Programmatic identity management

A programmatic identity represents an application or service. It uses the Alibaba Cloud OpenAPI to access cloud resources and data. On Alibaba Cloud, programmatic identity management follows the principle of least privilege. The two core guidelines are to reduce exposure duration and reduce the attack surface.

• Reduce exposure duration: Use temporary credentials, such as Security Token Service (STS) tokens, instead of fixed credentials such as AccessKeys whenever possible. If you use fixed credentials, rotate them regularly.

• Reduce the attack surface: Store credentials securely. Do not use the same credentials for different identity types.

Best practices

• Assign different credentials for different workloads and environments

• Use temporary credentials instead of fixed credentials

• Regularly review and rotate fixed credentials

• Encrypt credentials during storage and use

• Manage fixed credentials centrally