Access control overview
Resource Access Management (RAM) lets you grant team members fine-grained access to ARMS without sharing your Alibaba Cloud account AccessKey pair. Use RAM to create individual user accounts, assign per-user permissions, and delegate cross-account access -- all revocable at any time.
System policies
ARMS provides two built-in policies. Attach these to RAM users or roles to control access.
| Policy | Type | Description |
|---|---|---|
| AliyunARMSFullAccess | System | Full access to all ARMS operations. |
| AliyunARMSReadOnlyAccess | System | Read-only access to ARMS. |
To grant the read-only permissions on all ARMS features to a specific resource group, you must attach the AliyunARMSReadOnlyAccess policy to and grant the ReadTraceApp permission to the resource group. Otherwise, ARMS cannot display the application list that belongs to the authenticated resource group.
Grant per-user permissions with RAM users
Create a RAM user for each team member so that no one needs the Alibaba Cloud account AccessKey pair. Each RAM user gets independent credentials and only the permissions you assign.
This approach applies when you need to:
Avoid exposing the Alibaba Cloud account AccessKey pair to employees.
Grant each employee only the permissions required for their role.
Revoke permissions or delete a RAM user account at any time.
Keep billing consolidated under one Alibaba Cloud account -- RAM user activity is not billed separately.
For detailed steps, see Use RAM users to manage permissions.
Grant cross-account access with RAM roles
Assign a RAM role to an external account (for example, an O&M partner) so they can operate on your ARMS resources under controlled permissions. Revoke the delegation at any time.
This approach applies when you need to:
Outsource cloud resource O&M, monitoring, or management to another enterprise.
Allow the partner enterprise to distribute resource access across its own employees with fine-grained control.
Revoke all cross-account access immediately if the partnership ends.
For detailed steps, see Use a RAM role to access resources across Alibaba Cloud accounts.