Avoid using your Alibaba Cloud account directly to access cloud services unless otherwise required. Instead, use Resource Access Management (RAM) users or RAM roles for day-to-day access.
RAM user
RAM users are created by Alibaba Cloud accounts or by RAM users and RAM roles that have administrator permissions. After authorization, a RAM user can log on to the console or call API operations to access resources within the parent Alibaba Cloud account.
Best practices:
-
Create a RAM user with administrator permissions, then use that RAM user to create and manage other RAM users.
-
Separate RAM users for individuals from RAM users for programs.
You can create RAM users in the RAM console or by calling an API operation. The console requires your Alibaba Cloud account credentials; the API requires an AccessKey pair. Separating human and programmatic RAM users prevents accidental operations. Enable MFA for console-based RAM users.
-
Grant least-privilege permissions to RAM users.
Grant only the minimum permissions required for each operation to improve data security and prevent permission abuse.
-
Never embed AccessKey pairs in code. A leaked AccessKey pair exposes all resources in your account. Use STS tokens or environment variables instead.
-
Enable SSO for RAM users so they can access the Alibaba Cloud console through their enterprise identity systems.
Related operations
RAM user group
Group RAM users to simplify permission management. You can grant the same permissions to all members of a RAM user group. Best practices:
-
Grant least-privilege permissions to RAM user groups.
-
Remove a RAM user from a group when their duties change.
-
Revoke unnecessary permissions from a RAM user group.
Related operations
RAM role
A RAM role is a RAM identity type with attached policies. Unlike a RAM user, a role is not bound to a single person or application—any trusted principal can assume it. Roles have no long-term credentials such as passwords or AccessKey pairs. When a principal assumes a role, the Security Token Service (STS) generates temporary security credentials valid only for that session.
Best practices:
-
Do not frequently change the trusted entity of a RAM role after creation. Changing a trusted entity may cause permission loss that affects your business; adding one may introduce privilege escalation risks. Test all modifications before applying them.
-
A trusted entity with the required permissions can call AssumeRole to obtain a time-limited STS token for assuming a RAM role. Set the token validity period to an appropriate value to reduce security risks.
NoteThe maximum validity period of an STS token is the longest session duration specified for the RAM role. Specify an appropriate session duration to reduce security risks.
-
Enable SSO for RAM roles so users can access the Alibaba Cloud console through their enterprise identity systems.