Employee permission management
As a root account administrator, you can create RAM users for different employees, such as content editors, designers, and operations staff, and assign them fine-grained permissions to manage your website. This topic describes how to create RAM users and assign permissions.
Employee permission management lets you perform the following operations:
Employee management: Edit job titles, add employees, edit employee information, and delete employees.
Employee role management: Create different roles, such as Editor or Operator. You can assign permissions to roles in batches and then assign the roles to sub-administrators.
Configuration process overview:
Create a RAM user: Create a RAM user in the Alibaba Cloud Resource Access Management (RAM) console.
Grant permissions to the RAM user: Grant the RAM user permissions to manage the website builder product.
Add a sub-administrator: Add a sub-administrator in the website management backend and associate the RAM user.
Configure roles and permissions: Create roles, define permission sets, and then assign the roles to sub-administrators.
Step 1: Create a RAM user
If you already have an active RAM user, you can skip this step.
Use your Alibaba Cloud account to go to the Create RAM User page.
On the Create User page, in the User Account Information section, set the basic user information.
Logon Name (required): Up to 64 characters. Allows letters, digits, periods (.), hyphens (-), and underscores (_).
Display Name (optional): The name can be up to 128 characters long.
Tag (optional): Click
, then enter a tag key and tag value to categorize and manage users.Security Phone (optional): Enter a mainland China mobile number in +86 format. +86 is the country/region code and is selected by default; enter only the phone number itself. After the first binding, the number must be activated through SMS verification.
In the Access Mode section, select Console Access, and then set the parameters.
If an employee needs to call APIs programmatically, select Use permanent AccessKey for access. For more information, see Create a RAM user.
Set Logon Password: Auto-generate or set a custom password. Custom passwords must meet the configured complexity requirements. Set a password policy for RAM users.
Password Reset: Specify whether the user must reset the password at next sign-in.
Enable MFA: MFA is required for all users by default. To change this setting, see Manage RAM user security settings. Users must bind an MFA device at first sign-in. Bind an MFA device.
Click OK and complete the security authentication as prompted.
Step 2: Grant permissions to the RAM user
Use your Alibaba Cloud account to go to the RAM console. In the navigation pane, choose .
Find the target RAM user and click Add Permissions in the Actions column.
In the Add Permissions panel, add permissions for the RAM user.
Resource Scope: Select Account Level.
Principal: Keep the default value.
Access Policy: Search for and select
AliyunWebsiteBuildFullAccess.
Click Confirm Add Permissions and complete the security authentication as prompted.
Step 3: Add a sub-administrator and associate the RAM user
After you create the RAM user, return to the website management backend to add the user as a sub-administrator.
In the navigation pane, choose , and click Add Sub-administrator.
In the dialog box that appears, select the RAM user from the list, enter the sub-administrator information, and click OK.
The new sub-administrator appears in the Employee Management list. You can click Edit to modify their information at any time.
Step 4: Configure employee roles and permissions
You can assign permissions to sub-administrators using roles. First, create a role with specific permissions, and then assign the role to a sub-administrator.
In the navigation pane, choose , and click Add Employee Role.
Enter a Role Name, such as "Content Editor" or "Operations Staff". Select the required permissions for the role, and then click OK.
In the Employee Role Management list, find the role that you want to assign and click the
button.In the dialog box that appears, select one or more employees to assign the role to, and then click OK.
NoteAn employee can have multiple roles. Their final permissions are the union of all permissions from their assigned roles. If you delete a role, any sub-administrator with that role loses the permissions associated with it.
Log on as a RAM user
After you grant RAM permissions and assign employee roles, the RAM user can log on to the website management backend and start work.
Go to the Wanxiaozhi AI Website Builder console.
At the bottom of the page, click RAM User Logon.
Enter the username and password of the RAM user to complete the logon.
In the application list, find the target application and click Enter Application to open the website management backend.
Permission logic
When you associate the first sub-administrator to configure fine-grained permissions for a website, the website's access control switches to a role-based authorization whitelist mode. Note the following permission logic to avoid configuration errors:
When no sub-administrators are associated with the website (default state): The root account and all RAM users created under it can log on to and access all sites under the root account.
When at least one sub-administrator is associated with the website:
For associated RAM users: Their permissions are determined by their assigned employee roles. If a sub-administrator has no roles, they cannot perform any operations on the website after they log on.
For other unassociated RAM users: They immediately lose access to the website.