To protect your Alibaba Cloud account, create a Resource Access Management (RAM) user after you complete the initial setup of your account. Then, grant the RAM user permissions to manage all resources in your Alibaba Cloud account.
An Alibaba Cloud account is similar to the root user of a Linux operating system and has permissions to manage all resources in the account. Using your Alibaba Cloud account for daily operations increases the risk of operational errors, account theft, data breaches, and data loss. For daily work, use a RAM user with administrative permissions instead of your Alibaba Cloud account.
What is a RAM user
A RAM user is an entity type in RAM. It has a fixed identity ID and identity credentials. A RAM user usually corresponds to a specific person or application. RAM users have the following features:
-
A RAM user is created by an Alibaba Cloud account, another RAM user with administrative permissions, or a RAM role. After creation, the RAM user belongs to that Alibaba Cloud account and is not an independent Alibaba Cloud account.
-
A RAM user does not own resources and cannot be billed independently. All charges are billed to the Alibaba Cloud account to which the RAM user belongs.
-
A RAM user must be granted permissions before they can log on to the console or use an API to access resources in the Alibaba Cloud account.
-
A RAM user has its own logon password or AccessKey pair.
-
You can create multiple RAM users in a single Alibaba Cloud account. These users can correspond to employees, systems, or applications in your organization.
You can create RAM users and grant them permissions. This lets you provide different users with different access permissions to resources. If multiple users in your organization need to access resources, use RAM to assign the least privilege required. This practice avoids sharing Alibaba Cloud account passwords or AccessKey pairs and reduces security risks for your organization.
Get started
-
Log on to the RAM console by using an Alibaba Cloud account or a RAM user who has administrative rights.
-
Create a RAM user.
For more information, see Create a RAM user.
-
Configure logon parameters.
RAM users support both logon passwords and AccessKey pairs. For security, assign only one credential type per user: a logon password for employees who use the console, or an AccessKey pair for applications that call APIs.
-
Console logon
Enable console logon, set a logon password, and configure a password policy. You can also change the password and enable multi-factor authentication (MFA). For more information, see Manage RAM user logon settings, Configure a password policy for RAM users, Change RAM user login password, and Bind an MFA device for a RAM user.
NoteIf user-based SSO is enabled, RAM users can log on to the console through SSO without enabling console logon. For more information, see Overview.
-
API calls
Create an AccessKey pair for the RAM user. For more information, see Create an AccessKey pair.
-
-
Grant permissions to the RAM user.
Grant each RAM user only the permissions they need. Grant permissions to RAM users.
-
Log on to the console as the RAM user, or call API operations using the AccessKey pair.
For more information, see Log on to the Alibaba Cloud console as a RAM user and Overview.
For more information, see Overview of RAM users.