Resource Access Management:RAM APIs

Scenario

Description

API selection

Difference

User management

Manage RAM users, AccessKey pairs, logon passwords, and multi-factor authentication (MFA) devices.

• IMS API

• RAM API

• IMS API supports new operations. For example, you can call an IMS operation to query the time at which an AccessKey pair was last used, to modify the default domain name, and to obtain user credential reports.

• IMS API will support new operations that are related to user management, user group management, and security settings. We recommend that you use the IMS API.

• Some RAM operations have the same features as IMS operations. You can call these RAM operations or IMS operations to achieve the same goals.

User group management

Manage RAM user groups, and add or remove RAM users in RAM user groups.

Security settings

Manage password policies, global security preferences, default domain names, user credential reports, and security reports of Alibaba Cloud accounts.

Policy management

Manage policies and grant permissions to or revoke permissions from a RAM user, RAM role, or RAM user group.

• RAM API

• Resource Management API

• Some RAM operations have the same features as Resource Management operations. You can call these RAM operations or Resource Management operations to achieve the same goals.

• You can call a Resource Management operation to grant permissions on resource groups. You cannot call a RAM operation to grant permissions on resource groups.

• Resource Management API provides operations that are related to service-linked roles.

Role management

Manage RAM roles.

Role usage

Obtain STS tokens by assuming roles.

STS API

None.

Single sign-on (SSO) management

Manage identity providers (IdPs) for user-based SSO and role-based SSO.

IMS API

None.

Role-based SSO usage

Obtain STS tokens by using role-based SSO.

STS API

None.

Open authorization (OAuth) management

Manage applications and application secrets.

IMS API

None.