Resource Access Management:Quick start: Create and use an AccessKey pair

Direct access

This method is simple but introduces risks such as hard-coded keys and excessive permissions, as the AccessKey pair is configured directly on the client. This approach is not recommended for production environments.

1. Grant the RAM user with the AccessKey pair read-only permissions to RAM by attaching the AliyunRAMReadOnlyAccess policy.

   1. Log on to the RAM console. In the left-side navigation pane, choose Identities > Users.

   2. Find the target RAM user and click Add Permissions in the Actions column.

   3. In the Add Permissions panel, search for and select the AliyunRAMReadOnlyAccess system policy, and then click OK.

   4. Return to the Users page and click the username of the target RAM user. On the Permissions > Individual tab, verify that the AliyunRAMReadOnlyAccess policy is listed.

2. Open your local terminal and run the following command to configure your credentials interactively.

   aliyun configure --profile AkProfile

3. At the prompts, enter the AccessKey ID and AccessKey secret from the Create an AccessKey pair step. Then, set the default region and language.

   Configuring profile 'AkProfile' in 'AK' authenticate mode...
   Access Key Id []: <yourAccessKeyID>
   Access Key Secret []: <yourAccessKeySecret>
   Default Region Id []: cn-shanghai
   Default Output Format [json]: json (Only support json)
   Default Language [zh|en] en: en
   Saving profile[AkProfile] ...Done.

4. If the AccessKey pair and other configurations are correct, the terminal returns a success message. If an error occurs, delete the cached Alibaba Cloud CLI credential configuration, verify your settings, and then rerun the command from Step 2.

   Configure Done!!!
   ..............888888888888888888888 ........=8888888888888888888D=..............
   ...........88888888888888888888888 ..........D8888888888888888888888I...........
   .........,8888888888888ZI: ...........................=Z88D8888888888D..........
   .........+88888888 ..........................................88888888D..........
   .........+88888888 .......Welcome to use Alibaba Cloud.......O8888888D..........
   .........+88888888 ............. ************* ..............O8888888D..........
   .........+88888888 .... Command Line Interface(Reloaded) ....O8888888D..........
   .........+88888888...........................................88888888D..........
   ..........D888888888888DO+. ..........................?ND888888888888D..........
   ...........O8888888888888888888888...........D8888888888888888888888=...........
   ............ .:D8888888888888888888.........78888888888888888888O ..............

5. Run the following command to test the API call.

   aliyun ram ListUsers --profile AkProfile

   If the configuration is successful, the command returns a list of RAM users. The output is similar to the following:

   {
     "IsTruncated": false,
     "RequestId": "B3CDEF9E-A3F4-58B0-80BE-54576991****",
     "Users": {
       "User": [
         {
           "Comments": "",
           "CreateDate": "2025-10-29T02:47:52Z",
           "DisplayName": "username",
           "UpdateDate": "2025-10-29T02:47:52Z",
           "UserId": "20376656170607****",
           "UserName": "username"
         },
         ...
       ]
     }
   }

Indirect access

This method uses the long-term AccessKey pair to obtain a temporary STS token for making API calls. Although the configuration is more complex, this approach is more secure because it reduces the risk of exposing the long-term credential and allows for dynamic permission management through roles.

1. Grant the RAM user with the AccessKey pair permission to call the STS AssumeRole operation by attaching the AliyunSTSAssumeRoleAccess policy.

   1. Log on to the RAM console. In the left-side navigation pane, choose Identities > Users.

   2. Find the target RAM user and click Add Permissions in the Actions column.

   3. In the Add Permissions panel, search for and select the AliyunSTSAssumeRoleAccess system policy, and then click OK.

   4. Return to the Users page and click the username of the target RAM user. On the Permissions > Individual tab, verify that the AliyunSTSAssumeRoleAccess policy is listed.

2. Create a RAM role and obtain its role ARN.

   1. In the RAM console, choose Identities > Roles in the left-side navigation pane.

   2. On the Roles page, click Create Role.

   3. On the Create Role page, select Cloud Account for Principal Type, specify the Alibaba Cloud account, and then click OK.

   4. In the Create Role panel, enter a role name, such as cli-test-role, and click OK.

   5. On the role details page, find the ARN in the Basic Information section. Click Copy and save the ARN for later use.

3. Grant the RAM role read-only permissions to RAM by attaching the AliyunRAMReadOnlyAccess policy.

   Go to the Identities > Roles page, click Add Permissions in the Actions column for the role, and add the permission as described in Step 1.

4. Open your local terminal and run the following command to configure your credentials interactively.

   aliyun configure --profile RamRoleArnProfile --mode RamRoleArn

5. At the prompts, enter the AccessKey ID and AccessKey secret from the Create an AccessKey pair step, and the role ARN from Step 2. For other parameters, refer to the following example.

   Configuring profile 'RamRoleArnProfile' in 'RamRoleArn' authenticate mode...
   Access Key Id []: <yourAccessKeyID>
   Access Key Secret []: <yourAccessKeySecret>
   Sts Region []: cn-shanghai
   Ram Role Arn []: acs:ram::012345678910****:role/cli-test-role
   Role Session Name []: cli-test-role
   External ID []: abcd1234
   Expired Seconds [900]: 900
   Default Region Id []: cn-shanghai
   Default Output Format [json]: json (Only support json)
   Default Language [zh|en] en: en
   Saving profile[RamRoleArnProfile] ...Done.

6. If the AccessKey pair and other configurations are correct, the terminal returns a success message. If an error occurs, delete the cached Alibaba Cloud CLI credential configuration, verify your settings, and then rerun the command from Step 4.

   Configure Done!!!
   ..............888888888888888888888 ........=8888888888888888888D=..............
   ...........88888888888888888888888 ..........D8888888888888888888888I...........
   .........,8888888888888ZI: ...........................=Z88D8888888888D..........
   .........+88888888 ..........................................88888888D..........
   .........+88888888 .......Welcome to use Alibaba Cloud.......O8888888D..........
   .........+88888888 ............. ************* ..............O8888888D..........
   .........+88888888 .... Command Line Interface(Reloaded) ....O8888888D..........
   .........+88888888...........................................88888888D..........
   ..........D888888888888DO+. ..........................?ND888888888888D..........
   ...........O8888888888888888888888...........D8888888888888888888888=...........
   ............ .:D8888888888888888888.........78888888888888888888O ..............

7. Run the following command to test the API call.

   aliyun ram ListUsers --profile RamRoleArnProfile

   If the configuration is successful, the command returns a list of RAM users. The output is similar to the following:

   {
     "IsTruncated": false,
     "RequestId": "B3CDEF9E-A3F4-58B0-80BE-54576991****",
     "Users": {
       "User": [
         {
           "Comments": "",
           "CreateDate": "2025-10-29T02:47:52Z",
           "DisplayName": "username",
           "UpdateDate": "2025-10-29T02:47:52Z",
           "UserId": "20376656170607****",
           "UserName": "username"
         },
         ...
       ]
     }
   }