Cloud Backup uses user-based authorization policies (RAM Policy) and temporary authorization from Security Token Service (STS) to manage access to resources.
User-based RAM policies
Resource Access Management (RAM) is an Alibaba Cloud service that controls access to resources. A RAM Policy is a user-based authorization policy. You can use RAM policies to centrally manage your users, such as employees, systems, and applications, and control their permissions to access your resources.
A RAM Policy is a JSON document. In its Statement section, you define the authorization semantics. Each statement describes an Action, Effect, Resource, and Condition. You can add multiple statements based on your business scenarios to create flexible authorization policies. For more information, see RAM overview.
Temporary authorization with STS
In contrast to the long-term access control provided by RAM, Security Token Service (STS) provides temporary access authorization. STS can issue a temporary AccessKey and token that you can grant to temporary users for accessing Cloud Backup. Permissions granted through STS are typically more restricted and have a defined expiration time. This minimizes the security risk if the credentials are leaked.
Cloud Backup supports temporary access authorization through Alibaba Cloud STS. With STS, you can issue an access credential that has a custom validity period and specific permissions. You can grant this credential to third-party applications or to users whose identities you manage yourself.