You can use RAM users to avoid security risks that are caused by AccessKey pair and password leaks. This topic describes how to create a RAM user and grant the required permissions to the user.


The Resource Access Management (RAM) service and ApsaraVideo Live are activated.

Create a RAM user

  1. Log on to the RAM console.
  2. In the left-side navigation pane, click Users. On the Users page, click Create User.
  3. Select Programmatic Access and click OK.
    Create User
    After you click OK, an AccessKey pair is generated for the RAM user.
  4. Click Copy in the Actions column of the RAM user and save the user logon name, logon password, and AccessKey pair.
    Note We recommend that you keep the user information confidential for future access purposes.


  1. Go back to the Users page. The RAM user that you created appears in the user list.
    When the RAM user is created, it has no permissions.
  2. Click Add Permissions in the Actions column of the RAM user.
    Add Permissions
  3. Select the permissions to grant. In the field below Select Policy, enter live. Select the policies that are filtered out and click OK.

    If a RAM user needs to use the recording or transcoding features, you must grant the RAM user the required permissions on ApsaraVideo for Media Processing. You can use the system policy AliyunMTSFullAccess.

    You use system policies or custom policies. For more information about the definition of system policies, see Policy. For more information about how to customize policies, see Customize a policy.

  4. If the RAM user requires permissions such as the console logon permission, you can click the username of the RAM user and enable console logon on the Authentication tab.