Identity management
To ensure the security of your Alibaba Cloud account and cloud resources, avoid using your Alibaba Cloud account to access Cloud Firewall unless necessary. As a best practice, use a RAM identity, such as a RAM user or a RAM role, to access Cloud Firewall.
RAM user
RAM users can be created by using Alibaba Cloud accounts or using RAM users and RAM roles who have administrative rights. After a RAM user is granted the required permissions, the RAM user can use the Alibaba Cloud Management Console or call API operations to access Alibaba Cloud resources within the Alibaba Cloud account to which the RAM user belongs.
We recommend that you take note of the following items:
Use your Alibaba Cloud account to create a RAM user and grant the RAM user the administrative rights. Then, you can use the RAM user to create and manage other RAM users.
Separate RAM users for individuals from RAM users for programs.
When you create a RAM user, you can select Console Access, Using permanent AccessKey to access, or both for the Access Mode parameter.
To access resources, a RAM user designated for console access logs on to the Alibaba Cloud Management Console by using its username and password, whereas a RAM user designated for AccessKey pair-based access makes API calls. We recommend that you separate RAM users for individuals from RAM users for programs to prevent impacts of unintended operations. We recommend that you enable multi-factor authentication (MFA) for a RAM user designated for console access.
Grant permissions to RAM users based on the principle of least privilege.
Least-privilege permissions refer to the minimum permissions that are required to perform an operation. Least-privilege permissions improve data security and prevent permission abuse.
Do not embed your AccessKey ID or AccessKey secret in code to prevent an AccessKey pair leak. An AccessKey pair leak causes security risks for all resources within your account. We recommend that you use Security Token Service (STS) tokens or configure environment variables to obtain access permissions.
If applicable, enable single sign-on (SSO) for RAM users to allow the RAM users to log on to and access Alibaba Cloud resources from the identity management systems of their enterprises.
RAM user operations
RAM user group
If your Alibaba Cloud account has multiple Resource Access Management (RAM) users, you can create user groups to manage them. Grouping RAM users with the same responsibilities lets you grant permissions in batches and efficiently manage users and their permissions. For RAM user groups, follow these best practices:
Follow the principle of least privilege when you grant permissions to user groups.
If a RAM user's responsibilities change, remove the user from groups that are no longer relevant to prevent permission abuse.
If a user group no longer needs certain permissions, remove those permissions from the group.
RAM user group operations
RAM role
A RAM role is a type of RAM identity that can be granted a set of access policies. Unlike a Resource Access Management (RAM) user, a RAM role has no permanent identity credentials, such as a logon password or an AccessKey pair. Instead, a trusted entity must assume the role to use it. After assuming the role, the trusted entity receives a temporary Security Token Service (STS) token. This token allows the entity to access authorized resources as the RAM role.
We recommend that you take note of the following items:
Do not frequently change the trusted entity of a RAM role after the RAM role is created. If you change the trusted entity of a RAM role, permission loss may occur, which affects your business. If you add a trusted entity, security risks may arise due to privilege escalation. Make sure that the changes are fully tested before you apply them to a RAM role.
After a trusted entity is granted a permission, the trusted entity can call the AssumeRole operation to obtain an STS token, which can be used to assume a RAM role. For more information, see AssumeRole. An STS token is valid only for a limited period of time. We recommend that you set the validity period to an appropriate value to reduce security risks.
NoteThe maximum validity period of an STS token is the maximum session duration specified for the RAM role. We recommend that you set the maximum session duration for a RAM role to an appropriate value to reduce security risks.
If applicable, enable SSO for RAM roles to allow the RAM roles to log on to and access Alibaba Cloud resources from the identity management systems of their enterprises.