Personnel identity management

A personnel identity represents an individual in an organization, such as a security administrator, an operations administrator, or an application developer. They manage cloud resources using tools such as the Alibaba Cloud console, the command-line interface (CLI), or scenario-specific clients. On Alibaba Cloud, personnel identity management follows the principle of least privilege. This principle has two core tenets: reduce exposure duration and minimize the attack surface.

• Reduce exposure duration: Use temporary identities through role assumption instead of permanent identities. This greatly reduces the threat of identity leaks. This also lets you abstract permission models for personnel. For example, you can define roles based on job functions. This helps standardize permission settings and improves management efficiency. On the cloud, you can use single sign-on (SSO) with role assumption to manage personnel identities.

• Minimize the attack surface: Establish a secure logon mechanism. This includes requiring strong passwords, using multi-factor authentication (MFA), and avoiding shared identities. On Alibaba Cloud, you can integrate with your organization's Identity Provider (IdP) using single sign-on (SSO) to achieve unified identity authentication.

Best practices

• Assign an independent identity to each member of your organization

• Establish a secure logon mechanism

• Implement unified identity authentication based on a unified IdP

• Use user groups to simplify personnel management

• Periodically review the validity and necessity of personnel identities