API standards and multilingual preset SDKs
The OpenAPI of this product (Ram/2015-05-01) uses the RPC signature style. We have encapsulated SDKs for common programming languages for developers. Developers can download the SDK to directly call this product's OpenAPI without worrying about technical details. If the existing SDK does not meet your needs, you can use the signature mechanism for self-signing integration. Since the details of self-signing are very complex, it may take around 5 business days. Therefore, we recommend joining our DingTalk service group (147535001692) and conducting signature integration under expert guidance.
Before using the API, you need to prepare your identity account and access key (AccessKey) to effectively access the API through client tools (such as SDK and CLI). For details, see Obtain an AccessKey.
Custom signature scenarios
If your business scenario has special requirements and you need to integrate the API through self-signing, we recommend consulting our technical support team first (DingTalk service group: 147535001692) to obtain professional guidance and ensure efficient integration.
Account and security preparation
Alibaba Cloud accounts have full administrative permissions over all resources. Once an AccessKey is compromised, all associated resources will be at risk of unauthorized access. To ensure security, it is recommended to create a RAM user with only API access permissions and configure its AccessKey, while configuring RAM policies based on the principle of least privilege (PoLP). Use the Alibaba Cloud account only in specific scenarios where Alibaba Cloud account permissions are explicitly required.
User management
|
API |
Title |
Description |
| Users | Users | |
| CreateUser | CreateUser | Creates a Resource Access Management (RAM) user. |
| GetUser | GetUser | You can call the GetUser operation to query the details of a Resource Access Management (RAM) user. |
| UpdateUser | UpdateUser | Modifies information about a Resource Access Management (RAM) user. |
| DeleteUser | DeleteUser | Deletes a Resource Access Management (RAM) user. |
| ListUsers | ListUsers | Queries the information about all RAM users. |
| Logon information | Logon information | |
| GetLoginProfile | GetLoginProfile | Queries the logon configurations of a Resource Access Management (RAM) user. |
| UpdateLoginProfile | UpdateLoginProfile | Modifies the logon configurations of a Resource Access Management (RAM) user. |
| ChangePassword | ChangePassword | Changes the password that is used to log on to the console for a Resource Access Management (RAM) user. |
| AccessKey pairs | AccessKey pairs | |
| CreateAccessKey | CreateAccessKey | Creates an AccessKey pair for a Resource Access Management (RAM) user. |
| ListAccessKeys | ListAccessKeys | Queries all AccessKey pairs that belong to a Resource Access Management (RAM) user. |
| GetAccessKeyLastUsed | GetAccessKeyLastUsed | Queries the last time when an AccessKey pair was used. |
| Multi-factor authentication | Multi-factor authentication | |
| GetUserMFAInfo | GetUserMFAInfo | Queries the multi-factor authentication (MFA) device that is bound to a Resource Access Management (RAM) user. |
| DeleteVirtualMFADevice | DeleteVirtualMFADevice | Deletes a multi-factor authentication (MFA) device. |
| ListVirtualMFADevices | ListVirtualMFADevices | Queries multi-factor authentication (MFA) devices. |
| BindMFADevice | BindMFADevice | Binds a multi-factor authentication (MFA) device to a Resource Access Management (RAM) user. |
| UnbindMFADevice | UnbindMFADevice | Unbinds a multi-factor authentication (MFA) device from a Resource Access Management (RAM) user. |
User group management
|
API |
Title |
Description |
| CreateGroup | CreateGroup | Creates a RAM user group. |
| GetGroup | GetGroup | Queries information about a Resource Access Management (RAM) user group. |
| UpdateGroup | UpdateGroup | Modifies a Resource Access Management (RAM) user group. |
| DeleteGroup | DeleteGroup | Deletes a Resource Access Management (RAM) user group. |
| ListGroups | ListGroups | Queries Resource Access Management (RAM) user groups. |
| ListGroupsForUser | ListGroupsForUser | Queries the Resource Access Management (RAM) user groups to which a RAM user belongs. |
| ListUsersForGroup | ListUsersForGroup | Queries Resource Access Management (RAM) users in a RAM user group. |
| AddUserToGroup | AddUserToGroup | Adds a Resource Access Management (RAM) user to a RAM user group. |
| RemoveUserFromGroup | RemoveUserFromGroup | Removes a Resource Access Management (RAM) user from a RAM user group. |
Role management
|
API |
Title |
Description |
| CreateRole | **CreateRole** | Use the CreateRole operation to create a RAM role. |
| DeleteRole | DeleteRole | Deletes a regular Resource Access Management (RAM) role. |
| UpdateRole | UpdateRole | Updates a RAM role. |
| GetRole | GetRole | Queries information about a Resource Access Management (RAM) role. |
| ListRoles | ListRoles | Queries all Resource Access Management (RAM) roles. |
Permission management
|
API |
Title |
Description |
| Access policy management | Access policy management | |
| CreatePolicy | CreatePolicy | Creates a custom policy. |
| GetPolicy | GetPolicy | Queries information about a policy. |
| UpdatePolicyDescription | UpdatePolicyDescription | Modifies the description of a custom policy. |
| DeletePolicy | DeletePolicy | Deletes a policy. |
| ListPolicies | ListPolicies | Queries a list of policies. |
| CreatePolicyVersion | CreatePolicyVersion | Creates a version for a policy. |
| GetPolicyVersion | GetPolicyVersion | Queries the information about a policy version. |
| DeletePolicyVersion | DeletePolicyVersion | Deletes a policy version. |
| ListPolicyVersions | ListPolicyVersions | Queries the versions of a policy. |
| SetDefaultPolicyVersion | SetDefaultPolicyVersion | Specifies a version for a policy as the default version. |
| Authorization management | Authorization management | |
| AttachPolicyToUser | AttachPolicyToUser | Attaches a permission policy to a specified user. |
| DetachPolicyFromUser | DetachPolicyFromUser | Detaches a policy from a user. |
| AttachPolicyToGroup | AttachPolicyToGroup | Attaches a policy to a user group. |
| DetachPolicyFromGroup | DetachPolicyFromGroup | Detaches a policy from a group. |
| AttachPolicyToRole | AttachPolicyToRole | Attaches a policy to a role. |
| DetachPolicyFromRole | DetachPolicyFromRole | Detaches a policy from a role. |
| ListPoliciesForUser | ListPoliciesForUser | Queries the policies that are attached to a RAM user. |
| ListPoliciesForGroup | ListPoliciesForGroup | Queries the policies that are attached to a Resource Access Management (RAM) user group. |
| ListPoliciesForRole | ListPoliciesForRole | Queries the policies that are attached to a Resource Access Management (RAM) role. |
| ListEntitiesForPolicy | ListEntitiesForPolicy | Queries the entities to which a policy is attached. |
Security settings
|
API |
Title |
Description |
| SetAccountAlias | SetAccountAlias | Configures an alias for an Alibaba Cloud account. |
| ClearAccountAlias | ClearAccountAlias | Deletes the alias of an Alibaba Cloud account. |
| SetPasswordPolicy | SetPasswordPolicy | Configures the password policy for Resource Access Management (RAM) users, including the password strength. |
| GetPasswordPolicy | GetPasswordPolicy | Queries the password policy of Resource Access Management (RAM) users, including the password strength. |
| GetSecurityPreference | GetSecurityPreference | Queries the security preferences. |
Permission analysis and diagnostics
|
API |
Title |
Description |
| DecodeDiagnosticMessage | DecodeDiagnosticMessage | Decodes the permission diagnostic information from the response body of a request that was denied due to missing RAM permissions. |
Tag management
|
API |
Title |
Description |
| TagResources | TagResources | Adds tags to cloud resources which are Resource Access Management (RAM) roles and policies. |
| UntagResources | UntagResources | Removes tags from cloud resources that are Resource Access Management (RAM) roles and policies. |
| ListTagResources | ListTagResources | Queries the tags that are added to cloud resources which are Resource Access Management (RAM) roles and policies. |
Others
|
API |
Title |
Description |
| CreateLoginProfile | CreateLoginProfile | Enables console logon for a Resource Access Management (RAM) user. |
| CreateVirtualMFADevice | CreateVirtualMFADevice | Creates a multi-factor authentication (MFA) device. |
| DeleteAccessKey | DeleteAccessKey | Deletes an AccessKey pair of a Resource Access Management (RAM) user. |
| DeleteLoginProfile | DeleteLoginProfile | Disables console logon for a Resource Access Management (RAM) user. |
| GetAccountAlias | GetAccountAlias | Queries the alias of an Alibaba Cloud account. |
| SetSecurityPreference | SetSecurityPreference | Configures the security preferences. |
| UpdateAccessKey | UpdateAccessKey | Changes the status of an AccessKey pair that belongs to a Resource Access Management (RAM) user. |