Create an AccessKey pair

What is an AccessKey pair?

An AccessKey pair is a long-term credential that Alibaba Cloud uses to authenticate programmatic requests. It consists of an AccessKey ID and an AccessKey secret.

• AccessKey ID: The public, unique identifier for your AccessKey pair.

• AccessKey secret: The private key used to sign API requests. The signature verifies the authenticity and integrity of the request. You must keep your AccessKey secret strictly confidential.

AccessKey types

AccessKey pairs are categorized into two types based on their owner:

• Alibaba Cloud account AccessKey pair (Not recommended)

  This AccessKey pair belongs to the Alibaba Cloud account. By default, it has full permissions on all resources under the account. If compromised, the security risk is extremely high. We strongly recommend that you do not create or use an AccessKey pair for your Alibaba Cloud account.

• RAM user AccessKey pair (Recommended)

  This AccessKey pair belongs to a RAM user. You must create a RAM user before you can create an AccessKey pair for it. A RAM user's AccessKey pair inherits the user's permissions, which enables least-privilege access management. As a best practice, assign a separate RAM user and AccessKey pair for each independent application. This prevents excessive permissions and reduces the blast radius if credentials are compromised.

Permission requirements

An Alibaba Cloud account has excessive permissions, so avoid using it to create AccessKey pairs in production. Instead, use a RAM user with appropriate permissions to create and manage AccessKey pairs (except those belonging to the Alibaba Cloud account).

• You can grant the AliyunRAMFullAccess (RAM administrator) system policy to an administrator to allow them to create and manage AccessKey pairs for RAM users.

• You can also enable the Allow users to manage AccessKey option in the global security settings of RAM to allow users to manage their own AccessKey pairs. For more information, see Manage security settings for RAM users.

  Note

  Enabling this setting means that all RAM users can manage their own AccessKey pairs, including creating, disabling, and deleting them, unless an administrator attaches a policy that explicitly denies these operations.

  We do not recommend enabling this setting in a production environment. To allow a specific user to manage their own AccessKey pair, we recommend using a custom policy and setting the Resource element to the user's own identity. See the following example policies:

  Create AccessKey

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ram:CreateAccessKey",
          "ram:ListAccessKeys"
        ],
        "Resource": "acs:ram:*:ACCOUNT_ID:user/USER_NAME"
      }
    ]
  }

  Manage AccessKey

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ram:CreateAccessKey",
          "ram:ListAccessKeys",
          "ram:UpdateAccessKey",
          "ram:DeleteAccessKey",
          "ram:GetAccessKeyLastUsed",
          "ram:ListAccessKeysInRecycleBin"
        ],
        "Resource": "acs:ram:*:ACCOUNT_ID:user/USER_NAME"
      }
    ]
  }

Create an AccessKey for a RAM user

Complete the following steps as a RAM administrator (a user with the AliyunRAMFullAccess policy). If you have no RAM users in your account, see Create a RAM user.

Create an Alibaba Cloud account AccessKey (Not recommended)

1. Log on to the Alibaba Cloud console with your Alibaba Cloud account.

2. Hover over your profile picture in the upper-right corner and click AccessKey.

   

3. In the We do not recommend that you use the AccessKey of your Alibaba Cloud account dialog box, read the risks of creating an AccessKey pair for your Alibaba Cloud account. If you must proceed, select the I am aware of the security risks of using a main account AccessKey. checkbox, and then click Continue to use the AccessKey of my Alibaba Cloud account.

   

4. On the AccessKey page, click Create AccessKey.

   

   Note

   An Alibaba Cloud account can have a maximum of two AccessKey pairs. One is for active use, and a second for rotation.

5. In the Create Main Account AccessKey dialog box, review the risks and limitations again. If you are sure you want to create the AccessKey pair, select the I am aware of the security risks of using a main account AccessKey. checkbox, and then click Continue to use the AccessKey of my Alibaba Cloud account.

   

6. In the Create AccessKey dialog box, save the AccessKey ID and AccessKey secret. Then, select the I have saved the AccessKey Secret checkbox and click OK.

   (Recommended) Configure an AccessKey network ACL policy: You can restrict the source IP addresses of API requests that use this AccessKey pair. This helps improve security by ensuring that the AccessKey pair is used only from trusted network environments. We recommend that you click Configure network access policy to define the trusted network environments for this AccessKey pair. For more information, see Configure an AccessKey network ACL policy for an Alibaba Cloud account.

   

   Important

   To reduce the risk of a leak, the AccessKey secret for an Alibaba Cloud account is displayed only upon creation and cannot be retrieved.