When multiple team members need to manage EventBridge resources such as event buses and event rules, create Resource Access Management (RAM) users and grant them fine-grained permissions instead of sharing your Alibaba Cloud account AccessKey pair. This reduces the risk of credential exposure and lets you control exactly what each person can do through the console, SDKs, or API operations.
All resource usage and costs are billed to the Alibaba Cloud account, not to individual RAM users.
You can revoke permissions or delete a RAM user at any time.
Prerequisites
Before you begin, make sure that you have:
An Alibaba Cloud account
At least one RAM user created in the RAM console
Grant permissions from the Users page
Use this method to grant permissions directly from a specific RAM user's profile.
Log on to the RAM console with your Alibaba Cloud account.
In the left-side navigation pane, choose Identities > Users.
On the Users page, find the target RAM user and click Add Permissions in the Actions column.
In the Add Permissions panel, configure the following settings:
Select the authorization scope.
Scope Effect Alibaba Cloud Account The authorization applies to the current Alibaba Cloud account Specific Resource Group The authorization applies only within a specific resource group Note If you select Specific Resource Group for Authorized Scope, make sure the cloud service supports resource groups. For more information, see Services that work with Resource Group.Specify the principal. The current RAM user is selected by default. To grant permissions to a different RAM user, change the principal.
Select policies.
Note You can attach a maximum of five policies to a RAM user at a time. To attach more than five policies, repeat this operation.
Click OK.
Click Complete.
Grant permissions from the Grants page
Use this method to grant permissions without navigating to a specific user's profile first.
Log on to the RAM console with your Alibaba Cloud account.
In the left-side navigation pane, choose Permissions > Grants.
On the Grants page, click Grant Permission.
On the Grant Permission page, configure the following settings:
Select the authorization scope.
Scope Effect Alibaba Cloud Account The authorization applies to the current Alibaba Cloud account Specific Resource Group The authorization applies only within a specific resource group Note If you select Specific Resource Group for Authorized Scope, make sure the cloud service supports resource groups. For more information, see Services that work with Resource Group.Specify the principal. Select the RAM user to which you want to grant permissions.
Select policies.
Note You can attach a maximum of five policies to a RAM user at a time. To attach more than five policies, repeat this operation.
Click OK.
Click Complete.
What to do next
After you grant permissions, share the RAM user name and password or AccessKey pair with team members so they can access EventBridge.
Log on to the EventBridge console
Open the RAM user logon portal in a browser.
On the RAM User Logon page, enter the RAM user name and click Next. Enter the password and click Login.
Note The RAM user name format is<$username>@<$AccountAlias>or<$username>@<$AccountAlias>.onaliyun.com.<$AccountAlias>is the account alias. If no account alias is set, the Alibaba Cloud account ID is used by default.On the console homepage, click the authorized service to access its console.
Call API operations
Use the AccessKey ID and AccessKey secret of the RAM user in your code to authenticate API calls.