Step 4: Create a RAM user as an administrator
Your Alibaba Cloud account has unrestricted permissions and cannot be limited by any policy. To reduce exposure if credentials are compromised, create a RAM user with administrator permissions and use it for all daily operations.
Why use a RAM user instead of an Alibaba Cloud account
The following table compares an Alibaba Cloud account with a RAM user.
| Item | Alibaba Cloud account | RAM user |
|---|---|---|
| Identity role | Owner of all resources. Has full ownership and the highest permissions. | User of resources and services. Permissions are granted by the Alibaba Cloud account. Usually corresponds to a specific person or application. |
| Owns cloud resources | Yes | No. Resources are owned by the Alibaba Cloud account. |
| Default permissions | Full permissions. Cannot be restricted. | No permissions by default. Must be granted by the Alibaba Cloud account. |
| Recommended use | Key management operations only: authorization, payment, and account management. | Daily development, Operations and Maintenance (O&M), deployment, and other tasks. |
For more information about RAM, see What is Resource Access Management?
When you still need to use your Alibaba Cloud account
The following operations require your Alibaba Cloud account. RAM users cannot perform them:
Change the account email address, password, or phone number
Complete real-name verification or identity verification
Close the account
Delete or disable a RAM user whose credentials are compromised
For all other daily tasks—resource management, development, O&M, deployment—use the RAM administrator user you create in this step.
Account security best practices
Create a RAM user with administrator privileges for all daily management and technical operations.
Use your Alibaba Cloud account only when the operations above require it. Store its password and multi-factor authentication (MFA) credentials securely and do not share them.
Perform all daily operations with the RAM administrator user to avoid exposing your Alibaba Cloud account in day-to-day work environments.
If a RAM administrator's credentials are compromised, log on with your Alibaba Cloud account to delete or disable that RAM user immediately.
RAM users can currently manage only address and contact information in the Account Center. They cannot manage or modify other Alibaba Cloud account configurations, security information, or identity verification details.
Create a RAM user with administrator permissions
Log on to the RAM console with your Alibaba Cloud account to complete the steps below. RAM users do not have permission to perform these operations.
Choose one of the following methods.
Quick create (recommended)
Log on to the RAM console with your Alibaba Cloud account. On the Overview page, click QuickStart > Account Administrator.
Review the configuration for the Account Administrator and click Perform. By default, this account administrator has console access enabled and the AdministratorAccess system policy attached. This policy grants permissions to manage all Alibaba Cloud resources.
After the configuration is complete, save the RAM username and logon password for this account administrator.
After the account administrator is created, modify its configuration in the corresponding menu of the RAM console.
Manual create
Step 1: Create the RAM user
Log on to the RAM console with your Alibaba Cloud account. In the left navigation pane, choose Identities > Users, then click Create User.
Enter the user information.
Field Description Logon Name Enter a name for the administrator, such as administrator.Display Name Enter an alias for easy identification, such as Administrator.Access Mode Select an access mode. If you select OpenAPI Access, follow the best practices for using access credentials. Multi-Factor Authentication (MFA) Select the required option for Enable MFA. See Attach an MFA device to a RAM user. 
Follow the on-screen instructions to complete the security authentication.
Step 2: Enable MFA
We strongly recommend enabling multi-factor authentication (MFA) for the RAM administrator user. MFA adds a second layer of security by requiring a one-time code in addition to the password.
Select the required option for Enable MFA during user creation, or configure it afterward. For instructions, see Attach an MFA device to a RAM user.
Step 3: Grant administrator permissions
On the Users page, find the RAM user you created and click Add Permissions in the Actions column.
In the Grant Permission panel, attach the AdministratorAccess system policy to the RAM user. This policy grants permissions to manage all Alibaba Cloud resources.
Log on with the RAM user
Log out of your Alibaba Cloud account immediately.
Log on with the RAM user. Go to the RAM user logon page. Enter the RAM Username, click Next, enter the RAM Password, and click Log On.
From now on, use this RAM administrator user for all daily tasks, including cloud resource management, development, and O&M.
FAQ
What is the main difference between a RAM user and an Alibaba Cloud account?
The primary difference is in how permissions are sourced and managed. An Alibaba Cloud account has ultimate, built-in permissions that no other account can revoke or restrict. A RAM user's permissions are granted by the Alibaba Cloud account and can be modified, revoked, or disabled at any time.
This separation limits your exposure if credentials are compromised. If a RAM administrator's credentials are leaked, log on with your Alibaba Cloud account to delete or disable that RAM user immediately. If the Alibaba Cloud account itself is compromised, all resources and permissions are at risk—which is why it must be protected carefully.
Certain high-level operations—including identity verification, modifying account information, and closing an account—still require the Alibaba Cloud account. RAM users do not have permissions for these operations.