To ensure the security of your Alibaba Cloud account and cloud resources, avoid using your Alibaba Cloud account to access Quick Audience. Use RAM users and RAM roles instead.
RAM user
A RAM user must be created by an Alibaba Cloud account, a RAM user that has administrator permissions, or a RAM role. The RAM user must be authorized before you can log on to the console or call API operations to access resources under the Alibaba Cloud account.
For the use of RAM users, we recommend that you:
-
Use your Alibaba Cloud account to create a RAM user and grant administrator permissions to the RAM user. Later, use the RAM user with administrator permissions to create and manage other RAM users.
-
Separate personnel users from program users.
When you create a RAM user, you can select Console Access or Permanent AccessKey Access.
Console users use the account and password to access the cloud service console. API users use the AccessKey to call API operations to access cloud resources. We recommend that you separate the two scenarios to avoid service impacts caused by misoperations. We recommend that you enable MFA for users who access the console.
-
Assign minimum permissions to RAM users as needed.
The minimum permission is to grant a user the permissions required to perform a task, but not other unnecessary permissions. Minimum authorization prevents excessive user operation permissions, improves data security, and reduces security risks caused by permission abuse.
-
Do not save the AccessKey ID and AccessKey secret of a RAM user in the project code. Otherwise, the AccessKey pair may be leaked and the security of all resources under your account may be compromised. We recommend that you use STS or environment variables to obtain access permissions.
-
If the conditions are met, you can use SSO to log on to the RAM user and access Alibaba Cloud resources.
Operations related to RAM users
RAM user group
If you have multiple RAM users under your Alibaba Cloud account, you can create user groups to manage RAM users with the same responsibilities and grant permissions to them at a time. This way, you can efficiently manage RAM users and their permissions.
For the use of RAM user groups, we recommend that you:
-
Follow the principle of least privilege when you grant permissions to RAM user groups.
-
When the responsibilities of a RAM user change, the RAM user is removed from a user group to which the RAM user no longer belongs. This prevents permission abuse.
-
You can call this operation to remove permissions from a user group when the user group no longer needs the permissions.
Operations related to RAM user groups
RAM Role
A RAM role is a virtual identity to which policies can be attached. A RAM role does not have permanent identity credentials, such as a logon password or an AccessKey pair. A RAM role can be used only after the role is assumed by a trusted entity. After a RAM role is assumed by a trusted entity, the trusted entity can obtain a Security Token Service (STS) token and use the STS token to access Alibaba Cloud resources as the RAM role.
When you use a RAM role, consider the following recommended security practices:
-
Do not frequently change the trusted entity of a RAM role after the RAM role is created. If you change the trusted entity of a RAM role, the original entrusted entity may not have the required permissions, which affects your application functionality. If you add a trusted entity, security risks may arise due to privilege escalation. Make sure that the modifications are fully tested before you apply them to a RAM user.
-
After a trusted entity is granted a permission, the trusted entity can call the AssumeRole operation to obtain an STS token, which can be used to assume a RAM role. For more information, see AssumeRole. An STS token is valid only for a limited period of time. We recommend that you set the validity period to an appropriate value to reduce security risks.
NoteThe maximum validity period of an STS token is the maximum session duration specified for the RAM role. We recommend that you set the maximum session duration for a RAM role to an appropriate value to reduce security risks.
-
If applicable, enable SSO for RAM roles to allow the RAM roles to log on to and access Alibaba Cloud resources from the identity management systems of their enterprises.