To secure your Alibaba Cloud account and NIS resources, avoid using your root Alibaba Cloud account unless it is necessary. Instead, use Resource Access Management (RAM) identities — RAM users and RAM roles — to control who can access NIS and what they can do.
Choose the right identity type for your scenario:
| Scenario | Recommended identity |
|---|---|
| A person needs console or API access | RAM user |
| Multiple people share the same job function | RAM user group |
| A service, application, or cross-account process needs access | RAM role |
RAM users
A RAM user is an identity created under an Alibaba Cloud account by that account, another RAM user, or a RAM role with administrator permissions. RAM users have no permissions by default — they can log in to the console or call APIs only after you grant them the required permissions.
Grant least-privilege permissions
Assign only the minimum permissions a RAM user needs to perform their job, excluding other permissions. Least-privilege permissions improve data security and prevent permission abuse.
Delegate administration through RAM users
Use your Alibaba Cloud account to create a RAM user and grant administrator permissions to that RAM user. Then use RAM users to create and manage other RAM users.
Separate individual users from service accounts
Create distinct RAM users for people and for programs. Mixing them makes auditing harder and complicates permission changes when someone leaves or a service changes scope.
Create RAM users with the RAM console or OpenAPI Explorer
RAM console: Requires your Alibaba Cloud account username and password. Enable multi-factor authentication (MFA) when using this method to add a second layer of protection.
OpenAPI Explorer: Requires an AccessKey pair.
Pick one method per scenario type to minimize the chance of human error.
Keep AccessKeys out of your code
Never embed an AccessKey ID or AccessKey secret directly in source code. If the code is shared, versioned, or leaked, the credentials become exposed — putting all resources in the account at risk.
Enable SSO for enterprise identity integration
Enable single sign-on (SSO) to let RAM users log in to Alibaba Cloud using their existing corporate identity provider credentials, without managing separate passwords.
Related topics
RAM user groups
RAM user groups let you manage permissions for multiple RAM users with the same job function. You can grant the same permissions to RAM users in the same RAM user group.
Grant least-privilege permissions to groups
Apply the same least-privilege principle at the group level. Avoid granting broad permissions to a group just for convenience.
Remove users when their role changes
When a RAM user's responsibilities change or they no longer need a group's permissions, remove them from the group promptly. Stale group memberships are a common source of unintended access.
Related topics
RAM roles
A RAM role is a virtual identity you can attach policies to. Unlike a RAM user, a RAM role has no permanent credentials — no logon password and no AccessKey pair. To use a RAM role, a trusted entity (a RAM user, an Alibaba Cloud service, or an external account) must assume it. After assuming the role, the trusted entity receives a temporary security credential — a Security Token Service (STS) token — scoped to the permissions attached to that role.
Keep trusted entities stable
Avoid frequently changing the trusted entity of a RAM role after it is created. Changing the trusted entity may cause permission loss, which affects operations on your service. Adding a trusted entity introduces privilege escalation risk — a new entity gains all permissions the role holds. Test any trust policy changes in a non-production environment before applying them.
Enable SSO for federated access
Enable SSO for RAM roles to let federated users from your corporate identity provider assume roles and access Alibaba Cloud resources without separate Alibaba Cloud credentials.