All Products
Search

This Product

    Resource Access Management:Change the login password for a RAM user

    Document Center

    Resource Access Management:Change the login password for a RAM user

    Last Updated:Sep 04, 2026

    A RAM administrator or the RAM user can change a RAM user's login password in the console or by calling an API. Use this procedure to rotate passwords for security compliance or to reset a forgotten, expired, or locked password.

    The login password of a RAM user is independent of the password of the Alibaba Cloud account. Changing the password on the security settings page of the Alibaba Cloud account does not affect the login password of the RAM user. To change the login password of a RAM user, the Alibaba Cloud account administrator must perform the operation in the RAM console.

    Impacts

    Changing a RAM user's login password has the following impacts. Perform this operation during off-peak hours.

    • Forced console sign-out: All active console sessions for the RAM user are immediately terminated. The user must sign in again with the new password.

    • Associated session termination: Any active sessions for RAM roles that the user has assumed are also terminated.

    • AccessKeys unaffected: The user's AccessKeys are not affected.

    Weak password detection and blocking

    When you create or change the login password of a RAM user, RAM checks it against a continuously updated weak-password library using encrypted comparison. Alibaba Cloud does not access, transmit, or store plaintext passwords. RAM may block a password identified as weak even if it meets the strength requirements. To learn how to configure a password policy, see Set the password policy for RAM users.

    Console

    • Detection timing: The check is triggered when you select Custom Password and submit the change. Auto-generated passwords are not checked for weakness. This applies to the following scenarios:

      • An administrator creates a new user and sets a login password.

      • An administrator resets a user's login password.

      • A user is required to reset their password at first sign-in or after it expires.

      • A user voluntarily changes their own login password.

    • Blocking behavior: If a password is identified as weak, the system blocks it and prompts you to enter a stronger one that meets the password policy.

    API

    • Prerequisite: You must enable Block risk passwords when setting passwords through API in the password policy. This option is disabled by default. For more information, see Set the password policy for RAM users.

    • Affected API operations: CreateLoginProfile, UpdateLoginProfile, and ChangePassword. If this feature is enabled, the API call fails when a weak password is provided for the Password or NewPassword parameter.

    • Error response: The API returns the error code InvalidParameter.RiskPassword.Weak, which indicates that the password is weak.

      {
  "RequestId": "7348E639-3A47-593D-9914-D7A9729D****",
  "HostId": "ims.aliyuncs.com",
  "Code": "InvalidParameter.RiskPassword.Weak",
  "Message": "The specified password was detected as a weak password, please set a stronger password.",
  "Recommend": "https://api.alibabacloud.com/troubleshoot?q=InvalidParameter.RiskPassword.Weak&product=Ims&requestId=7348E639-3A47-593D-9914-D7A9729D****"
}

    Change password as a RAM administrator

    As an Alibaba Cloud account or a RAM user with RAM administrator permissions (AliyunRAMFullAccess), you can set an initial password for a RAM user or reset a forgotten password.

    Note

    When you set or reset a RAM user's login password, you are not required to bind a phone number. You can bind a secure phone number, a security email address, or a virtual MFA device as a multi-factor authentication (MFA) method. Starting from August 20, 2024, Alibaba Cloud will gradually enforce MFA verification at logon for all RAM users. We recommend that you bind at least one MFA device in advance.

    Console

    Important

    You cannot change a RAM user's password directly from the Users list page. To change a password, click the target RAM user's name on the Users page to go to the user details page. Then, click the Authentication tab and find the Modify Logon Settings or Enable Console Logon button.

    1. Log on to the RAM console.

    2. In the left-side navigation pane, choose Identities > Users.

    3. On the Users page, click the name of the target RAM user.

    4. On the Authentication tab, you can manage the user's login credentials. For security, RAM does not allow you to view an existing password; you can only reset it. The button displayed depends on the user's status:

      • If console logon has not been configured for the user, as described in Manage console logon settings for a RAM user, click Enable Console Logon to set an initial login password.

      • If console logon is already enabled for the user, click Modify Logon Settings to change the RAM user's password.

    5. In the Modify Logon Settings panel that appears, configure a new password in the Set Logon Password section.

      • Select Keep Current Password Unchanged to make no changes to the password.

      • Select Automatically Regenerate Default Password for the system to create a new password. Record the new password and store it securely.

        Important

        The auto-generated password is displayed only once. It cannot be retrieved after you close the panel. Copy it immediately and deliver it securely to the user.

      • Select Reset Custom Password and enter a new password. The new password must comply with the current password strength policy. The default password policy of Alibaba Cloud requires a password to be 8 to 32 characters in length. To view or modify the password policy, see Set the password policy for RAM users.

        Note

        Custom passwords are checked for weakness. If a weak password is detected, the console blocks the change. For more information, see Weak password detection and blocking.

    6. (Optional) In the Password Reset section, select Required at Next Logon. This is useful when securely delivering an initial password to a user.

    7. Click OK.

    API

    1. Call the GetPasswordPolicy operation or sign in to the console to check the password strength policy for RAM users in your account. For more information, see Set the password policy for RAM users.

    2. Depending on the user's status:

    Note

    When you call the CreateLoginProfile or UpdateLoginProfile operation, if the Block risk passwords when setting passwords through API option is enabled for your account, the API call fails if a weak password is provided in the Password parameter. For more information, see Weak password detection and blocking.

    Change your own password

    If your RAM administrator allows RAM users to manage their own passwords and you remember your current password, you can change it in the console.

    Prerequisites

    Your RAM administrator must have the Allow users to manage password setting enabled. This option is enabled by default. If it is disabled, you cannot change your own password. You must contact your Alibaba Cloud account or a RAM administrator with AliyunRAMFullAccess permissions to enable this setting. For more information, see Manage security settings for RAM users.

    Console

    1. Log on to the RAM console.

    2. In the left-side navigation pane, choose Settings. In the Security section, click Modify to configure the Allow users to manage password setting.

    API

    Call the SetSecurityPreference operation and set the AllowUserToChangePassword parameter to true.

    Change your password

    Console

    1. As a RAM user, go to the RAM User Logon page and sign in.

    2. Hover over your profile picture in the upper-right corner and click Security.

    3. In the Login Profile section, click Change Password to the right of Password Management.

    4. Enter your old password and new password, and then click OK.

      Note

      The new password is checked for weakness. If a weak password is detected, the console blocks the change. For more information about the rules and behavior, see Weak password detection and blocking.

    API

    Call the ChangePassword operation.

    Note

    When you call the ChangePassword operation, if the Block risk passwords when setting passwords through API option is enabled for your account, the API call fails if a weak password is provided in the NewPassword parameter. For more information, see Weak password detection and blocking.

    FAQ

    Will my login be restricted or my account be frozen again after I reset the password?

    • If you log on from a trusted network, such as the same network as the Alibaba Cloud account or a commonly used office IP address, abnormal login restrictions are typically not triggered after a password reset.

    • Avoid using proxies, frequently switching regions, or logging on from public networks to reduce the risk of being identified as anomalous.

    • If your account is restricted or frozen due to security risk control, the Alibaba Cloud account or a RAM user with the required permissions must find the affected RAM user in the RAM console and reset the password to a strong, unique password that has not been used on other websites. The restriction is typically lifted automatically after the password is reset.

    • If you still cannot log on after resetting the password and MFA is enabled, the restriction may be imposed by the backend security system. In this case, submit a ticket to request that the restriction be lifted.

    What should I do if I still cannot log on or receive a wrong password error after resetting a RAM user's password?

    1. Verify that the password you entered is correct. We recommend that you reset the password again in the RAM console and try again.

    2. Clear your browser cache, or try using a different browser or an incognito/private browsing window.

    3. Check whether MFA is enabled for the RAM user. If MFA is enabled, you must complete MFA binding or verification during logon.

    4. Check whether the account status is normal. If you receive a message such as "Account frozen" or "Security restriction", the Alibaba Cloud account or a RAM user with the required permissions must find the affected RAM user in the RAM console and reset the password.

    Can I reset my RAM user password by myself if I cannot reach the Alibaba Cloud account administrator?

    No. RAM users cannot reset their own passwords. Only the Alibaba Cloud account or a RAM user with the AliyunRAMFullAccess permission can reset the password in the RAM console. If you cannot reach the administrator, no self-service password reset method is currently available.

    Does the login password or AccessKey secret of a RAM user change automatically?

    • The console login password of a RAM user is fixed and does not change automatically with each logon. The password changes only when it is manually changed or reset.

    • The AccessKey secret is also fixed. You can view or download the AccessKey secret as a CSV file only when the AccessKey pair is created. After you close the creation dialog box, the AccessKey secret cannot be retrieved.

    • If MFA is enabled, only the dynamic verification code changes with each logon. Basic authentication credentials, such as the password and AccessKey, remain unchanged.

    What should I do if a RAM user's password is compromised?

    1. The administrator must immediately change the login password of the affected RAM user in the RAM console.

    2. Enable multi-factor authentication (MFA) for the user to enhance account security.

    3. Check the recent operations of the user for any anomalies or unexpected charges.

    4. If the user account is no longer needed, we recommend that you delete the user to reduce security risks.