All Products
Search

This Product

    Performance Testing:Cross-account access with a RAM role

    Document Center

    Performance Testing:Cross-account access with a RAM role

    Last Updated:Jun 20, 2026

    You can create a RAM role by using the Alibaba Cloud account of Company A and grant permissions to the role. A RAM user from Company B can then assume this role to access Company A's cloud resources. This topic describes the required steps.

    Prerequisites

    PTS has been activated. For more information, see billing overview.

    Background information

    Assume that Company A has purchased multiple cloud resources to run its business and needs to authorize Company B to manage some of them on its behalf. You can use a RAM role to meet this requirement. A RAM role is a virtual user without a specific credential that a trusted entity must assume. To achieve this, follow these steps:

    Step 1: Create a RAM role

    Log on to the RAM console by using Company A's Alibaba Cloud account to create a RAM role.

    1. Log on to the RAM console using your Alibaba Cloud account or as a RAM administrator.

    2. In the left-side navigation pane, choose Identities > Roles.

    3. On the Create Role page, select Alibaba Cloud Account as the Trusted Entity Type. Select Other Alibaba Cloud Account, and enter Company B's Alibaba Cloud account ID in the text box. Then, click OK.

      Note

    4. In the dialog box that appears, enter a role name and click OK.

    Step 2: Grant permissions to the RAM role

    A newly created RAM role has no permissions. Company A must grant permissions to the role.

    1. Log on to the RAM console using your Alibaba Cloud account or as a RAM administrator.

    2. In the left-side navigation pane, choose Identities > Roles.

    3. On the Roles page, find the target RAM role and click Grant Permission in the Actions column.

    4. In the Grant Permission panel, grant the AliyunPTSFullAccess permission to the RAM role. Then, click OK and close the panel.image

    Step 3: Create a RAM user

    Log on to the RAM console by using Company B's Alibaba Cloud account to create a RAM user.

    1. Log on to the RAM console by using an Alibaba Cloud account or a RAM user with RAM administrator permissions (AliyunRAMFullAccess).

    2. In the left-side navigation pane, choose Identities > Users.

    3. On the Users page, click Create User.

    4. On the Create User page, in the User Account Information section, configure the user's basic information.

      • Logon Name (Required): Can contain letters, digits, periods (.), hyphens (-), and underscores (_). The name can be up to 64 characters long.

      • Display Name (Optional): Up to 128 characters.

      • Tag (Optional): Click edit and enter a tag key and tag value to manage users based on tags.

        Note

        Click Add User to create multiple RAM users at a time.

    5. In the Access Mode section, configure the settings based on the user type.

      Important

      • For better account security, select only one access mode and separate human users from application users.

      • A leaked AccessKey pair compromises the security of your entire account. Use Security Token Service (STS) tokens, which are temporary credentials, to reduce security risks. For more information, see Best practices for using access credentials to access Alibaba Cloud OpenAPI.

      Console Access

      Select Console Access.

      • Set Logon Password: You can automatically generate a password or specify a custom one. A custom password must meet the password complexity rules. For more information, see Set a password policy for RAM users.

      • Password Reset: Specify whether the RAM user must reset the password at the next logon.

      • Enable MFA: By default, the account enforces MFA for all users at logon. To change this setting, see Manage security settings for a RAM user. RAM users must bind an MFA device when they log on for the first time. For more information, see A RAM user binds an MFA device.

      Programmatic access

      Select Programmatic Access.

      If you enable this option, an AccessKey ID and an AccessKey secret are automatically generated for the RAM user.

      Important

      The AccessKey secret of a RAM user is displayed only when you create it and cannot be retrieved later. You must immediately download or copy the AccessKey secret and keep it in a secure place. A leaked AccessKey pair poses a high security risk to your entire account. For more information, see Create an AccessKey pair.

    Step 4: Grant permissions to the RAM user

    Company B must grant the AliyunSTSAssumeRoleAccess permission to the RAM user in its Alibaba Cloud account. This allows the RAM user to assume the RAM role created by Company A.

    1. Log on to the RAM console using your Alibaba Cloud account or as a RAM administrator.

    2. In the left-side navigation pane, choose Identities > Users.

    3. On the Users page, find the target RAM user and click Add Permissions in the Actions column.

    4. In the Add Permissions panel, grant the AliyunSTSAssumeRoleAccess permission to the RAM user. Then, click OK and close the panel.image

    Step 5: Access cloud resources

    1. Log on to the Alibaba Cloud Management Console as the RAM user created in Step 3: Company B creates a RAM user.

    2. In the upper-right corner of the console, move the pointer over the profile icon and click Switch Role.

    3. On the Switch Role page, enter Company A's account alias or default domain name, and the name of the RAM role created in Step 1: Company A creates a RAM role. Then, click Submit.

    4. After switching the role, you can manage Company A's cloud resources.