Overview of Resource Access Management

Scenarios

The following are common scenarios for using Resource Access Management (RAM).

• Use RAM users to manage permissions

  Enterprise A has purchased a variety of Alibaba Cloud products for a project (Project-X), such as ECS instances, RDS instances, SLB instances, and OSS buckets. Multiple employees need to perform operations on these cloud resources. Different employees require different permissions to fulfill their duties. Enterprise A has the following requirements:

  • For security or trust reasons, A does not want to directly disclose the cloud account key to employees, but hopes to create independent accounts for employees.
  • The RAM users can perform operations on resources only after they are granted the corresponding permissions. A can revoke permissions on a user account at any time, or delete the user account it created at any time.
  • You do not need to perform separate metering and billing for user accounts, and all expenses are borne by A.

  To meet the preceding requirements, you can use the authorization management function of RAM to implement user decentralization and unified resource management.

• Use RAM roles to access resources across accounts

  Alibaba Cloud Account A and Alibaba Cloud Account B represent different enterprises. A purchases a variety of cloud resources to carry out business, such as ECS instances, RDS instances, SLB instances, and OSS buckets.

  • Enterprise A wants to focus on business systems, and authorizes tasks such as cloud resource O&M, monitoring, and management to Enterprise B.
  • Enterprise B can further assign A's resource access permissions to one or more employees of B, and B can finely control its employees' operation permissions on resources.
  • If the O&M relationship between A and B is terminated, A can revoke the authorization to B at any time.

  To meet the preceding requirements, you can use RAM roles to implement cross-account authorization and resource access control.

Access policies