Identity management
To ensure the security of your Alibaba Cloud account and cloud resources, avoid using your Alibaba Cloud account directly to access elastic IP addresses (EIPs). Instead, use RAM users or RAM roles to grant only the permissions needed to manage EIPs.
Choose your identity type based on who or what needs access:
People (administrators, operators): use RAM users, optionally organized into RAM user groups.
Applications and services (workloads that call APIs): use RAM roles.
RAM users
A RAM user is an identity for a person who needs to access Alibaba Cloud resources. RAM users belong to an Alibaba Cloud account and can access resources only within that account. You can create RAM users from your Alibaba Cloud account, or delegate that task to a RAM user or RAM role with administrative rights.
Each RAM user can be assigned one or both access modes:
| Access mode | How the user authenticates |
|---|---|
| Console Access | Username and password to log in to the Alibaba Cloud Management Console |
| Using permanent AccessKey to access | AccessKey pair to make API calls |
Best practices for RAM users:
Delegate user management early. Create one RAM user with administrative rights, then use that RAM user to create and manage all other RAM users. Avoid using your Alibaba Cloud account for day-to-day operations.
Separate individual users from application users. Give each person their own RAM user. Create separate RAM users for programs and automated processes. This limits the blast radius if a credential is compromised.
Apply least-privilege permissions. Grant each RAM user only the permissions needed for their specific tasks. Expand permissions only when required.
Enable multi-factor authentication (MFA) for console users. Require MFA for any RAM user with console access to add a second layer of protection against credential theft.
Never embed credentials in code. Do not hardcode an AccessKey ID or AccessKey secret in application code or configuration files. A leaked AccessKey pair exposes all resources in the account. Store credentials in environment variables or use STS tokens instead.
Enable single sign-on (SSO) for enterprise environments. If your organization uses a corporate identity provider, configure SSO so that RAM users log in through your existing identity management system.
Related topics
RAM user groups
RAM user groups let you manage permissions for multiple RAM users at once. When you add a RAM user to a group, the user inherits all permissions assigned to that group. This is more maintainable than granting permissions to individuals separately.
Best practices for RAM user groups:
Apply least-privilege permissions to groups. Grant each group only the permissions its members need. Avoid creating catch-all groups with broad permissions.
Update group membership when roles change. Remove a RAM user from a group as soon as their responsibilities change and they no longer need that group's permissions.
Revoke unused group permissions. Regularly audit group permissions and revoke any that are no longer needed.
Related topics
RAM roles
A RAM role is a virtual identity designed for workloads — applications, services, or automated processes that need to call Alibaba Cloud APIs. Unlike RAM users, RAM roles have no permanent credentials (no password, no AccessKey pair). Instead, a trusted entity assumes the role and receives a short-lived STS token to make API calls.
This approach is more secure than distributing long-term credentials to applications.
How it works:
Create a RAM role and attach the required policies.
Grant a trusted entity (an Alibaba Cloud account, service, or RAM user) permission to assume the role.
The trusted entity calls the AssumeRole API operation to get an STS token.
The application uses the STS token to access Alibaba Cloud resources as the RAM role.
Best practices for RAM roles:
Minimize changes to trusted entities. After creating a RAM role, avoid changing its trusted entity. Removing a trusted entity causes permission loss; adding one can introduce privilege escalation risks. Test any changes thoroughly before applying them.
Set an appropriate STS token validity period. STS tokens are valid only for a limited period of time. Set the validity period to an appropriate value to reduce security risks. The maximum validity period of an STS token is capped by the maximum session duration configured for the RAM role — set both to appropriate values.
Enable SSO for role-based access. If your organization uses a corporate identity provider, configure role-based SSO so that federated users can assume RAM roles directly from your identity management system.
The maximum validity period of an STS token is capped by the maximum session duration configured for the RAM role. Set the role's maximum session duration to an appropriate value.