DocsICP FilingConsole
Documentation
Home Page Information Query Service Developer reference SDK Create a RAM user and grant permissions

Create a RAM user and grant permissions

Updated at:
Copy as MD
Product
My Favorites

Background information

If a RAM user has not been granted permissions, authentication fails when using this service. In this case, the Alibaba Cloud account must grant the necessary permissions to the RAM user.

Note

Resource Access Management (RAM) is a user identity management and access control service provided by Alibaba Cloud. With RAM, you can create and manage user accounts—such as employees, systems, or applications—and control their permissions to operate resources under your Alibaba Cloud account.

Procedure steps

Create a RAM user

  1. Log on to the Resource Access Management (RAM) console using your Alibaba Cloud account or a RAM administrator account.

  2. In the left navigation pane, choose Identity Management > Users.

  3. On the Users page, click Create User.

  4. In the Create User dialog box, under User Account Information, set the basic user information.

    • Logon Name: Can contain letters, digits, periods (.), hyphens (-), and underscores (_). Maximum length is 64 characters.

    • Display Name: Can contain up to 128 characters.

    • Tags: Click edit, then enter a tag key and tag value. Attach tags to the RAM user to simplify tag-based user management later.

    Note

    Click Add User to create multiple RAM users at once.

  5. Under Access Method, select an access method and configure the corresponding settings.

    For security, use only one of the following access methods. Separate human users from application users to avoid mixing access types.

    • Console Access

      If the RAM user represents a person, enable console access so they can log on to Alibaba Cloud using a username and password. Configure the following settings:

      • Console logon password: Choose to auto-generate a password or set a custom one. If you set a custom password, it must meet the password complexity requirements. For more information, see Set a password policy for RAM users.

      • Password reset policy: Choose whether the RAM user must reset their password at next logon.

      • MFA policy: Choose whether to enable MFA for this RAM user. If you enable MFA, you must also bind an MFA device. For more information, see Bind an MFA device for a RAM user.

    • Use Permanent AccessKey

      If the RAM user represents an application, use a permanent AccessKey pair to access Alibaba Cloud. After enabling this option, the system automatically generates an AccessKey ID and AccessKey secret for the RAM user. For more information, see Create an AccessKey for a RAM user.

      Important

      • The RAM user's AccessKey secret appears only during creation. You cannot view it later. Store it securely.

      • An AccessKey is a long-term programmatic access credential. If leaked, it compromises all resources under the account. Use Security Token Service (STS) temporary credentials instead to reduce risk. For more information, see Best practices for using credentials to access Alibaba Cloud OpenAPI.

  6. Click OK.

  7. Complete the security verification as prompted.

Grant permissions

  1. Log on with your Alibaba Cloud account, go to RAM access control, and click Grant Permission. Specify the RAM user as the entity to authorize. In the system policy search box, type IQS, then select AliyunIQSFullAccess (full management permissions). Click OK to confirm.

  2. After granting IQS permissions, use the SDK with the RAM user's AccessKey to call IQS services such as general search and nearby query.

    Important

    Before making calls, confirm that you have purchased the IQS service.

    After purchasing IQS, wait for the instance to be provisioned and contact your Alibaba Cloud account manager for offline integration. Otherwise, you may receive an "inactive" error.

Previous：SDK quick startNext：Create an AccessKey for a RAM user