Configure Alibaba Cloud CLI identity credentials using an AccessKey. This guide covers interactive, non-interactive, and environment variable methods for automation scenarios requiring stable, long-term authentication, such as CI/CD pipelines and scheduled tasks.-Alibaba Cloud CLI(CLI)-阿里云帮助中心

An AccessKey (AK) is a long-lived credential for a RAM user. It is suitable for automation scenarios that require stable, long-term authentication, such as CI/CD pipelines, scheduled tasks, and remote terminals without browser access. This topic describes how to configure, verify, and delete AccessKey credentials in Alibaba Cloud CLI.

Prerequisites

Important

An AccessKey is a long-term credential that does not expire automatically. If an AccessKey is compromised, an attacker can continuously access all authorized cloud resources until the AccessKey is manually disabled or deleted in the RAM console.

If your runtime environment supports them, we recommend using OAuth credentials or RAM role credentials instead. For a comparison of different credential types, see Configure and manage identity credentials.

Alibaba Cloud CLI version ≥ 3.3.0. Run aliyun version to check your current version. If your version is earlier than 3.3.0, see Install/Update CLI to upgrade.
You must have the AccessKey ID and AccessKey Secret for a RAM user. We recommend using the AccessKey of a RAM user instead of an Alibaba Cloud account. An Alibaba Cloud account has permissions to all resources, and the impact of a leak is uncontrollable. To learn how to obtain an AccessKey, see CreateAccessKey.

Configure credentials

The Alibaba Cloud CLI provides three methods to configure an AccessKey: interactive configuration, non-interactive configuration (for scripting and automation), and environment variables (for CI/CD pipelines). All three methods produce the same result.

Interactive configuration

Run the following command to start the configuration. Replace <ProfileName> with a custom profile name, such as AkProfile:
```
aliyun configure --profile <ProfileName>
```

Enter your AccessKey ID, AccessKey Secret, default region, and language when prompted:

Configuring profile 'AkProfile' in 'AK' authenticate mode...
Access Key Id []: ************
Access Key Secret []: ************
Default Region Id []: cn-shanghai
Default Output Format [json]: json (Only support json)
Default Language [zh|en] en: en
Saving profile[AkProfile] ...Done.

When the terminal displays Configure Done and a welcome message, the configuration is successful.

Note

After the configuration is successful, the profile is automatically activated. To switch to a different profile, run the aliyun configure switch --profile <ProfileName> command.

Non-interactive configuration

Bash

aliyun configure set \
  --profile AkProfile \
  --mode AK \
  --access-key-id ************ \
  --access-key-secret ************ \
  --region cn-hangzhou

PowerShell

aliyun configure set `
  --profile AkProfile `
  --mode AK `
  --access-key-id ************ `
  --access-key-secret ************ `
  --region cn-hangzhou

Full configuration parameters

Parameter	Description	Required	Example
`--mode`	The credential mode. The default value is `AK`.	Yes
`--profile`	The profile name. The default value is `default`. We recommend using a descriptive name, such as `dev` or `project-a`.	No
`--access-key-id`	The AccessKey ID of the RAM user.	Yes
`--access-key-secret`	The AccessKey Secret of the RAM user.	Yes
`--region`	The ID of the default region.	Yes

Verify credential configuration

After configuring the credentials, run the following command to verify them:

aliyun sts get-caller-identity

The output is similar to the following. You can identify the owner of the current AccessKey using the Arn and UserId fields:

{
  "AccountId": "173305794806****",
  "Arn": "acs:ram::173305794806****:user/<user-name>",
  "IdentityType": "RAMUser",
  "PrincipalId": "20407046578681****",
  "RequestId": "D012C652-FF76-5101-81B3-45A1DDAC****",
  "UserId": "20407046578681****"
}

Environment variable configuration

The CLI prioritizes values in the profile. If a profile exists but some fields are empty, the CLI automatically uses the corresponding environment variables to fill in the missing values.

Linux / macOS

export ALIBABA_CLOUD_ACCESS_KEY_ID="LTAI5txxx"
export ALIBABA_CLOUD_ACCESS_KEY_SECRET="yourSecret"

PowerShell

$env:ALIBABA_CLOUD_ACCESS_KEY_ID = "LTAI5txxx"
$env:ALIBABA_CLOUD_ACCESS_KEY_SECRET = "yourSecret"

Delete credentials

To delete an AccessKey profile from your local configuration, run the following command:

aliyun configure delete --profile <ProfileName>

Note

This command only deletes the corresponding configuration entry from ~/.aliyun/config.json. It does not disable or delete the AccessKey in the RAM console. If you confirm that the AccessKey is no longer needed, you must also manually disable or delete the AccessKey in the RAM console.

FAQs

Which configuration does the CLI use when both environment variables and profile are set?

The CLI prioritizes values in the profile. If a profile exists but some fields are empty, the CLI automatically uses the corresponding environment variables to fill in the missing values.