Account authorization

Procedure

What to do next

1. Grant permissions to the RAM user.

   By default, a new RAM user has no permissions. You must grant permissions to the RAM user to allow access to the required cloud resources.

2. Log on to the Alibaba Cloud Management Console as the RAM user or use the AccessKey pair to call an API.

Limits

A limit applies to the maximum number of system and custom policies that can be attached to a RAM user.

Method 1: Grant permissions to a RAM user on the Users page

1. Log on to the RAM console as a RAM administrator.

2. In the navigation pane on the left, choose Identity Management > Users.

3. On the Users page, find the RAM user that you want to manage and click Add Permissions in the Actions column.

   You can also select multiple RAM users and click Add Permissions at the bottom of the list to grant permissions in a batch.

4. In the Add Permissions panel, grant permissions to the RAM user.

   1. Select a resource scope.

      • Account Level: The permissions take effect on the current Alibaba Cloud account.

      • Resource Group Level: The permissions take effect on the specified resource group.

        Important

        For resource group-level authorization to be effective, both the Alibaba Cloud service and the resource type must support resource groups.

   2. Select a principal.

      The principal is the RAM user to whom you want to grant permissions. The RAM user that you selected is automatically specified as the principal.

   3. Select access policies.

      An access policy is a set of permissions. Policies are categorized into the following two types. You can select multiple access policies.

      • System Policy: Created by Alibaba Cloud. Alibaba Cloud maintains and updates the policy versions. You can use system policies but cannot modify them.

        Note

        The system automatically identifies high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. When you grant permissions, avoid granting high-risk access policies unless they are necessary.

      • Custom Policy: Managed by you. You maintain and update the policy versions. You can create, update, and delete custom policies.

   4. Click Confirm to create the authorization.

5. Click Close.

Method 2: Grant permissions to a RAM user on the Grants page

1. Log on to the RAM console as a RAM administrator.

2. In the navigation pane on the left, choose Permission Management > Grants.

3. On the Grants page, click Grant Permission.

4. In the Grant Permission panel, grant permissions to the RAM user.

   1. Select a resource scope.

      • Account Level: The permissions take effect on the current Alibaba Cloud account.

      • Resource Group Level: The permissions take effect on the specified resource group.

        Important

        For resource group-level authorization to be effective, both the Alibaba Cloud service and the resource type must support resource groups.

   2. Select a principal.

      The principal is the RAM user to whom you want to grant permissions. You can select multiple RAM users.

   3. Select access policies.

      An access policy is a set of permissions. Policies are categorized into the following two types. You can select multiple access policies.

      • System Policy: Created by Alibaba Cloud. Alibaba Cloud maintains and updates the policy versions. You can use system policies but cannot modify them.

        Note

        The system automatically identifies high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. When you grant permissions, avoid granting high-risk access policies unless they are necessary.

      • Custom Policy: Managed by you. You maintain and update the policy versions. You can create, update, and delete custom policies.

   4. Click OK.

5. Click Close.

Logon portals

• General logon URL

  • Go to the RAM user logon page.

  • On the Alibaba Cloud account logon page, click RAM User.

• Alibaba Cloud account-specific logon URL

  Log on to the RAM console as an Alibaba Cloud account. On the Overview page, in the Account Information section, you can find the RAM user logon URL. RAM users can use this URL to log on to the Alibaba Cloud Management Console.

• RAM user-specific logon URL

  You can use the username parameter in the logon URL to specify the RAM username. This lets you skip entering the username during logon. You can click Next and enter the password directly. The username uses the User Principal Name (UPN) format, which is the user logon name that is displayed in the user list of the RAM console. For example, a RAM user named Alice@example.onaliyun.com can use https://signin.aliyun.com/login.htm?username=Alice@example.onaliyun.com to log on to the Alibaba Cloud Management Console.

Log on with a RAM username and password

The following steps describe how a RAM user logs on to the Alibaba Cloud Management Console using the general logon URL.

1. Go to the Alibaba Cloud Management Console logon page.

2. On the Log on with RAM user tab, enter the RAM username, and click Next.

   • Method 1: Log on with the default domain name. The logon format for the RAM user is <UserName>@<AccountAlias>.onaliyun.com. For example, username@company-alias.onaliyun.com.

     Note

     <UserName> is the name of the RAM user, and <AccountAlias>.onaliyun.com is the default domain name.

   • Method 2: Log on with an account alias. The logon format for the RAM user is <UserName>@<AccountAlias>. For example, username@company-alias.

     Note

     <UserName> is the name of the RAM user, and <AccountAlias> is the account alias.

   • Method 3: If you created a domain alias, you can also use it to log on. The logon format for the RAM user is <UserName>@<DomainAlias>. For example, username@example.com.

     Note

     <UserName> is the name of the RAM user, and <DomainAlias> is the domain alias.

3. Enter the logon password for the RAM user, and then click Log On.

4. (Optional) If MFA is enabled for the user, enter the verification code generated by the virtual MFA device or authenticate using a U2F security key.