Resource Access Management:Overview of RAM users

What is a RAM user?

A RAM user is a physical identity with a fixed ID and credentials, representing a person or an application. Key characteristics:

• A RAM user can be created by an Alibaba Cloud account, or by a RAM user or RAM role with administrative rights. In either case, the created RAM user belongs to the Alibaba Cloud account of the creator.

• A RAM user does not own resources. All usage fees are billed to the parent Alibaba Cloud account. RAM users cannot receive bills or make payments.

• RAM users must be authorized before they can log on to the console or call API operations. After authorization, they can access resources owned by the parent Alibaba Cloud account.

• RAM users have independent passwords or AccessKey pairs for logon.

• An Alibaba Cloud account can create multiple RAM users to represent employees, systems, and applications.

RAM user types

RAM users are classified by creation method:

• Manual creation: a RAM user created in the RAM console. For more information, see Create a RAM user.

• CloudSSO synchronization: a RAM user created through the RAM user provisioning feature of CloudSSO. To access the Alibaba Cloud Management Console, you must first log on to the CloudSSO user portal as a CloudSSO user and then use this type of RAM user. You cannot log on directly with a RAM username and password. You can delete this type only after you delete the RAM user provisioning. For more information, see Create a RAM user provisioning.

Get started

1. Log on to the RAM console by using an Alibaba Cloud account or a RAM user who has administrative rights.

2. Create a RAM user.

   For more information, see Create a RAM user.

3. Configure logon parameters.

   RAM users support both logon passwords and AccessKey pairs. For security, assign only one credential type per user: a logon password for employees who use the console, or an AccessKey pair for applications that call APIs.

   • Console logon

     Enable console logon, set a logon password, and configure a password policy. You can also change the password and enable multi-factor authentication (MFA). For more information, see Manage RAM user logon settings, Configure a password policy for RAM users, Change RAM user login password, and Bind an MFA device for a RAM user.

     Note

     If user-based SSO is enabled, RAM users can log on to the console through SSO without enabling console logon. For more information, see Overview.

   • API calls

     Create an AccessKey pair for the RAM user. For more information, see Create an AccessKey pair.

4. Grant permissions to the RAM user.

   Grant each RAM user only the permissions they need. Grant permissions to RAM users.

5. Log on to the console as the RAM user, or call API operations using the AccessKey pair.

   For more information, see Log on to the Alibaba Cloud console as a RAM user and Overview.

Best practices

Enterprises that have multiple Alibaba Cloud resources can use RAM to manage identities, permissions, and resources across your enterprise. For more information, see User and permission management.

Limits

For more information about the limits of using RAM users, see Limitations.