Identity management
Use a Resource Access Management (RAM) user or RAM role to access ApsaraDB for MongoDB — not your Alibaba Cloud account. Your Alibaba Cloud account has unrestricted access to all resources; a compromise puts everything at risk.
RAM users
A RAM user is a fixed identity with a username, password, and optional AccessKey pair. RAM users can be created by an Alibaba Cloud account or by a RAM user or RAM role that has administrative rights. After a RAM user is granted the required permissions, it can access resources in the Alibaba Cloud account through the Alibaba Cloud Management Console or by calling API operations.
Console users vs. programmatic users
RAM users come in two types, and keeping them separate reduces the blast radius of any security incident:
| Type | Access mode | Credential | Use for |
|---|---|---|---|
| Console user | Console Access | Username and password | Human operators managing the database |
| Programmatic user | Using permanent AccessKey to access | AccessKey pair | Applications and scripts that call API operations |
You can also configure a RAM user with both Console Access and AccessKey-based access for the Access Mode parameter.
Use your Alibaba Cloud account to create one RAM user with administrative rights, then use that RAM user to create and manage all other RAM users.
Security practices for RAM users
Enable MFA for every console user. Multi-factor authentication (MFA) is the most effective control against credential theft. Enable it for any RAM user with console access.
Apply least privilege. Grant only the minimum permissions required for the task. Least-privilege permissions prevent permission abuse and limit damage from compromised accounts.
Never embed credentials in code. Hardcoding an AccessKey ID or AccessKey secret in source code exposes it to anyone who reads the code or accesses version control. Use Security Token Service (STS) tokens or environment variables to supply credentials at runtime instead.
Enable single sign-on (SSO) if your organization uses a central identity provider. SSO lets RAM users log in to Alibaba Cloud resources from your enterprise identity management system without managing a separate set of credentials.
Related topics
RAM user groups
Group RAM users to manage permissions at scale. Users in the same RAM user group share the same permissions, so you only need to update the group once when access requirements change.
Apply least privilege to groups. Keep group permissions as narrow as the common task shared by all members.
Remove users when their role changes. If a RAM user's responsibilities change, remove them from the current group before adding them to a more appropriate one.
Revoke permissions that are no longer needed. Audit group permissions regularly and remove any that the group no longer uses.
Related topics
RAM roles
A RAM role is a virtual identity with no permanent credentials — no password, no AccessKey pair. A trusted entity (such as an Alibaba Cloud service, a RAM user, or an account) assumes the role to get a short-lived STS token, then uses that token to access resources as the role. This makes RAM roles the right choice for cross-service access, temporary access grants, and federated identity scenarios.
How it works
-
Attach a permission policy to the RAM role.
-
Grant a trusted entity permission to assume the role.
-
The trusted entity calls the
AssumeRoleAPI operation and receives an STS token. -
The trusted entity uses the STS token to access ApsaraDB for MongoDB resources as the RAM role. The STS token is valid only for a limited period of time.
Security practices for RAM roles
Do not frequently change the trusted entity after creation. Changing the trusted entity of an existing RAM role can revoke access for current holders (breaking your business) or grant access to unintended principals (creating a privilege escalation risk). Test changes thoroughly in a non-production environment before applying them.
Set an appropriate session duration. An STS token is valid for at most the maximum session duration configured on the RAM role.
The shorter the session duration, the smaller the window of exposure if a token is leaked. Set the maximum session duration to the minimum value that keeps your workflows running without requiring frequent re-authentication.
Enable SSO for RAM roles if your organization uses a central identity provider. Role-based SSO lets users authenticate through your enterprise identity management system and assume RAM roles directly.