Avoid using the root identity

After you register an Alibaba Cloud account, you can use your username and password to log on to the Alibaba Cloud Management Console. When you log on, you assume the root identity. This identity has full permissions for the account. If the account password is leaked, the security risk is extremely high. If multiple users share this identity, each user has the account's username and password, which increases the risk of a leak. Additionally, if the account is shared, you cannot use operation logs to identify which user in your organization performed an operation or trace the source of the operation. Therefore, except for a few specific scenarios, you should use a Resource Access Management (RAM) identity to access cloud resources and avoid using the root identity of your Alibaba Cloud account. We recommend that you improve the security of the root identity by taking measures such as setting a strong password and enabling Multi-Factor Authentication (MFA).

Priority

High

What to avoid

• Using the Alibaba Cloud account for all daily cloud management.

• Reusing the same password for other websites and apps.

• Having multiple people in your organization share one Alibaba Cloud account and password to log on to the console for operations and maintenance (O&M).

• Not enabling MFA.

• Enabling an AccessKey for the root identity. A root AccessKey has full permissions for the account. If it is leaked, the risk is extremely high.

Implementation guide

1. After you register your Alibaba Cloud account, perform security hardening:

   1. Set a strong password for your Alibaba Cloud account. Use a combination of numbers, uppercase letters, lowercase letters, and symbols. The password must be at least 8 characters long.

   2. Enable MFA.

   3. Change the password regularly, for example, every 90 days. Do not reuse old passwords.

2. Create a separate identity for each person who needs to access cloud resources. Use these identities for daily O&M instead of the root identity:

   1. If you have only one Alibaba Cloud account, use Resource Access Management (RAM) to manage identities that need to access cloud resources.

   2. If you have multiple Alibaba Cloud accounts, use CloudSSO for unified identity management.

3. Do not enable an AccessKey for the root identity. If you have already enabled one, manage these AccessKeys.

4. Use ActionTrail to periodically review the usage of identities such as the root identity. Use the Query Logon Events of the Alibaba Cloud Account to the Console system template in ActionTrail advanced event query to retrieve logon events of the root identity for auditing.