Step 4: Create a RAM user as an administrator
To keep your cloud assets secure, we strongly recommend that you use a Resource Access Management (RAM) user for daily operations and management, instead of directly using your Alibaba Cloud account, which owns all assets and has the highest permissions. This topic describes how to use your Alibaba Cloud account to create a RAM user with administrator permissions and complete the first logon and security settings. After you finish this guide, log out of your Alibaba Cloud account and always use this RAM administrator for daily cloud resource management.
Why use a RAM user instead of an Alibaba Cloud account
The following table compares an Alibaba Cloud account with a RAM user.
|
Item |
Alibaba Cloud account |
RAM user |
|
Identity role |
Owner of all resources. Has full ownership and the highest permissions. |
User of resources and services. Permissions are granted by the Alibaba Cloud account. Usually corresponds to a specific person or application. |
|
Owns cloud resources |
Yes |
No. Resources are owned by the Alibaba Cloud account. |
|
Default permissions |
Full permissions. Cannot be restricted. |
No permissions by default. Must be granted by the Alibaba Cloud account. |
|
Recommended use |
Key management operations only: authorization, payment, and account management. |
Daily development, Operations and Maintenance (O&M), deployment, and other tasks. |
For more information about RAM, see What is Resource Access Management?
RAM users can only manage address and contact information in the Account Center. They cannot manage or modify other Alibaba Cloud account configurations, security information, or identity verification details.
Account security best practices
-
Create a RAM user with administrator permissions dedicated to daily management and technical operations.
-
Use your Alibaba Cloud account only when necessary, and securely store its password, MFA, and other credentials.
-
Perform all daily operations with the RAM administrator user to avoid exposing your Alibaba Cloud account in day-to-day environments.
Create a RAM user with administrator permissions
The following steps describe how to use your Alibaba Cloud account to log on to the RAM console and create a RAM user as the account administrator. Choose one of the following methods.
Quick create (recommended)
-
Log on to the RAM console with your Alibaba Cloud account. On the Overview page, click the Quick Start tab, then under Initial users click Account Administrator.
-
Review the configuration for the Account Administrator and click Perform. By default, this account administrator has console access enabled and the AdministratorAccess system policy attached. This policy grants permissions to manage all Alibaba Cloud resources.
-
After the configuration is complete, save the RAM username and logon password for this account administrator (Copy or Download).
After the account administrator is created, modify its configuration in the corresponding menu of the RAM console.
Manual create
Step 1: Create the RAM user
-
Log on to the RAM console with your Alibaba Cloud account. In the left navigation pane, choose Identities > Users, then click Create User.
-
Enter the user information.
Field
Description
Logon Name
Enter a name for the administrator, such as
administrator.Display Name
Enter an alias for easy identification, such as
Administrator.Access Mode
Select an access mode. If you select OpenAPI Access, follow the best practices for using access credentials.
Multi-Factor Authentication (MFA)
Select the required option for Enable MFA. See Attach an MFA device to a RAM user.
-
Follow the on-screen instructions to complete the security authentication.
Step 2: Grant administrator permissions
-
On the Users page, find the RAM user you created and click Add Permissions in the Actions column.
-
In the Grant Permission panel, attach the AdministratorAccess system policy to the RAM user. This policy grants permissions to manage all Alibaba Cloud resources.
Log on with the RAM user
-
Log out of your Alibaba Cloud account immediately.
-
Log on with the RAM user. Go to the RAM user logon page. Enter the RAM Username, click Next, enter the RAM Password, and click Log On.
-
Bind an MFA device. If MFA was enabled during user creation, the system prompts you to bind an MFA device, which is a second layer of protection for your administrator account. Follow the on-screen instructions to complete the binding. See Attach an MFA device to a RAM user.
Verification and next steps
After you log on successfully and complete the security settings, try accessing a console such as ECS or OSS to verify that the administrator permissions have taken effect.
From now on, perform all daily cloud resource management, development, and O&M tasks with this RAM administrator user. Keep your Alibaba Cloud account credentials safe and use them only for account management, payment, or specific account-level operations.
FAQ
What is the main difference between an Alibaba Cloud account and a RAM user?
The primary difference is in how permissions are sourced and managed. An Alibaba Cloud account has ultimate, built-in permissions that no other account can revoke or restrict. A RAM user's permissions are granted by the Alibaba Cloud account and can be modified, revoked, or disabled at any time.
This separation limits your exposure if credentials are compromised. If a RAM administrator's credentials are leaked, log on with your Alibaba Cloud account to delete or disable that RAM user immediately. If the Alibaba Cloud account itself is compromised, all resources and permissions are at risk—which is why it must be protected carefully.
Certain high-level operations—including identity verification, modifying account information, and closing an account—still require the Alibaba Cloud account. RAM users do not have permissions for these operations.