Documentation
Home Page ApsaraVideo VOD Security and Compliance Use RAM for access control Create a RAM user and grant permissions

Create a RAM user and grant permissions

Updated at:
Copy as MD
Product

Create independent RAM users for employees, systems, or applications and grant only the permissions they need. RAM users are free to create; the associated Alibaba Cloud account pays for resources they consume.

Prerequisites

An Alibaba Cloud account is created and identity verification is complete. To create an Alibaba Cloud account, visit the Alibaba Cloud official website. For more information, see Create an Alibaba Cloud account.

Create a RAM user

Note

  • In Step 4, set the logon name to vod. The examples below use this name.

  • In Step 5, select OpenAPI access as the access mode.

Procedure

Console

  1. Sign in to the RAM console using your Alibaba Cloud account or as a RAM user with administrative permissions (a user to which the AliyunRAMFullAccess policy is attached).

  2. In the left-side navigation pane, choose Identities > Users.

  3. On the Users page, click Create User.

  4. On the Create User page, in the User Account Information section, configure the user's basic information.

    • Logon Name (required): Up to 64 characters. Allows letters, digits, periods (.), hyphens (-), and underscores (_).

    • Display Name (optional): The name can be up to 128 characters long.

    • Tag (optional): Click edit, then enter a tag key and tag value to categorize and manage users.

    Note

    Click Add User to create multiple RAM users in bulk.

  5. In the Access Mode section, select an access mode based on the user type.

    Important
    Console access

    Select Console Access.

    • Set Logon Password: Auto-generate or set a custom password. Custom passwords must meet the configured complexity requirements. Set a password policy for RAM users.

    • Password Reset: Specify whether the user must reset their password at next sign-in.

    • Enable MFA: MFA is required for all users by default. To change this setting, see Manage RAM user security settings. Users must bind an MFA device at first sign-in. Bind an MFA device.

    Programmatic access

    Select Using permanent AccessKey to access.

    The system automatically creates an AccessKey ID and AccessKey secret for the RAM user.

    Important

    The AccessKey secret is shown only at creation and cannot be retrieved later. You must immediately download or copy and save the AccessKey secret. A leaked AccessKey pair compromises all resources under your account. Create an AccessKey pair.

OpenAPI

Create a RAM user for console access

  1. Call GetDefaultDomain to obtain the default logon suffix of an account. The format is <AccountAlias>.onaliyun.com.

  2. Call the CreateUser operation to create a RAM user. The following parameters are required:

    1. UserPrincipalName: The logon name for a RAM user. The format is <username>@<AccountAlias>.onaliyun.com, where <username> is the RAM username and <AccountAlias>.onaliyun.com is the default logon suffix.

    2. DisplayName: The display name for the RAM user. It can be different from the <username> above.

  3. Call the CreateLoginProfile operation to create a login profile and configure access mode and MFA. Recommended settings:

    1. UserPrincipalName: The information of the user created in the previous step.

    2. Password: Set per the account's password strength requirements. Call the GetPasswordPolicy operation to query the current password policy.

    3. MFABindRequired: Set to true to require MFA for RAM users.

    4. Status: Enables or disables console password logon. Default: Active.

Create a RAM user for programmatic access

  1. Call GetDefaultDomain to obtain the default logon suffix for an account. The suffix is in the format <AccountAlias>.onaliyun.com.

  2. Call the CreateUser operation to create a RAM user. The following parameters are required:

    1. UserPrincipalName: The logon name of a RAM user in the format <username>@<AccountAlias>.onaliyun.com, where <username> is the RAM username and <AccountAlias>.onaliyun.com is the default logon suffix.

    2. DisplayName: The display name for the RAM user, which can be different from the <username> above.

  3. To create an AccessKey pair (AccessKey), call the CreateAccessKey operation and pass only the UserPrincipalName for the user that you created in the previous step.

    Important

    The CreateAccessKey response contains the AccessKeyId and AccessKeySecret. The AccessKeySecret appears only once and cannot be retrieved later — save it immediately. A leaked AccessKey compromises all resources in your account. For more information, see Create an AccessKey.

Important

When you click OK, the system generates the logon password and AccessKey pair (AccessKey ID and AccessKey Secret) for the RAM user. Save the logon password and AccessKey information immediately. This information cannot be retrieved.

Grant permissions to a RAM user

  1. In the RAM console, on the Users page, find the RAM user (for example, vod) and click Add Permissions in the Actions column.

  2. In the Grant Permission panel, grant permissions to the RAM user.

    Note

    Attach the AliyunVODFullAccess system policy to the vod user for full access to ApsaraVideo VOD resources. Search for AliyunVODFullAccess in the search box. For policy definitions and permissions, see System authorization policies.

    Select Account Level as the Resource Scope, select the AliyunVODFullAccess policy, and click Confirm Authorization.

    • Select a Resource scope:

      • Account level: Applies to the entire Alibaba Cloud account.

      • Resource group level: Applies only to the specified resource group. The RAM user must switch to the authorized resource group in the console's top navigation bar to manage resources.

        Note

        1. High-risk system policies such as AdministratorAccess and AliyunRAMFullAccess are automatically flagged. These policies grant full control over cloud resources or full RAM management permissions. Grant them with caution.

        2. Example: Use a resource group to grant a RAM user permissions to manage specific ECS instances.

    • Select a Principal:

      The current RAM user is selected automatically when you start from the Users page. From the Grant Permission page, manually select one or more RAM users.

    • Select a Permission policy:

      • System policy: Search and select policies directly. You can search by product name (ECS, OSS), permission level (ReadOnly, FullAccess), or full policy name.

      • Custom policy: You must create a custom policy before granting it.

    • Click Confirm Authorization.

  3. Review the authorization summary and click Close.

Next steps

To grant the RAM user console logon permission later, go to Manage RAM user logon settings.

Previous：Service role for ApsaraVideo VODNext：System policies for VOD