Resource Access Management (RAM) provides security settings that help protect your Alibaba Cloud account.
Password
A password is the credential that verifies your identity when you log on to Alibaba Cloud.
Keep your password secure and change it regularly.
For more information, see Change RAM user login password.
Default logon suffix
Alibaba Cloud assigns a Default Domain to each Alibaba Cloud account in the format <AccountAlias>.onaliyun.com. The default logon suffix uniquely identifies an Alibaba Cloud account and is used for RAM user logon and single sign-on (SSO).
For more information, see Manage RAM user logon domains.
Custom logon suffix
If you own a publicly resolvable domain name, you can use it as a Domain Alias to replace the default logon suffix. A custom logon suffix is an alias for the default logon suffix.
You can use a custom logon suffix only after domain ownership verification is complete. After verification, the custom logon suffix can replace the default logon suffix in all scenarios.
For more information, see Create and verify a domain alias.
AccessKey pair
An AccessKey pair consists of an AccessKey ID and an AccessKey secret. RAM uses symmetric encryption with the AccessKey ID and AccessKey secret to authenticate API request senders. Resources can be managed only after successful authentication.
The AccessKey ID identifies the caller. The AccessKey secret is used to generate a signature that RAM verifies.
The AccessKey secret is displayed only when it is created and cannot be retrieved later. Keep it secure.
For more information, see Create an AccessKey.
Multi-factor authentication (MFA)
Multi-factor authentication (MFA) adds an extra layer of protection on top of your username and password. MFA requires secondary identity verification when you log on to the console or perform sensitive operations. The following sections describe the MFA methods available for RAM users, along with usage notes and limitations.
MFA methods
|
Authentication method |
Description |
Use cases |
References |
|
Virtual MFA |
Time-based one-time password (TOTP) is a widely used MFA protocol. A virtual MFA device is an app that supports TOTP, such as the Alibaba Cloud app or Google Authenticator. After a user enables a virtual MFA device, they must enter a 6-digit verification code generated by the app during logon. This helps prevent unauthorized access if the password is compromised. |
|
|
|
Passkey |
A passkey is a more secure authentication method that can replace a password. RAM users can use passkeys for logon and as an MFA method. With a passkey, you can use the built-in fingerprint, face recognition, or PIN on your device to complete logon or MFA verification. |
|
|
|
Security email address |
Attach a security email address to a RAM user. The verification code sent to the security email address is used for secondary identity verification. |
|
How it works
After MFA is enabled and an MFA device is bound, a RAM user must provide two authentication factors when they log on to Alibaba Cloud or perform sensitive operations on the console:
-
First factor: Enter the username and password.
-
Second factor: Enter the verification code generated by a virtual MFA device or sent to a security email address, or perform passkey authentication.
Limitations
-
Virtual MFA devices support logon through a browser or the Alibaba Cloud app.
-
For limitations and supported device types for passkeys, see What is a passkey?.
-
A security email address can be attached to a maximum of five RAM users.
Secondary identity verification for sensitive operations
When a RAM user with a bound MFA device performs a sensitive operation on the console, RAM requires secondary identity verification. The user can proceed only after entering a valid verification code.
To enable secondary identity verification for all RAM users, you must first enforce MFA for all RAM users. For more information, see Manage security settings for RAM users.