All Products
Search

This Product

    :Use the credentials of a RAM user to log on to the OSS console

    Document Center

    :Use the credentials of a RAM user to log on to the OSS console

    Last Updated:Oct 08, 2026

    This topic describes how to use the credentials of a Resource Access Management (RAM) user to log on to the Object Storage Service (OSS) console.

    Background information

    You can use the credentials of a RAM user to log on to the OSS console in the following scenarios:

    • A bucket that is created by using an Alibaba Cloud account stores internal documents of your enterprise. To share specific internal documents with your employees, you can create RAM users for your employees and grant permissions to the RAM users. The RAM users can log on to the OSS console to view these documents.

    • Some of your partners need to periodically view specific materials. You can store the materials in a bucket, create RAM users for the partners, and grant the RAM users the permissions to access the bucket. This way, the partners can log on to the OSS console as RAM users to periodically view the materials.

    Step 1: Create a RAM user

    1. Sign in to the RAM console using your Alibaba Cloud account or as a RAM user with administrative permissions (a user to which the AliyunRAMFullAccess policy is attached).

    2. In the left-side navigation pane, choose Identities > Users.

    3. On the Users page, click Create User.

    4. On the Create User page, in the User Account Information section, configure the user's basic information.

      • Logon Name (required): Up to 64 characters. Allows letters, digits, periods (.), hyphens (-), and underscores (_).

      • Display Name (optional): The name can be up to 128 characters long.

      • Tag (optional): Click edit, then enter a tag key and tag value to categorize and manage users.

      Note

      Click Add User to create multiple RAM users in bulk.

    5. In the Access Mode section, select an access mode based on the user type.

      Important

      • As a security best practice, select only one access mode per user to separate human console access from programmatic application access. If a RAM user needs both console sign-in and API call capabilities, you can select both access modes. After you select Permanent AccessKey, you must select the I confirm that I must create an AccessKey checkbox to continue.

      • A leaked AccessKey pair compromises your account. Use Security Token Service (STS) tokens (temporary credentials) instead to reduce risk. Best practices for using access credentials to call Alibaba Cloud APIs.

      Console access

      Select Console Access.

      Programmatic access

      Select Permanent AccessKey.

      The system automatically creates an AccessKey ID and AccessKey secret for the RAM user.

      Important

      The AccessKey secret is displayed only at creation and cannot be retrieved later. You must immediately download or copy and save the AccessKey secret. A leaked AccessKey pair compromises all resources under your account. Create an AccessKey pair.

    Step 2: Grant permissions to the RAM user

    1. Log on to the RAM console.

    2. In the left-side navigation pane, choose Identities > Users.

    3. On the Users page, find the target RAM user and click Actions column > Attach Policy.

      You can also select multiple RAM users and click Attach Policy below the user list for batch authorization.

    4. In the Grant Permission panel, configure the following settings:

      • Resource scope:

        • Account level: Permissions apply to all resources in your Alibaba Cloud account.

        • Resource group level: Permissions apply only within the specified resource group. After logging on, the RAM user must switch to the authorized resource group in the top navigation bar.

          Note

          1. The system marks high-risk system policies (such as AdministratorAccess and AliyunRAMFullAccess) with a warning indicator. These policies typically grant full control over all cloud resources or full management of RAM. Grant these policies with caution.

          2. For resource group authorization examples, see Control RAM user access to specific ECS instances.

      • Principal:

        The principal is the RAM user receiving permissions. From the Users page, the system auto-selects the current user. From the Grants page, you must manually select the user. Batch selection is supported.

      • Permission policy:

        • System policy: Search and select. Filter by product name (e.g., ECS, OSS), access level (e.g., ReadOnly, FullAccess), or full policy name. For example, to grant permissions for financial management (expenses and costs), search for BSS to find AliyunBSSFullAccess (full access to Billing and Cost Management) and other finance-related policies.

          The following table lists system policy names for commonly requested Alibaba Cloud products to help you quickly find the right policy.

          Product

          System policy name

          Access level

          Billing and cost management (finance)

          AliyunBSSFullAccess

          Full access

          Cloud Monitor

          AliyunCloudMonitorReadOnlyAccess

          Read-only

          China Gateway (Website Builder)

          AliyunWebsiteBuildFullAccess

          Full access

          Alibaba Cloud DevOps

          AliyunYunxiaoFullAccess

          Full access

          Model Studio (Bailian)

          AliyunBailianFullAccess

          Full access

          Alibaba Cloud DNS

          AliyunDNSFullAccess

          Full access

          SSL Certificates Service

          AliyunYundunCertFullAccess

          Full access

          Cloud Phone

          AliyunECDFullAccess

          Full access

          Support Center

          AliyunSupportFullAccess

          Full access

          Resource Center

          AliyunResourceCenterFullAccess

          Full access

          AgentBay

          AliyunAgentBayFullAccess

          Full access

          Security Center

          AliyunYundunSASFullAccess

          Full access

          If you cannot find the policy for your target product, see the System policy reference for the complete list, or create a custom policy for fine-grained access control.

        • Custom policy: You must Create a custom policy before you can grant it.

        • Pagination limit for select all: The policy list is paginated. Selecting all applies only to the current page. After you switch pages, previously selected policies remain in the selected list, but policies on the new page are not automatically selected; you must select them page by page.

        • Quickly grant administrator permissions: To grant administrator permissions, search for AdministratorAccess in the search box and select it directly, instead of selecting policies page by page. Selecting this policy triggers a high-risk authorization warning.

      • (Optional) Description: Enter the authorization reason or scenario for audit purposes.

      • Click Confirm.

    5. Review the authorization result and click Close.

    Step 3: Log on to the OSS console as the RAM user

    1. In the left-side navigation pane of the RAM console, click Overview.

    2. In the Basic Information section on the Overview tab, obtain the logon URL of the RAM user.

    3. Click the logon link of the RAM user. Use the username of the RAM user and click Next. Enter the credentials of the RAM user to log on to the Alibaba Cloud Management Console.

    4. Access OSS by using the OSS console link.