This topic introduces some basic concepts of security settings in the Resource Access Management (RAM) console.
An identity credential that is used to log on to the Alibaba Cloud Management Console.
For more information about how to configure a logon password, see Change the logon password of a RAM user.
default domain name
The domain name that is used to identify the Alibaba Cloud account. Alibaba Cloud assigns a default domain name to each Alibaba Cloud account. The default domain name is in the
<AccountAlias>.onaliyun.com format. The default domain name can be used for RAM user logon and single sign-on (SSO) management.
For more information, see View and modify the default domain name.
A custom domain name that you can use to replace the default domain name. The custom domain name must be publicly resolvable. A domain alias is the alias of the default domain name.
For more information, see Create and verify a domain alias.
An identity credential that is used to verify access identities. Each AccessKey pair consists of an AccessKey ID and an AccessKey secret. You can use your AccessKey pair or Alibaba Cloud SDK to sign API requests that you send to Alibaba Cloud. The AccessKey ID and AccessKey secret are used for symmetric encryption and identity verification. After the identity is verified, you can manage Alibaba Cloud resources by calling operations.
The AccessKey ID is used to identify a user, and the AccessKey secret is used to encrypt and verify a signature string.
For more information, see Create an AccessKey pair.
multi-factor authentication (MFA)
MFA is an easy-to-use and effective authentication model and is a supplement to the username and password authentication model. MFA provides an extra layer of protection by verifying users who initiate console logon or perform sensitive operations. MFA enhances the security of your account. The following section describes MFA methods that are supported by RAM users. The following section also describes usage notes and limits of MFA in RAM.
|Virtual MFA devices||Time-based one-time cipher algorithm (TOTP) is a multi-factor authentication protocol that is widely used. Applications that support TOTP on devices such as mobile phones are called virtual MFA devices. For example, both the Alibaba Cloud app and the Google Authenticator app are virtual MFA devices. If you enable a virtual MFA device, you must enter the 6-digit verification code that is generated on the device when you log on to the Alibaba Cloud Management Console. This prevents unauthorized logon due to password theft.||Bind a virtual MFA device to a RAM user|
|U2F security keys||Universal 2nd Factor (U2F) is a multi-factor authentication protocol that is widely used and hosted by the Fast Identity Online (FIDO) Alliance. For more information, visit Fast Identity Online (FIDO) Alliance. The protocol is used to provide an efficient and universal multi-factor authentication method. A hardware device that supports Web Authentication is a U2F security key. You can plug a U2F security key into a USB port on your computer. Then, you can complete multi-factor authentication by tapping the button on the device when you log on to the Alibaba Cloud Management Console. For more information, see Web Authentication.||Bind a U2F security key|
After you enable MFA and bind an MFA device to a RAM user, the RAM user must perform the following steps when the RAM user logs on to the Alibaba Cloud Management Console of perform sensitive operations:
- Enter the username and password of your account.
- Enter the verification code that is generated by the virtual MFA device. Alternatively, pass the U2F authentication.
- RAM users support both virtual MFA devices and U2F security keys. However, you can bind only one virtual MFA device or one U2F security key to a RAM user.
- Virtual MFA can be used when you log on to the Alibaba Cloud Management Console from a browser or the Alibaba Cloud app.
- U2F security keys have the following limits:
- U2F security keys can be used only on computers with USB ports. If you log on to the Alibaba Cloud Management Console from a browser on a mobile device or from the Alibaba Cloud app, you cannot use U2F security keys. If you use a virtual machine or Remote Desktop Services, U2F authentication is not supported.
- You can use U2F security keys only when you log on to the Alibaba Cloud Management Console by using the signin.alibabacloud.com domain name. If you use the signin-intl.aliyun.com domain name that was previously supported by Alibaba Cloud, U2F authentication is not supported.
- You can use U2F security keys in the following versions of browsers that support Web Authentication (WebAuthn):
- Google Chrome 67 and later
- Opera 54 and later
- Mozilla Firefox 60 and laterNote If you use Mozilla Firefox, you must manually enable the U2F feature by performing the following operations: Enter
about:configin the address bar of your browser to go to the browser configuration page. On this page, search for
u2fand set the security.webauth.u2f parameter to true. For more information, see the Mozilla Firefox help documentation.
MFA for sensitive operations
MFA is required for sensitive operations. If a RAM user for which an MFA method is enabled wants to perform a sensitive operation in the Alibaba Cloud Management Console, risk control is triggered and the RAM user is required to pass identity authentication again. The RAM user can perform the sensitive operation only after the RAM user enters a valid verification code.
Before you can implement identity authentication for sensitive operations for all RAM users, you must enable MFA for all RAM users. For more information, see Manage security settings of RAM users.