API standards and multilingual preset SDKs
The OpenAPI of this product (Ram/2015-05-01) uses the RPC signature style. We have encapsulated SDKs for common programming languages for developers. Developers can download the SDK to directly call this product's OpenAPI without worrying about technical details. If the existing SDK does not meet your needs, you can use the signature mechanism for self-signing integration. Since the details of self-signing are very complex, it may take around 5 business days. Therefore, we recommend joining our DingTalk service group (147535001692) and conducting signature integration under expert guidance.
Before using the API, you need to prepare your identity account and access key (AccessKey) to effectively access the API through client tools (such as SDK and CLI). For details, see Obtain an AccessKey.
Custom signature scenarios
If your business scenario has special requirements and you need to integrate the API through self-signing, we recommend consulting our technical support team first (DingTalk service group: 147535001692) to obtain professional guidance and ensure efficient integration.
Account and security preparation
Alibaba Cloud accounts have full administrative permissions over all resources. Once an AccessKey is compromised, all associated resources will be at risk of unauthorized access. To ensure security, it is recommended to create a RAM user with only API access permissions and configure its AccessKey, while configuring RAM policies based on the principle of least privilege (PoLP). Use the Alibaba Cloud account only in specific scenarios where Alibaba Cloud account permissions are explicitly required.
User management
|
API |
Title |
Description |
| Users | Users | |
| CreateUser | CreateUser | Creates a Resource Access Management (RAM) user. |
| GetUser | GetUser | You can call the GetUser operation to query the details of a Resource Access Management (RAM) user. |
| UpdateUser | UpdateUser | Modifies information about a Resource Access Management (RAM) user. |
| DeleteUser | DeleteUser | Deletes a Resource Access Management (RAM) user. |
| ListUsers | ListUsers | Queries the information about all RAM users. |
| Logon information | Logon information | |
| CreateLoginProfile | CreateLoginProfile | Enables console logon for a Resource Access Management (RAM) user. |
| GetLoginProfile | View the logon configuration of a RAM user | Invokes the GetLoginProfile operation to view the logon configuration of a Resource Access Management (RAM) user. |
| UpdateLoginProfile | UpdateLoginProfile | Modifies the logon configurations of a Resource Access Management (RAM) user. |
| DeleteLoginProfile | DeleteLoginProfile | Disables console logon for a Resource Access Management (RAM) user. |
| ChangePassword | Change RAM user password | Allows a Resource Access Management (RAM) user to invoke ChangePassword to change their own console logon password. |
| AccessKey pairs | AccessKey pairs | |
| CreateAccessKey | Create an AccessKey pair for a RAM user | Invokes the CreateAccessKey operation to create an AccessKey pair for a Resource Access Management (RAM) user. |
| UpdateAccessKey | UpdateAccessKey | Changes the status of an AccessKey pair that belongs to a Resource Access Management (RAM) user. |
| DeleteAccessKey | DeleteAccessKey | Deletes an AccessKey pair of a Resource Access Management (RAM) user. |
| ListAccessKeys | List accessKey pairs of a specified user | Lists the AccessKey pairs of a specified user. |
| GetAccessKeyLastUsed | GetAccessKeyLastUsed | Queries the last time when an AccessKey pair was used. |
| Multi-factor authentication | Multi-factor authentication | |
| CreateVirtualMFADevice | CreateVirtualMFADevice | Creates a multi-factor authentication (MFA) device. |
| GetUserMFAInfo | GetUserMFAInfo | Queries the multi-factor authentication (MFA) device that is bound to a Resource Access Management (RAM) user. |
| DeleteVirtualMFADevice | DeleteVirtualMFADevice | Deletes a multi-factor authentication (MFA) device. |
| ListVirtualMFADevices | ListVirtualMFADevices | Queries multi-factor authentication (MFA) devices. |
| BindMFADevice | BindMFADevice | Binds a multi-factor authentication (MFA) device to a Resource Access Management (RAM) user. |
| UnbindMFADevice | UnbindMFADevice | Unbinds a multi-factor authentication (MFA) device from a Resource Access Management (RAM) user. |
User group management
|
API |
Title |
Description |
| CreateGroup | CreateGroup | Creates a RAM user group. |
| GetGroup | Query user group information | Queries the information of a user group by calling the GetGroup operation. |
| UpdateGroup | UpdateGroup | Modifies a Resource Access Management (RAM) user group. |
| DeleteGroup | DeleteGroup | Deletes a Resource Access Management (RAM) user group. |
| ListGroups | Query user groups | Queries the list of user groups by calling the ListGroups operation. |
| ListGroupsForUser | ListGroupsForUser | Invokes the ListGroupsForUser operation to query the information about the groups to which a specified Resource Access Management (RAM) user is added. |
| ListUsersForGroup | List RAM users in a specified user group | Lists the Resource Access Management (RAM) users in a specified user group. |
| AddUserToGroup | AddUserToGroup | Adds a Resource Access Management (RAM) user to a RAM user group. |
| RemoveUserFromGroup | RemoveUserFromGroup | Removes a Resource Access Management (RAM) user from a RAM user group. |
Role management
|
API |
Title |
Description |
| CreateRole | Create a role | Creates a RAM role. |
| DeleteRole | DeleteRole | Deletes a regular Resource Access Management (RAM) role. |
| UpdateRole | Update role information | Calls the UpdateRole operation to update the information of a RAM role. |
| GetRole | Get role information | Retrieves the information about a role. |
| ListRoles | List roles | Lists RAM roles. |
Permission management
|
API |
Title |
Description |
| Policy management | Policy management | |
| CreatePolicy | CreatePolicy | Creates a custom policy. |
| GetPolicy | Retrieve information of a specified access policy | Retrieves the information of a specified access policy. |
| UpdatePolicyDescription | UpdatePolicyDescription | Modifies the description of a custom policy. |
| DeletePolicy | DeletePolicy | Deletes a policy. |
| ListPolicies | List access policies | Invokes the ListPolicies operation to list access policies. |
| CreatePolicyVersion | CreatePolicyVersion | Creates a version for a policy. |
| GetPolicyVersion | Retrieve a version of an access policy | Retrieves a specific version of an access policy. |
| DeletePolicyVersion | DeletePolicyVersion | Deletes a policy version. |
| ListPolicyVersions | List access policy versions | Lists the versions of an access policy. |
| SetDefaultPolicyVersion | SetDefaultPolicyVersion | Specifies a version for a policy as the default version. |
| Authorization management | Authorization management | |
| AttachPolicyToUser | Attach a policy to a user | Attaches an access policy to a specified user. |
| DetachPolicyFromUser | Revoke a specified permission from a user | Revokes a specified permission from a user by calling the DetachPolicyFromUser operation. |
| AttachPolicyToGroup | Attach a permission to a specified user group | Calls the AttachPolicyToGroup operation to attach a permission to a specified user group. |
| DetachPolicyFromGroup | Revoke a specified permission from a user group | Calls the DetachPolicyFromGroup operation to revoke a specified permission from a user group. |
| AttachPolicyToRole | Add permission to a specified role | Calls the AttachPolicyToRole operation to add a permission to a specified role. |
| DetachPolicyFromRole | Revoke a specified access policy from a role | Revokes a specified access policy from a role. |
| ListPoliciesForUser | ListPoliciesForUser | Queries the policies that are attached to a RAM user. |
| ListPoliciesForGroup | List permission policies of a user group | Lists the permission policies attached to a user group. |
| ListPoliciesForRole | List access policies for a role | Lists the access policies attached to a role. |
| ListEntitiesForPolicy | List entities that reference an access policy | Lists the entities that reference an access policy. |
Security settings
|
API |
Title |
Description |
| SetAccountAlias | SetAccountAlias | Configures an alias for an Alibaba Cloud account. |
| GetAccountAlias | GetAccountAlias | Queries the alias of an Alibaba Cloud account. |
| ClearAccountAlias | ClearAccountAlias | Deletes the alias of an Alibaba Cloud account. |
| SetPasswordPolicy | SetPasswordPolicy | Configures the password policy for Resource Access Management (RAM) users, including the password strength. |
| GetPasswordPolicy | GetPasswordPolicy | Queries the password policy of Resource Access Management (RAM) users, including the password strength. |
| SetSecurityPreference | SetSecurityPreference | Configures the security preferences. |
| GetSecurityPreference | GetSecurityPreference | Queries the security preferences. |
Permission analysis and diagnostics
|
API |
Title |
Description |
| DecodeDiagnosticMessage | DecodeDiagnosticMessage | Decodes the permission diagnostic information from the response body of a request that was denied due to missing RAM permissions. |
Tag management
|
API |
Title |
Description |
| TagResources | TagResources | Adds tags to cloud resources which are Resource Access Management (RAM) roles and policies. |
| UntagResources | UntagResources | Removes tags from cloud resources that are Resource Access Management (RAM) roles and policies. |
| ListTagResources | ListTagResources | Queries the tags that are added to cloud resources which are Resource Access Management (RAM) roles and policies. |
Others
|
API |
Title |
Description |
| GetServiceLinkedRoleTemplate | Get service-linked role template | Retrieves the template of a service-linked role. |