Resource Access Management:Create an AccessKey pair

What is an AccessKey pair?

An AccessKey pair is a long-term security credential used to authenticate programmatic requests to Alibaba Cloud APIs. It consists of an AccessKey ID and an AccessKey secret.

• AccessKey ID: The unique public identifier for the AccessKey pair.

• AccessKey secret: A secret key used to calculate the digital signature for an API request. This signature verifies the request's authenticity and integrity. You must keep your AccessKey secret strictly confidential.

AccessKey pair categories

An AccessKey pair can belong to either an Alibaba Cloud account or a RAM user. AccessKey pairs are categorized based on their owner:

• Alibaba Cloud account AccessKey pair (Not recommended)

  This type of AccessKey pair belongs to an Alibaba Cloud account. It has full permissions to all resources in the account. A compromised AccessKey pair poses an extremely high security risk. We strongly recommend that you do not create or use a Alibaba Cloud account AccessKey pair.

• RAM user AccessKey pair (Recommended)

  This type of AccessKey pair belongs to a RAM user. It has only the permissions that are granted to that user, which allows you to follow the principle of least privilege. As a best practice, create a unique RAM user and AccessKey pair for each application. This reduces the risk of exposure that can result from sharing credentials.

Permission requirements

Because an Alibaba Cloud account has full access to all resources, you should avoid using it to create AccessKey pairs in a production environment. Instead, as a best practice, use a RAM user that is granted only the necessary permissions to create and manage AccessKey pairs for other RAM users.

• You can attach the AliyunRAMFullAccess system policy to an administrator to allow them to create and manage AccessKey pairs for RAM users.

• You can also allow RAM users to manage their own AccessKey pairs by enabling the Allow users to manage AccessKey option in the global security settings of RAM. For more information, see Manage the security settings of RAM users.

  Note

  Enabling this setting allows all RAM users to manage their own AccessKey pairs. This includes all related operations, such as creating, disabling, and deleting AccessKey pairs, unless an administrator attaches a policy that explicitly denies these operations.

  We do not recommend enabling this setting in a production environment. To allow specific RAM users to manage their own AccessKey pairs, we recommend that you use a custom policy and set the Resource element in the policy to the user's own Alibaba Cloud Resource Name (ARN). The following sample policies are for your reference:

  Allow a RAM user to create their own AccessKey pair

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ram:CreateAccessKey",
          "ram:ListAccessKeys"
        ],
        "Resource": "acs:ram:*:ACCOUNT_ID:user/USER_NAME"
      }
    ]
  }

  Allow a RAM user to manage their own AccessKey pair

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ram:CreateAccessKey",
          "ram:ListAccessKeys",
          "ram:UpdateAccessKey",
          "ram:DeleteAccessKey",
          "ram:GetAccessKeyLastUsed",
          "ram:ListAccessKeysInRecycleBin"
        ],
        "Resource": "acs:ram:*:ACCOUNT_ID:user/USER_NAME"
      }
    ]
  }

Create an AccessKey pair for a RAM user

A RAM administrator (a user with the AliyunRAMFullAccess policy attached) can perform the following operations. If you do not have any RAM users under your account, create one first.

Create an AccessKey pair for an Alibaba Cloud account (Not recommended)

1. Log on to the RAM console with your Alibaba Cloud account.

2. Hover over the profile picture in the upper-right corner of the page that appears and click AccessKey.

   

3. In the Main Account AccessKey is not recommended dialog box, review the risks of creating an AccessKey pair for your Alibaba Cloud account. To proceed, select I am aware of the security risks of using a main account AccessKey, and click Use Main Account AccessKey.

   

4. On the AccessKey page, click Create AccessKey.

   

   Note

   An Alibaba Cloud account can have a maximum of two AccessKey pairs. One is for regular use, and the other is created for rotation to replace the old one.

5. In the Create Main Account AccessKey dialog box, review the security risks and limits again. To create the AccessKey pair, select I am aware of the security risks of using a main account AccessKey, and click Use Main Account AccessKey.

   

6. In the Create AccessKey dialog box, save the AccessKey ID and AccessKey secret, select I have saved the AccessKey Secret, and click OK.

   (Optional) Configure AccessKey Network Access Control: You can restrict the source IP addresses for API requests that use the AccessKey pair. This improves security by restricting access to the AccessKey pair to trusted network environments. We recommend that you identify the network environment where the AccessKey pair is used, and click Go to Settings. For more information, see Configure an AccessKey-level network access restriction policy for a RAM user.

   

   Important

   To reduce the risk of leaks, the AccessKey secret of an Alibaba Cloud account is displayed only when you create it. You cannot retrieve it later. Make sure to store it securely.