EventBridge allows an Alibaba Cloud account to grant resource-level permissions to RAM users. This practice helps you avoid the security risks of exposing your Alibaba Cloud account's AccessKey pair. Only authorized RAM users can manage resources in the EventBridge console or publish events by using an SDK or API.
Use cases
A company, Enterprise A, subscribes to the EventBridge service. The company's employees need to manage the service's resources, such as event rules and event buses. Because employees have different job responsibilities, they require different permissions.
This scenario includes the following requirements:
For security reasons, Enterprise A wants to avoid sharing its Alibaba Cloud account's AccessKey pair directly with employees. Instead, the company prefers to create a separate RAM user for each employee.
Individual RAM users are not billed for usage. All costs are charged to Enterprise A's Alibaba Cloud account.
Enterprise A can revoke the permissions of a RAM user or delete the RAM user at any time.
In this scenario, the Alibaba Cloud account can grant fine-grained permissions to employees, ensuring they access only the resources required for their jobs.
Grant permissions to a RAM user
Console
The RAM console provides two entry points for granting permissions to RAM users. Both methods support granting permissions to a single user or multiple users at once. Choose the method that best fits your workflow:
From the Users page: Select the target users from the user list. The system automatically sets the selected users as the principals in the authorization panel. This approach is user-centric.
From the Grants page: You must manually select the principals. This page provides an overview of all permission grants in your account. This approach is permission-centric.
Recommendation for bulk management: When you need to grant the same permissions to multiple RAM users with the same job responsibilities, we recommend adding them to a user group and then granting permissions to the user group (console path: Identities > User Groups). This approach is easier to maintain than granting permissions to each user individually.
Start from the Users page
Log on to the RAM console.
In the left-side navigation pane, choose .
On the Users page, find the RAM user that you created and click Actions in the Attach Policy column.
You can also select multiple RAM users and click Attach Policy below the user list to grant permissions to them in bulk.
In the Grant Permission panel, configure the permissions for the RAM user.
Select a Scope:
Account: The permissions apply to all resources within the current Alibaba Cloud account. This is suitable for general-purpose scenarios that do not require isolation by resource group.
Resource Group: The permissions apply only to resources within a specified resource group. This is suitable for scenarios where multiple teams share an account and require permission isolation. If a RAM user is granted resource-group-level permissions, they must switch the scope to the authorized resource group in the top navigation bar of the console to access and manage its resources.
NoteThe system automatically flags high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. These policies typically grant full control over all cloud resources or full management access to RAM. Grant these permissions with caution.
For an example of resource group authorization, see Use resource groups to control access to ECS instances.
Select a Principal:
The principal is the RAM user that you are granting permissions to. If you start from the Users page, the system automatically selects the target RAM user. If you start from the Grants page, you must manually select one or more RAM users.
Select a Policy:
System Policy: You can search for and select system policies directly. Search tip: Use the search box to quickly find a policy. You can perform a fuzzy search by product name (e.g.,
ECS,OSS), permission level (e.g.,ReadOnly,FullAccess), or the full policy name.Custom Policy: You must first create a custom policy before you can grant it.
(Optional) Enter a Note: We recommend adding a note that describes the reason for the grant, such as "Special authorization for OSS upload tasks." This helps with future auditing and traceability.
Confirm the authorization: Click OK.
Review the authorization result and click Close.
Start from the Grants page
Log on to the RAM console.
In the left-side navigation pane, choose .
On the Grants page, click Grant Permission.
In the Grant Permission panel, grant permissions to the RAM user. The settings are the same as described in the previous section.
Review the authorization result and click Close.
API
Grant a custom policy
Call CreatePolicy to create a custom policy. For more information, see Basic elements of a policy and Policy example overview.
Call AttachPolicyToUser to grant account-level permissions to the RAM user. Set
PolicyTypetoCustom.Alternatively, call AttachPolicy to grant resource-group-level permissions.
Grant a system policy
Call AttachPolicyToUser to attach the policy to the specified RAM user. Set
PolicyTypetoSystem. For a list of policy names (PolicyName), see System policy reference.Alternatively, call AttachPolicy to grant resource-group-level permissions.
More information
Next steps
After you create a RAM user by using your Alibaba Cloud account, you can distribute the RAM user's logon name and password, or its AccessKey pair, to other users. They can then use these credentials to log on to the console or call API operations.
Log on to the console.
Open the RAM user logon portal in a web browser.
On the RAM User Logon page, enter the RAM user logon name and click Next. Then, enter the password and click Login.
NoteThe logon name for a RAM user is in the format
<$username>@<$AccountAlias>or<$username>@<$AccountAlias>.onaliyun.com.<$AccountAlias>is the account alias. If no account alias is set, the ID of your Alibaba Cloud account is used by default.On the Alibaba Cloud console, click a service that you have permission to access.
Use the RAM user's AccessKey pair to call API operations.
Include the RAM user's AccessKey ID and AccessKey secret in your code.