If your enterprise uses multiple cloud resources, use RAM to create individual user accounts, delegate permissions, and centrally manage resource access.
Prerequisites
Before you begin, ensure you have an Alibaba Cloud account. If not, create one.
Scenario
Company A is migrating Project-X to the cloud and uses several Alibaba Cloud resources, including ECS instances, RDS instances, SLB instances, and OSS buckets.
Company A has these requirements:
-
Prevent multiple employees from sharing a single Alibaba Cloud account, which risks exposing passwords or AccessKey pairs.
-
Create individual user accounts for employees and grant permissions independently to ensure accountability.
-
Ensure users operate only on authorized resources and that all actions are auditable.
-
Revoke permissions from user accounts or delete accounts at any time.
-
Avoid separate billing for individual user accounts. The Alibaba Cloud account consolidates all charges into a single bill.
Solution
-
Enable multi-factor authentication (MFA) for your Alibaba Cloud account to prevent password exposure risks. Bind or unbind a U2F security key.
-
Create RAM users for employees or applications, and set logon passwords or AccessKey pairs as needed. Create a RAM user.
-
If multiple employees share the same responsibilities, create a user group and add them to it. Create a RAM user group.
-
Attach one or more system policies to a RAM user or user group. Grant permissions to a RAM user or Grant permissions to a RAM user group. For finer-grained authorization, use custom policies. Create a custom permission policy.
-
Revoke permissions from RAM users or user groups that no longer need them. Revoke permissions from a RAM user or Revoke permissions for a RAM user group.