Panxi Zhichuang: Flow for creating and authorizing a RAM user
Background
An Alibaba Cloud account has full management permissions for all resources within the account. These permissions cannot be modified. If multiple people share the account, audit logs cannot distinguish between individual users. A compromised account poses a significant risk that is difficult to trace. For security reasons, avoid using your Alibaba Cloud account for daily operations and management. Instead, you can create a Resource Access Management (RAM) user, grant the AdministratorAccess permission, and use this user as an account administrator. This administrator can manage all cloud resources and effectively reduce security risks. You can assign accounts to different personnel and freeze an administrator account immediately if it is compromised. You can create multiple RAM users under your Alibaba Cloud account. This allows multiple users to securely and conveniently access your purchased products.
A RAM user is an entity in RAM. You can create RAM users under your Alibaba Cloud account and grant them permissions. This lets you provide different users with varying levels of access to your resources.
Create a RAM user
Log on to the RAM console using your Alibaba Cloud account or as a RAM administrator.
In the navigation pane on the left, choose .
On the Users page, click Create User.
In the User Account Information section of the Create User page, set the basic information for the user.
Logon Name: The name can contain letters, digits, periods (.), hyphens (-), and underscores (_). It can be up to 64 characters long.
Display Name: The name can be up to 128 characters long.
Tags: Click
, and then enter a tag key and tag value. You can attach tags to RAM users to manage them based on tags.
Note
Click Add User to create multiple RAM users at once.
In the Access Mode section, select an access mode and set the parameters.
For security reasons, select only one of the following access modes. We recommend separating human users from application users to avoid confusion.
Console Access
If the RAM user is a human user, enable console access. This allows the user to access Alibaba Cloud with a username and logon password. You must set the following parameters:
Console Logon Password: Choose whether to automatically generate a password or set a custom password. A custom logon password must comply with the password complexity rules. For more information, see Set the password policy for RAM users.
Password Reset Policy: Choose whether the RAM user must reset the password at the next logon.
Multi-factor Authentication (MFA) Policy: Choose whether to enable MFA for this RAM user. If you enable MFA, you must also bind an MFA device. For more information, see Bind an MFA device to a RAM user.
Access with a permanent AccessKey
If the RAM user is an application, you can use a permanent AccessKey to access Alibaba Cloud programmatically. After you enable this option, the system automatically generates an AccessKey ID and an AccessKey secret for the RAM user. For more information, see Create an AccessKey.
Important
The AccessKey secret for a RAM user is displayed only when it is created. You cannot retrieve it later. Keep it secure.
An AccessKey is a long-term access credential. A leaked AccessKey threatens the security of all resources under the account. To reduce the risk of credential leaks, we recommend that you use a temporary credential solution, such as a Security Token Service (STS) token. For more information, see Best practices for using access credentials to access Alibaba Cloud OpenAPI.
Click OK.
Complete the security verification as prompted.
Grant permissions to a RAM user
For security reasons, RAM users (also known as standard accounts) have no permissions by default. Their function permissions are not configured, and their data permissions are limited. By default, a RAM user can access only the data they generate and public data from the administrator account, excluding digital human and voice assets. In contrast, the Alibaba Cloud account (the administrator) has the highest level of permissions and can manage all features and data.
You must grant permissions to a newly created RAM user before the user can access resources.
For a RAM user to use an Alibaba Cloud product, the parent Alibaba Cloud account must first grant the necessary permissions to that RAM user.
The following procedure describes how an Alibaba Cloud account can grant a RAM user permissions to use the Panxi platform.
Procedure
Log on to the RAM console using your Alibaba Cloud account and go to the user list page: https://ram.console.aliyun.com/users
In the Actions column for the target RAM user, click Add Permissions.
In System Policies, find and grant the AliyunImarketingFullAccess permission, which is used to manage the marketing engine (imarketing).
After the policy is attached, the RAM user can use the Panxi platform.