Resource Management:What are the differences among management accounts, members, resource accounts, cloud accounts, root users, and RAM users?

Management account

An Alibaba Cloud account that has passed enterprise verification and enabled a resource directory. The management account is the super administrator with full permissions over the resource directory, all folders, and all members. Each resource directory has exactly one management account.

Member

An account within a resource directory. Members are either resource accounts (created in the directory to isolate project or application resources) or cloud accounts (existing Alibaba Cloud accounts invited to join).

• Resource account

  Created within a resource directory. Root users are disabled for resource accounts, providing higher security. For more information about how to create a resource account, see Create a member.

• Cloud account

  An existing Alibaba Cloud account invited to join a resource directory. Cloud accounts retain their root users. For more information about how to invite an Alibaba Cloud account to join a resource directory, see Invite an account to a resource directory.

Root user

A root user is the identity of an Alibaba Cloud account with full administrative permissions on all resources within that account. When you log on to the Alibaba Cloud Management Console with an Alibaba Cloud account's username and password, you are logged on as the root user.

For security, do not share the root user's password or AccessKey pairs. Instead, create a RAM user for the management account or each cloud account, grant the required permissions, and use the RAM user for related operations.

RAM user

A RAM user is a physical identity with a fixed ID and credentials in RAM. A RAM user represents a person or an application. You can create RAM users under an Alibaba Cloud account and grant them access to specific resources.