monitoring Service:Grant ARMS permissions to RAM users

    Last Updated:Sep 16, 2026

    Sharing your Alibaba Cloud account credentials with team members exposes all account resources to security risks. Resource Access Management (RAM) lets you create separate user identities with only the Application Real-Time Monitoring Service (ARMS) permissions each person or application needs -- enforcing least-privilege access without sharing your Alibaba Cloud account credentials.

    ARMS permission policies

    For security purposes, you can create RAM users for your Alibaba Cloud account and grant different permissions to these RAM users as needed. This way, you can enable RAM users to perform their own duties without exposing the key of your Alibaba Cloud account. In this topic, if Enterprise A wants to allow some employees to handle routine O&M tasks, Enterprise A can create RAM users and grant the corresponding permissions to the RAM users. After that, employees can use these RAM users to log on to the console or call API operations.

    ARMS provides two system policies. Choose one based on the access level required:

    Policy

    What it allows

    Typical use case

    AliyunARMSFullAccess

    View, edit, and delete instances across all ARMS sub-services

    Administrators who configure monitoring tasks, manage alerts, and maintain ARMS resources

    Note

    This policy includes all read permissions. Do not attach both policies to the same RAM user.

    AliyunARMSReadOnlyAccess

    View instance information across all ARMS sub-services (no edit or delete operations)

    Team members who only need to view dashboards, traces, and monitoring data

    Important

    To grant read-only access scoped to a specific resource group, attach both AliyunARMSReadOnlyAccess and the ReadTraceApp permission. Without ReadTraceApp, ARMS cannot display the application list for that resource group.

    Prerequisites

    Before you begin, make sure that you have:

    Step 1: Create a RAM user

    Procedure

    Console

    1. Sign in to the RAM console using your Alibaba Cloud account or as a RAM user with administrative permissions (a user to which the AliyunRAMFullAccess policy is attached).

    2. In the left-side navigation pane, choose Identities > Users.

    3. On the Users page, click Create User.

    4. On the Create User page, in the User Account Information section, configure the user's basic information.

      • Logon Name (required): Up to 64 characters. Allows letters, digits, periods (.), hyphens (-), and underscores (_).

      • Display Name (optional): The name can be up to 128 characters long.

      • Tag (optional): Click edit, then enter a tag key and tag value to categorize and manage users.

      Note

      Click Add User to create multiple RAM users in bulk.

    5. In the Access Mode section, select an access mode based on the user type.

      Important

      • As a security best practice, select only one access mode per user to separate human console access from programmatic application access. If a RAM user needs both console sign-in and API call capabilities, you can select both access modes. After you select Permanent AccessKey, you must select the I confirm that I must create an AccessKey checkbox to continue.

      • A leaked AccessKey pair compromises your account. Use Security Token Service (STS) tokens (temporary credentials) instead to reduce risk. Best practices for using access credentials to call Alibaba Cloud APIs.

      Console access

      Select Console Access.

      Programmatic access

      Select Permanent AccessKey.

      The system automatically creates an AccessKey ID and AccessKey secret for the RAM user.

      Important

      The AccessKey secret is displayed only at creation and cannot be retrieved later. You must immediately download or copy and save the AccessKey secret. A leaked AccessKey pair compromises all resources under your account. Create an AccessKey pair.

    OpenAPI

    Create a RAM user for console access

    1. Call GetDefaultDomain to obtain the default logon suffix of an account. The format is <AccountAlias>.onaliyun.com.

    2. Call the CreateUser operation to create a RAM user. The following parameters are required:

      1. UserPrincipalName: The logon name for a RAM user. The format is <username>@<AccountAlias>.onaliyun.com, where <username> is the RAM username and <AccountAlias>.onaliyun.com is the default logon suffix.

      2. DisplayName: The display name for the RAM user. It can be different from the <username> above.

    3. Call the CreateLoginProfile operation to create a login profile and configure access mode and MFA. Recommended settings:

      1. UserPrincipalName: The user created in the previous step.

      2. Password: Set per the account's password strength requirements. Call GetPasswordPolicy to query the current password policy.

      3. MFABindRequired: Set to true to require MFA for RAM users.

      4. Status: Enables or disables console password logon. Default value: Active.

    Create a RAM user for programmatic access

    1. Call GetDefaultDomain to obtain the default logon suffix for an account. The suffix is in the format <AccountAlias>.onaliyun.com.

    2. Call the CreateUser operation to create a RAM user. The following parameters are required:

      1. UserPrincipalName: The logon name of a RAM user in the format <username>@<AccountAlias>.onaliyun.com, where <username> is the RAM username and <AccountAlias>.onaliyun.com is the default logon suffix.

      2. DisplayName: The display name for the RAM user, which can be different from the <username> above.

    3. To create an AccessKey pair (AccessKey), call the CreateAccessKey operation and pass only the UserPrincipalName for the user that you created in the previous step.

      Important

      The CreateAccessKey response contains the AccessKeyId and AccessKeySecret. The AccessKeySecret is displayed only once and cannot be retrieved later — save it immediately. A leaked AccessKey compromises all resources in your account. For more information, see Create an AccessKey.

    Step 2: Grant ARMS permissions to the RAM user

    Console

    The RAM console offers two entry points, both supporting single and batch authorization:

    • Users page: The principal is auto-selected based on the users you choose. Best for user-centric workflows.

    • Grants page: You manually select principals and can view all authorization records across your account. Best for permission-centric workflows.

    Note

    Tip: For large-scale management, add RAM users with identical responsibilities to a user group, then grant permissions to the group. Navigate to Identities > User Groups to manage groups.

    From the Users page

    1. Log on to the RAM console.

    2. In the left-side navigation pane, choose Identities > Users.

    3. On the Users page, find the target RAM user and click Actions column > Attach Policy.

      You can also select multiple RAM users and click Attach Policy below the user list for batch authorization.

    4. In the Grant Permission panel, configure the following settings:

      • Resource scope:

        • Account level: Permissions apply to all resources in your Alibaba Cloud account.

        • Resource group level: Permissions apply only within the specified resource group. After logging on, the RAM user must switch to the authorized resource group in the top navigation bar.

          Note

          1. The system marks high-risk system policies (such as AdministratorAccess and AliyunRAMFullAccess) with a warning indicator. These policies typically grant full control over all cloud resources or full management of RAM. Grant these policies with caution.

          2. For resource group authorization examples, see Control RAM user access to specific ECS instances.

      • Principal:

        The principal is the RAM user receiving permissions. From the Users page, the system auto-selects the current user. From the Grants page, you must manually select the user. Batch selection is supported.

      • Permission policy:

        • System policy: Search and select. Filter by product name (e.g., ECS, OSS), access level (e.g., ReadOnly, FullAccess), or full policy name. For example, to grant permissions for financial management (expenses and costs), search for BSS to find AliyunBSSFullAccess (full access to Billing and Cost Management) and other finance-related policies.

          The following table lists system policy names for commonly requested Alibaba Cloud products to help you quickly find the right policy.

          Product

          System policy name

          Access level

          Billing and cost management (finance)

          AliyunBSSFullAccess

          Full access

          Cloud Monitor

          AliyunCloudMonitorReadOnlyAccess

          Read-only

          China Gateway (Website Builder)

          AliyunWebsiteBuildFullAccess

          Full access

          Alibaba Cloud DevOps

          AliyunYunxiaoFullAccess

          Full access

          Model Studio (Bailian)

          AliyunBailianFullAccess

          Full access

          Alibaba Cloud DNS

          AliyunDNSFullAccess

          Full access

          SSL Certificates Service

          AliyunYundunCertFullAccess

          Full access

          Cloud Phone

          AliyunECDFullAccess

          Full access

          Support Center

          AliyunSupportFullAccess

          Full access

          Resource Center

          AliyunResourceCenterFullAccess

          Full access

          AgentBay

          AliyunAgentBayFullAccess

          Full access

          Security Center

          AliyunYundunSASFullAccess

          Full access

          If you cannot find the policy for your target product, see the System policy reference for the complete list, or create a custom policy for fine-grained access control.

        • Custom policy: You must Create a custom policy before you can grant it.

        • Pagination limit for select all: The policy list is paginated. Selecting all applies only to the current page. After you switch pages, previously selected policies remain in the selected list, but policies on the new page are not automatically selected; you must select them page by page.

        • Quickly grant administrator permissions: To grant administrator permissions, search for AdministratorAccess in the search box and select it directly, instead of selecting policies page by page. Selecting this policy triggers a high-risk authorization warning.

      • (Optional) Description: Enter the authorization reason or scenario for audit purposes.

      • Click Confirm.

    5. Review the authorization result and click Close.

    From the Grants page

    1. Log on to the RAM console.

    2. In the left-side navigation pane, choose Permissions > Grants.

    3. On the Grants page, click Grant Permission.

    4. In the Grant Permission panel, select the principal and configure the same settings as described above.

    5. Review the authorization result and click Close.

    Note

    RAM users created through the Quick Start feature on the RAM console Overview page are automatically granted the corresponding system policy based on the selected scenario, with no manual authorization required:

    • Super user: Automatically granted the PowerUserAccess policy. This user can manage cloud services and resources, but cannot manage RAM identities and their permissions, resource directories, or billing accounts.

    • Account administrator: Automatically granted the AdministratorAccess policy. This user can manage all Alibaba Cloud resources, including RAM identities and permissions.

    Use these options only when super administrator privileges are truly required. For routine operations, follow the principle of least privilege and grant only the permissions required for the specific task.

    OpenAPI

    Grant a custom policy

    1. Call CreatePolicy to create a custom policy. For policy syntax, see Permission policy elements and Overview of sample policies.

    2. Call AttachPolicyToUser to grant the policy at the account level (set PolicyType to Custom).

      Alternatively, call AttachPolicy to grant the policy at the resource group level.

    Grant a system policy

    Next steps

    After creating and authorizing a RAM user, share the credentials with the team member.

    Log on to the console as a RAM user

    1. Go to the RAM User Logon page.

    2. On the RAM User Logon page, enter your username and click Next. The username is typically in one of the following formats: <RAM-username>@<default-domain-name> or <RAM-username>@<domain-alias>. For more information about how to view and change your default domain name and domain alias, see Manage the logon settings for a RAM user.

    3. Enter your password and click Log On.

      Note

      If the system detects that your password is weak when you log on, you are redirected to a password reset page. We recommend that you change it to a stronger password. You can skip this step without affecting the current logon. For more information, see the announcement.

    4. (Optional) If you have enabled multi-factor authentication (MFA), you must also complete MFA verification. For more information, see Multi-factor authentication (MFA) and Enable an MFA device for a RAM user.

    Call API operations with the RAM user AccessKey pair

    Specify the RAM user's AccessKey ID and AccessKey secret in your API calls.