Resource Access Management:Create an AccessKey pair

What is an AccessKey pair?

An AccessKey pair is a long-term security credential that Alibaba Cloud provides to a user. It consists of an AccessKey ID and an AccessKey secret.

• AccessKey ID: The unique public identifier for the AccessKey pair.

• AccessKey secret: The secret part of the AccessKey pair. It is used to sign API requests to verify the authenticity and integrity of the request. You must keep your AccessKey secret strictly confidential.

AccessKey pair categories

An AccessKey pair can belong to either an Alibaba Cloud account or a RAM user. AccessKey pairs are categorized based on their owner:

• Alibaba Cloud account AccessKey pair (Not recommended)

  This type of AccessKey pair is created directly by an Alibaba Cloud account. By default, it has full permissions on all resources under the account and can perform any operation. A leak of the account AccessKey pair poses an extremely high security risk. We strongly recommend that you do not create or use an AccessKey pair for your Alibaba Cloud account.

• RAM user AccessKey pair (Recommended)

  This is a programmatic access credential for a RAM user. You must create a RAM user before you can create an AccessKey pair for the user. The AccessKey pair of a RAM user inherits the permissions of that user, which enables least-privilege access management. We recommend that you assign a separate RAM user and AccessKey pair for each independent business application. This practice prevents you from assigning excessive permissions or increasing the risk of leaks that can result from sharing credentials.

Permission requirements

Because an Alibaba Cloud account has full access to all resources, you should avoid using it to create AccessKey pairs in a production environment. Instead, as a best practice, use a RAM user that is granted only the necessary permissions to create and manage AccessKey pairs for other RAM users.

• You can attach the AliyunRAMFullAccess system policy to an administrator to allow them to create and manage AccessKey pairs for RAM users.

• You can also allow RAM users to manage their own AccessKey pairs by enabling the Allow users to manage AccessKey option in the global security settings of RAM. For more information, see Manage the security settings of RAM users.

  Note

  Enabling this setting allows all RAM users to manage their own AccessKey pairs. This includes all related operations, such as creating, disabling, and deleting AccessKey pairs, unless an administrator attaches a policy that explicitly denies these operations.

  We do not recommend enabling this setting in a production environment. To allow specific RAM users to manage their own AccessKey pairs, we recommend that you use a custom policy and set the Resource element in the policy to the user's own Alibaba Cloud Resource Name (ARN). The following sample policies are for your reference:

  Allow a RAM user to create their own AccessKey pair

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ram:CreateAccessKey",
          "ram:ListAccessKeys"
        ],
        "Resource": "acs:ram:*:ACCOUNT_ID:user/USER_NAME"
      }
    ]
  }

  Allow a RAM user to manage their own AccessKey pair

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ram:CreateAccessKey",
          "ram:ListAccessKeys",
          "ram:UpdateAccessKey",
          "ram:DeleteAccessKey",
          "ram:GetAccessKeyLastUsed",
          "ram:ListAccessKeysInRecycleBin"
        ],
        "Resource": "acs:ram:*:ACCOUNT_ID:user/USER_NAME"
      }
    ]
  }

Create an AccessKey pair for a RAM user

A RAM administrator (a user with the AliyunRAMFullAccess policy attached) can perform the following operations. If you do not have any RAM users under your account, create one first.

Create an AccessKey pair for an Alibaba Cloud account (Not recommended)

1. Log on to the RAM console with your Alibaba Cloud account.

2. Hover over the profile picture in the upper-right corner of the page that appears and click AccessKey.

   

3. In the Main Account AccessKey is not recommended dialog box, review the risks of creating an AccessKey pair for your Alibaba Cloud account. To proceed, select I am aware of the security risks of using a main account AccessKey, and click Use Main Account AccessKey.

   

4. On the AccessKey page, click Create AccessKey.

   

   Note

   An Alibaba Cloud account can have a maximum of two AccessKey pairs. One is for regular use, and the other is created for rotation to replace the old one.

5. In the Create Main Account AccessKey dialog box, review the security risks and limits again. To create the AccessKey pair, select I am aware of the security risks of using a main account AccessKey, and click Use Main Account AccessKey.

   

6. In the Create AccessKey dialog box, save the AccessKey ID and AccessKey secret, select I have saved the AccessKey Secret, and click OK.

   (Optional) Configure AccessKey Network Access Control: You can restrict the source IP addresses for API requests that use the AccessKey pair. This improves security by restricting access to the AccessKey pair to trusted network environments. We recommend that you identify the network environment where the AccessKey pair is used, and click Go to Settings. For more information, see Configure an AccessKey-level network access restriction policy for a RAM user.

   

   Important

   To reduce the risk of leaks, the AccessKey secret of an Alibaba Cloud account is displayed only when you create it. You cannot retrieve it later. Make sure to store it securely.