DocsICP FilingConsole
Documentation
Home Page Bastionhost Historical documents Getting Started Version 3.1 Step 2: Import RAM users

Step 2: Import RAM users

Updated at:
Copy as MD
Product
My Favorites

Before using Bastion Host for host O&M, you must create users in your Bastion Host instance. This topic shows how to import RAM users into the instance.

Prerequisites

  • You have created RAM users in the Alibaba Cloud account that contains your Bastion Host instance. For more information, see Create a RAM user.

  • Ensure that MFA authentication is enabled for the RAM users that you want to import. For more information, see Bind an MFA device.

    Note

    For Bastion Host instances of version 3.1.3 and later, you can skip this step if you do not require two-factor authentication for your RAM users.

  • The RAM users that you want to import must have the required permissions for Bastion Host.

    Bastion Host provides two types of user permissions: super administrator (admin) and O&M personnel. These permissions correspond to the AliyunYundunBastionHostFullAccess and AliyunYundunBastionHostOperateOnlyAccess system policies in Resource Access Management (RAM), respectively.

    • An Alibaba Cloud account has admin permissions and can view and manage all data.

    • An Alibaba Cloud account assigns permissions to RAM users. A RAM user can be assigned either admin or O&M personnel permissions. To follow the principle of least privilege, we recommend that you assign O&M personnel permissions to RAM users. Local users that are created directly in a Bastion Host instance have O&M personnel permissions by default.

    For instructions on how to grant permissions to RAM users, see Manage RAM user permissions.

Background information

In addition to importing RAM users, you can also create local users or import AD/LDAP users. For more information, see User management.

Importing RAM users into Bastion Host is a two-step process:

  1. Import RAM users to the Bastion Host account system. See Step 3.

  2. Import the RAM users from the Bastion Host account system to a specific Bastion Host instance. See Step 7.

Procedure

  1. Log on to the Bastion Host console.

  2. On the Accounts page, click Add RAM User.

  3. In the Add RAM User dialog box, click Refresh Sub-accounts to retrieve the current list of RAM users. Then, select the users that you want to import and click Import Sub-account.

    The RAM users are imported into the Bastion Host account system and can then be imported into specific Bastion Host instances.

  4. Log on to your Bastion Host instance.

  5. In the left navigation pane, choose Users > User Management.

  6. On the User Management page, click Import RAM User.

  7. In the Import RAM User dialog box, select the RAM users that you want to import into the instance and click Import.

    Note

    The RAM user list displays only the RAM users that you successfully imported in Step 3. If the list is empty, complete Step 3 first.

    The selected RAM users are now imported into the Bastion Host instance.

Next steps

Step 3: Create an O&M rule

Previous：Step 1: Synchronize Alibaba Cloud ECS instancesNext：Step 3: Create an O&M rule