DocsICP FilingConsole
Documentation
Home Page Information Query Service Developer reference SDK Create and authorize a RAM user

Create and authorize a RAM user

Updated at:
Copy as MD
Product
My Favorites

If a RAM user lacks the required permissions, their API requests will fail authorization. The Alibaba Cloud account must then grant the necessary permissions to the RAM user.

Note

Resource Access Management (RAM) is an identity and access control service provided by Alibaba Cloud. With RAM, you can create and manage user accounts, such as for employees, systems, or applications, and control the permissions these accounts have over your resources.

Procedure

1. Create a RAM user

  1. Log on to the RAM console with your Alibaba Cloud account or as a RAM administrator.

  2. In the left-side navigation pane, choose Identities > Users.

  3. On the Users page, click Create User.

  4. On the Create User page, in the User Account Information section, configure the user's basic information.

    • Logon Name: Can contain letters, digits, periods (.), hyphens (-), and underscores (_), and be up to 64 characters long.

    • Display Name: Up to 128 characters.

    • Tags: Click edit, and then enter a tag key and tag value. Adding tags to a RAM user helps with user management.

    Note

    Click Add User to create multiple RAM users at once.

  5. In the Access Mode section, select an access mode and configure the related parameters.

    For account security, we recommend that you select only one of the following access modes to separate human users from application users.

    • Console Access

      If the RAM user is for a person, we recommend that you enable console access, which allows the user to sign in to Alibaba Cloud by using a username and password. You need to configure the following parameters:

      • Console logon password: Select Auto-generate Password or Custom Password. A custom password must comply with the password policy. For more information, see Set a password policy for RAM users.

      • Password reset policy: Specify whether the RAM user must reset their password at the next sign-in.

      • Multi-factor authentication (MFA) policy: Specify whether to enable MFA for the current RAM user. If MFA is enabled, you must also bind an MFA device to the user. For more information, see A RAM user binds an MFA device.

    • Programmatic Access

      If the RAM user is for an application, you can use a permanent AccessKey to access Alibaba Cloud. After you enable this option, the system automatically generates an AccessKey ID and an AccessKey Secret for the RAM user. For more information, see Create an AccessKey for a RAM user.

      Important

      • A RAM user's AccessKey Secret is displayed only at the time of creation and cannot be retrieved later. Store it securely.

      • An AccessKey is a long-term access credential. If an AccessKey is compromised, your account resources are at risk. We recommend using temporary credentials, such as STS tokens, to reduce the risk of a leak. For more information, see Best practices for using access credentials to call Alibaba Cloud OpenAPI.

  6. Click OK.

  7. Follow the on-screen instructions to complete the security verification.

2. Grant permissions

  1. With your Alibaba Cloud account, go to RAM Access Control and click Add Permissions. Select the RAM user as the principal and grant the following three permissions:

    1. In the permission policy search box, enter IQS, then select AliyunIQSFullAccess (administrative permissions).

    2. In the permission policy search box, enter cleversee, and then select AliyunCleverSeeAISearchPlatformUserAccess and AliyunCleverSeeAISearchWebSearchAccess.

    3. Click OK.

  2. After the permissions are granted, you can use the RAM user's AccessKey with an SDK to call CleverSee services such as General Search and Nearby Search.

    Important

    Before making API calls, ensure that you have purchased the CleverSee service.

Previous：SDK integrationNext：Create an AccessKey for a RAM user