Resource Access Management:Best practices for identity and access management

1. Avoid routine operations with the Alibaba Cloud account

• Best practice: The Alibaba Cloud account is similar to the root user in a Linux system. It has all permissions but is unsuitable for daily use.

1. Create a RAM user with administrator permissions dedicated to daily management and technical operations.

2. Use your Alibaba Cloud account only when necessary, and securely store its password, MFA, and other credentials.

3. Perform all daily operations with the RAM administrator user to avoid exposing your Alibaba Cloud account in day-to-day environments.

• Recommendations:

• Create dedicated RAM users: First, create a RAM user with administrator permissions. For instructions, seeCreate a RAM user as an administrator. Then, create an independent RAM user for each member of your organization. For instructions, seeCreate a RAM user and grant permissions.

• Enable MFA for the Alibaba Cloud account: To complete the security hardening of the Alibaba Cloud account, followConfigure MFA for the account.

2. Establish a more secure logon mechanism

• Best practice: For human identities, protecting usernames and passwords is especially important. Complex passwords, regular rotation, and MFA significantly increase the difficulty of cracking password credentials.

• RAM operation guide:

  • Increase password complexity: Use thepassword policyto set the minimum length and complexity requirements of RAM user passwords, the password validity period, such as a maximum of 90 days, and the password retry limit. This strengthens the security of RAM user passwords.

  • Enforce MFA for RAM users:MFAis a second line of defense beyond passwords. Even if a password is leaked, MFA effectively blocks unauthorized logons. In thesecurity settings, you can set MFA for RAM user sign-infor all RAM users in the account.

3. Implement unified authentication for human identities (SSO)

• Best practice: With single sign-on (SSO), identity authentication is delegated to a unified enterprise identity provider (IdP), so you no longer need to maintain a separate password system in the cloud. Employee onboarding, offboarding, and permission changes can all be completed in one IdP, achieving centralized management of the identity lifecycle.

• Recommendations: Use theSSOmanagement feature of RAM to federate your enterprise IdP, such as Active Directory or Okta, with the Alibaba Cloud identity system based on the SAML 2.0 or OpenID Connect (OIDC) protocol. Based on your environment and logon requirements, configureuser-based SSOorrole-based SSO.

  Note

  If your enterprise uses aresource directory (RD)to manage multiple Alibaba Cloud accounts, we recommend that you usecloud single sign-on (CloudSSO)to achieve unified identity and permission management across accounts.

1. Prefer temporary credentials (STS tokens)

• Best practice: Once created, a permanent AccessKey remains valid until it is manually deleted. Once an AccessKey is leaked, the risk persists and threatens the security of all resources in the account. In contrast, a Security Token Service token (STS token) obtained by assuming a RAM Roleexpires automatically after the session duration that you specify when you assume the role. This duration cannot exceed the maximum session duration of the role, which is measured in hours. Even if the token is leaked accidentally, the time window for exploiting it is minimal.

• Recommendations: Use AK-free methods to obtain STS tokens, such as ECS instance role assumption, container instance role assumption, or Function Compute role assumption. These AK-free methods remove the need to manage AccessKey pairs, to avoid exposing AccessKey pairs entirely. For more information, seeBest practices for obtaining STS tokens.

2. Properly store and use unavoidable AccessKey pairs

• Best practice: In scenarios where STS tokens cannot be used, such as local development and debugging, if you must use permanent AccessKey, avoid using the AccessKeyof the Alibaba Cloud account. Make sure that each AccessKeyis used by only one application in one environment, and rotate it regularly.

• Recommendations:

  • Do not use the AccessKey of the Alibaba Cloud account: In scenarios where AccessKeymust be used, replace it with the AccessKeyof a RAM user that has the appropriate permissions. For instructions, see.

  • Do not share AccessKey pairs: Create an independent RAM Userand a dedicated AccessKeyfor each application and each environment, including development, testing, and production. For instructions, seeManage AccessKey pairs. Keep your AccessKey ID and AccessKey secret safe. Do not share AccessKey information with others or record it in public documents.

  • Rotate AccessKey pairs regularly: When a RAM user has two AccessKey pairs enabled, use one for daily operations and reserve the other for rotation only. For instructions, seeManage AccessKey pairs.

  • Grant least privilege: Grant the least privilege policy for the scenario to the RAM Userthat owns the AccessKey. Periodicallyreview permissionsandrevoke permissionsas needed.

  • Never hardcode credentials in code: Manage AccessKey through Best practices for obtaining STS tokens orKMS Secrets Manager. Never write AccessKeyin plaintext into code repositories.

  • Restrict access: Configure network access policies to restrict AccessKey access to specified IP addresses only. For instructions, see Configure access restrictions.

  • Disable and recycle idle AccessKey pairs in a timely manner: Set the maximum idle duration of AccessKey pairs to within 365 days. A value of 90 days is recommended. For instructions, see Security settings.

  • Monitor and audit: Use ActionTrail to monitor AccessKey usage and detect anomalous behavior promptly.

1. Grant least privilege access

• Best practice: Grant an identity only the minimum permissions required to complete its intended tasks. This minimizes the potential impact if credentials are stolen.

• Recommendations:

  • Use a custom policy: In non-administrator scenarios, avoid a system policy with overly broad permissions, such as AdministratorAccess. Use acustom policyfor fine-grained authorization, and explicitly specify the resource, the action (Action/NotAction), and the condition (Condition).

  • Review permissions regularly: Periodicallyreview permissionsandrevoke permissionsas needed.

2. Simplify permission management with RAM user groups

• Best practice: Bind permissions to responsibilities. Simplify permission changes for a single RAM Userinto adjustments of the RAM Groupthat the user is assigned to. This improves management efficiency and keeps responsibilities consistent.

• Recommendations:

  • Create RAM user groups: Create groups based on the job responsibilities in your organization, such as a network administrator group or an application developer group. For instructions, seeCreate RAM user groups.

  • Configure permission policies: Attach permission policies that match job responsibilities. For instructions, seeAttach an access policy to a group. Do not attach policies directly to each RAM User.

3. Set permission boundaries in multi-account environments

• Best practice: For organizations with multiple Alibaba Cloud accounts, you can use Resource Directory-based control policies to restrict the permission scope of RAM identities within member accounts.

• Recommendations: In a multi-account environment with the resource directory enabled, when a RAM Useror a RAM Roleidentity in a member account tries to access Alibaba Cloud services, Alibaba Cloud first performs a control policy check, and then performs the RAM permission check within the account. For more information, seeControl policies. Before binding control policies, test them on a small scale first to make sure that they take effect as expected, and then bind them to all target nodes, including folders and members.