Cloud Hardware Security Module (HSM) stores and manages cryptographic keys — among the most sensitive resources in your Alibaba Cloud account. Access controls for HSM directly affect the security of everything those keys protect. Take the time to design your identity architecture carefully before granting access.
By default, all access is denied unless explicitly granted through a permission policy. We recommend that you access HSM as a Resource Access Management (RAM) user or RAM role. Do not use your Alibaba Cloud account to access Cloud Hardware Security Module unless otherwise required.
RAM users
RAM users can be created by using Alibaba Cloud accounts, or by RAM users and RAM roles who have administrative rights. After a RAM user is granted the required permissions, they can use the Alibaba Cloud Management Console or call API operations to access resources within the account.
When creating a RAM user, set the Access Mode parameter to one of the following:
Console Access — the user logs on with a username and password
Using permanent AccessKey to access — the user makes API calls
Both — only if the same person needs both access paths
Best practices for RAM users
Separate human identities from programmatic identities. Create distinct RAM users for people and for programs. This limits the blast radius of a compromised credential and makes audit logs easier to interpret.
Enable multi-factor authentication (MFA) for console access. For any RAM user with console access, enable MFA to prevent unauthorized log-on if a password is compromised.
Never embed AccessKey credentials in code. An exposed AccessKey ID or AccessKey secret compromises every resource in your account. Store credentials in environment variables or use Security Token Service (STS) tokens.
Grant only the permissions each user needs. Apply the principle of least privilege: assign the minimum permissions required to perform an operation. Least-privilege permissions improve data security and prevent permission abuse.
Use RAM user groups to manage permissions at scale. If you have multiple RAM users with similar responsibilities, assign permissions to a RAM user group rather than to individual users. Update or revoke group permissions when responsibilities change.
Enable single sign-on (SSO) where applicable. If your organization uses an enterprise identity management system, enable user-based SSO to let RAM users authenticate through it instead of maintaining separate Alibaba Cloud passwords.
Related topics
RAM user groups
RAM user groups let you manage permissions for multiple RAM users collectively. Assign a permission policy to a group rather than to each user individually — every member inherits those permissions automatically.
Best practices for RAM user groups
Apply least-privilege permissions to groups, not just individuals. Groups amplify both correct and incorrect permissions across all members. Keep group policies tightly scoped.
Remove users from groups when their responsibilities change. Do not leave users in groups they no longer need. Stale group memberships are a common source of privilege creep.
Revoke group permissions when they are no longer needed. Regularly audit group policies and remove permissions that the group's current purpose does not require.
Related topics
RAM roles
A RAM role is a virtual identity that carries policies but has no permanent credentials — no password, no AccessKey pair. A trusted entity (a RAM user, an Alibaba Cloud service, or an external identity) assumes the role to get a short-lived STS token, then uses that token to access resources as the role.
Best practices for RAM roles
Avoid changing the trusted entity after creation. Changing the trusted entity of a RAM role can cause permission loss and disrupt dependent services. If you must add a trusted entity, make sure that the changes are fully tested before you apply them to a RAM role — adding a trusted entity can create privilege escalation risks.
Set an appropriate STS token validity period. Call the AssumeRole API operation to get an STS token. The maximum validity period equals the maximum session duration set on the role. Set both values to the minimum duration your workload requires.
The STS token cannot outlast the role's maximum session duration. Set the maximum session duration to an appropriate value — not the longest possible — to reduce the window of exposure if a token is compromised.
Enable SSO for roles where applicable. If your organization uses an enterprise identity provider, enable role-based SSO so that users can assume RAM roles through federated authentication rather than through permanent Alibaba Cloud credentials.