Resource Management:Log on to the Alibaba Cloud Management Console as a member

Log on as a RAM role

1. Create and grant permissions to a RAM user in the management account.

   1. Log on to the RAM console with a management account.

   2. Create a RAM user.

      In this example, the RAM username is Alice. For more information, see Create a RAM user.

   3. Grant permissions to the RAM user (Alice).

      You must attach the following policies to the RAM user (Alice):

      • AliyunSTSAssumeRoleAccess: The permission to call the AssumeRole operation of Security Token Service (STS). If you need to switch from the management account to a member account, you must grant this permission to the RAM user (Alice). The switch works because STS assumes the target member's role on your behalf, which is the underlying mechanism for cross-account switching. If the RAM user (Alice) only needs read-only access and does not need to switch to a member account, you can skip this permission.

      • AliyunResourceDirectoryFullAccess: The permission to manage Resource Directory.

      Note

      If the RAM user (Alice) is used as an account administrator, you can directly grant the AdministratorAccess permission. This is a high-risk permission. Grant it with caution.

      If you encounter a logon error or fail to switch to a member account after you grant the preceding permissions, troubleshoot the issue as follows:

      1. Check for missing permissions. Confirm that the RAM user (Alice) also has the resourcedirectory:AssumeRoleInMember and resourcedirectory:ListAccounts permissions, which are required to switch member accounts and list accounts in the resource directory. If either permission is missing, grant it and try switching the member account again.

      2. Check the role status. If the switch still fails after you grant the preceding permissions, check whether the ResourceDirectoryAccountAccessRole role exists in the target member account and whether its trust policy and permissions are configured correctly. An incorrect trust policy or missing authorization on this role can also cause the switch to fail.

      For more information, see Manage RAM user permissions.

2. Use the RAM user (Alice) to log on to the member account by assuming a RAM role.

   1. Log on to the Resource Management console as the RAM user (Alice).

   2. In the left-side navigation pane, choose Resource Directory > Management.

   3. In the Resource Organization View or Member List View, click Log On in the Actions column of the target member.

      After you log on, the management account's RAM user (Alice) assumes the target member's RAM role (ResourceDirectoryAccountAccessRole). The user can then perform operations that are within the scope of this role.

Log on as a RAM user

1. Log on to the member account by assuming a RAM role from the management account.

   For more information, see Log on as a RAM role.

2. Create a RAM user within the member account.

   In this example, the RAM username is Tom. For more information, see Create a RAM user.

3. Grant permissions to the RAM user (Tom).

   You must follow the principle of least privilege to grant the RAM user (Tom) permissions to access specific cloud resources. For more information, see Manage RAM user permissions.

4. Log on as the RAM user (Tom).

   For more information, see Log on as a RAM user.

Log on with an Alibaba Cloud account (not recommended)

1. Go to the Alibaba Cloud Management Console login page.

2. Enter the username and password of the Alibaba Cloud account.

3. Click Logon.

Log on as a CloudSSO user

Configure the relevant settings in CloudSSO. For more information, see Use CloudSSO to centrally manage the identities and permissions of multiple accounts. Then, log on as the CloudSSO user. For more information, see Sign in to the CloudSSO user portal.