Resource Management:Root user restrictions in Resource Directory

Problem description

The root user of the management account for your Resource Directory cannot sign in to or delete member accounts, switch member account types, or bind security phones. The corresponding buttons in the console are disabled.

The Move button is also disabled. Clicking a disabled button displays the message: "Please use a RAM user with the required permissions to perform this operation."

Causes

In the best practices of Alibaba Cloud, the principle of least privilege is implemented to ensure security. A root user is an Alibaba Cloud account identity. By default, a root user has all administrative permissions on resources within the related Alibaba Cloud account. Using the root user of an account to perform operations may cause extremely high security risks and does not conform to security requirements. In a resource directory, only cloud accounts have root users. To ensure security, we recommend that you disable root users for all cloud accounts in your resource directory and use RAM users to perform related operations. You can grant permissions to RAM users based on your business requirements.

Only RAM users with required permissions can be used to perform key operations in a resource directory due to the following reasons:

• RAM users can be granted permissions based on the principle of least privilege.

• Security risks caused by misuse of the root user of an account can be prevented.

• The operations performed by using RAM users can be recorded by the system, which facilitates auditing and tracking.

Solutions

You can create a RAM user for the management account of your resource directory, grant required permissions to the RAM user, and use the RAM user to perform operations.

1. Use the root user of the management account to create a RAM user.

   Log on to the RAM console by using the root user of the management account, select Identities > Users, and click Create User to create a RAM user. In this topic, select Console Password Logon and set a console logon password. For more information, see Create a RAM user.

2. Use the root user of the management account to grant permissions to the RAM user.

   On the Users page, find the target RAM user and click Add Permissions in the Actions column. Grant the required policies. For detailed instructions, see Manage RAM user permissions.

   The following table lists the policies that are required in different scenarios.

   Scenario	Policy
   Unable to log on to the Alibaba Cloud Management Console by using a member	AliyunResourceDirectoryFullAccess, or custom policy that contains the minimum required operation permissions AliyunSTSAssumeRoleAccess
   Unable to delete a member	AliyunResourceDirectoryFullAccess, or custom policy that contains the minimum required operation permissions Note If the member deletion feature is disabled, the Delete button is also dimmed. Therefore, you need to enable the member deletion feature. For more information, see Enable the member deletion feature.
   Unable to switch the type of a member	AliyunResourceDirectoryFullAccess, or custom policy that contains the minimum required operation permissions
   Unable to bind a mobile phone number to a member for security purposes	AliyunResourceDirectoryFullAccess, or custom policy that contains the minimum required operation permissions

   Note

   The AliyunResourceDirectoryFullAccess policy defines the highest permissions on resource directories. If you want to perform only specific operations as the RAM user, we recommend that you grant the RAM user only the permissions that are required to perform the operations. For information about the permissions, see RAM authorization.

3. Log on to the Alibaba Cloud Management Console as the RAM user.

   Sign in to the Alibaba Cloud Management Console with the RAM user's username and password. Then, go to the Resource Management console to perform the required operations.