All Products
Search

This Product

    Resource Access Management:Disable a RAM user's access key

    Document Center

    Resource Access Management:Disable a RAM user's access key

    Last Updated:Aug 07, 2026

    You can disable an access key pair for a RAM user when their permissions change or they no longer need to programmatically access Alibaba Cloud resources.

    Background information

    Warning

    After an access key pair is disabled, the RAM user can no longer use it to call Alibaba Cloud APIs. If your applications use this access key pair, service disruptions may occur. Proceed with caution.

    By default, Alibaba Cloud automatically disables an access key pair that has been unused for more than 730 days. You can change this period to 365, 180, or 90 days in the security settings. An access key pair that is automatically disabled is not deleted. You can re-enable it by clicking Enable in the RAM console. Multi-factor authentication (MFA) verification is required to re-enable the access key pair.

    Before you disable an access key pair, take note of the following impacts:

    • After you disable an access key pair, all applications and scripts that use this access key pair to access Alibaba Cloud services through API, CLI, SDK, or Terraform will fail.

    • RAM roles, such as system-preset roles for services like Data Transmission Service (DTS) and Database Backup (DBS), access cloud services through Security Token Service (STS) temporary credentials. These roles do not depend on the disabled access key pair. As long as the access key pair was not manually used to assume roles for business purposes, these services are not affected.

    • To identify the affected services, you can log on to the RAM console to check the permission policies associated with the access key pair, or use ActionTrail to query the cloud service API operations that were recently called by using the access key pair.

    If you find that an access key pair has been leaked or is being used for abnormal API calls, immediately take the following actions:

    1. Disable or delete the access key pair to stop the risk.

    2. API calls are one-time requests. You cannot disable a specific abnormal call. You must perform operations on the access key pair itself.

    3. In the RAM console, click Event List or IP List in the AccessKey section to trace the details of the abnormal calls.

    4. After the incident is handled, create a new access key pair for a RAM user and grant permissions based on the principle of least privilege. We recommend that you do not use access key pairs of your Alibaba Cloud account (root account).

    Procedure

    1. Log on to the RAM console as a RAM administrator.

    2. In the left-side navigation pane, choose Identities > Users.

    3. On the Users page, click the name of the target RAM user.

    4. On the Authentication tab, in the AccessKey section, click Disabled in the Actions column for the target access key pair.

      Note

      To re-enable a disabled access key pair, click Enable in the Actions column.

    5. In the Disabled dialog box, click Disabled.

    FAQ

    Why are there still API call records or alerts after I disable an access key pair?

    After an access key pair is disabled, all API call requests that use this access key pair fail with a 403 error. The disabled access key pair cannot be used to access any Alibaba Cloud resources.

    However, the system still records these failed call attempts and may trigger security alerts. This is a normal security monitoring mechanism. The Last Used time in the console records only the time of the last successful call and is not updated by failed calls after the access key pair is disabled.

    If you no longer need the access key pair, we recommend that you delete it to stop receiving alert notifications.

    How do I query the time when an access key pair was disabled?

    You can query the exact time when an access key pair was disabled by using ActionTrail. Log on to the ActionTrail console, go to the event query page, and search for the AccessKey ID. The management event records show the exact time when the access key pair was disabled.

    Can I disable access key pairs for multiple RAM users at a time?

    No. Batch disabling is not supported. You must go to the details page of each RAM user to disable the access key pairs one by one.

    How do I disable an access key pair of my Alibaba Cloud account (root account)?

    The entry for managing access key pairs of your Alibaba Cloud account (root account) differs from that of RAM users. Log on to the RAM console and navigate to the AccessKey management page. In the access key pair list, find the target access key pair and click Disable.

    If an access key pair of your Alibaba Cloud account has not been used for a long time, we recommend that you delete it instead of only disabling it.