Identity and Access Compliance Guide
To keep your Alibaba Cloud account and cloud resources secure, avoid using your Alibaba Cloud account (root account) to access ID Verification for Financial Services unless necessary. Instead, use a RAM identity—such as a RAM user—to access ID Verification for Financial Services.
RAM users
You can create a RAM user using your Alibaba Cloud account (root account), a RAM user with administrative permission, or a RAM role. After you grant the required permissions, a RAM user can log on to the console or call APIs to access resources.
Follow these best practices for RAM users:
Create a RAM user with your Alibaba Cloud account and assign it administrative permission. Then use this administrative RAM user to create and manage other RAM users.
Assign least privilege access to each RAM user based on its actual needs. The principle of least privilege means granting only the permissions required to complete a specific task—and no more. Following this principle limits what users can do, improves data security, and reduces security risks caused by permission abuse.
Separate console users from API users to prevent accidental operations from affecting your services.
Console users: Use a username and password to access the Alibaba Cloud console. You can also use Security Token Service (STS) temporary credentials. Enable multi-factor authentication (MFA) for all console users. If your organization meets the requirements, configure Single Sign-On (SSO) for RAM users so they can access Alibaba Cloud resources directly through your corporate identity system.
API users: Use an AccessKey (AK) to call Alibaba Cloud service APIs. Never hard code a RAM user’s AccessKey ID and AccessKey secret in application source code. Hard coding exposes credentials and puts all resources under your account at risk. Instead, use STS temporary credentials or pass access credentials securely—for example, through environment variables.
Related operations for RAM users
RAM user groups
If you use your Alibaba Cloud account to create multiple RAM users, you can group the RAM users to facilitate permission management. For example, you can grant the same permissions to RAM users in the same RAM user group. We recommend that you take note of the following items:
Grant permissions to RAM user groups based on the principle of least privilege.
Remove a RAM user from the RAM user group if the work duties of the RAM user change.
Revoke permissions from RAM user groups if the RAM user groups no longer need the permissions.