DocsICP FilingConsole
Documentation

Credentials

Updated at:
Copy as MD
Product
My Favorites

This topic describes how to obtain and use credentials.

Credentials are a set of information that users provide to verify their identity when they log on to a system. Common credential types include the following:

  1. An AccessKey (AK) is a permanent credential for an Alibaba Cloud account or a Resource Access Management (RAM) user. It is a key pair that consists of an AccessKey ID and an AccessKey secret.

  2. A Security Token Service (STS) token is a temporary identity credential for an Alibaba Cloud RAM role. It has a custom validity period and custom access permissions. For more information, see What is STS?.

  3. A Bearer Token is a token type used for identity verification and authorization.

AccessKey

Root account

Each Alibaba Cloud account can have a maximum of five AK pairs at a time, including disabled ones. Log on to the RAM console to create or delete AK pairs. Each AK pair can be enabled or disabled. Only enabled AK pairs can be used for identity verification.

Warning

Because an AccessKey for an Alibaba Cloud account has full permissions on all resources, a leak poses a significant threat.

RAM user

Each RAM user can have a maximum of two AccessKey pairs. Log on to the RAM console, go to the details page of a specific RAM user, and then click Create AccessKey.

Note

The longer an AccessKey is active, the higher the risk of a leak. Rotate your AccessKeys regularly.

STS Token

RAM roles do not have permanent identity credentials. Use STS to obtain a temporary identity credential, an STS token, with a custom validity period and custom access permissions. Then, use the STS token to access Alibaba Cloud resources.

Note

Temporary identity credentials have a limited validity period. If a credential expires, call STS again to obtain a new STS token.

Bearer Token

Currently, only Cloud Call Center (CCC) supports credential initialization using a Bearer Token. In the Authentication Method Configuration section, select Bearer Token.

Recommendations

Leaked credentials can pose significant security threats to your cloud resources and business. Pay close attention to credential security in your daily operations management. For more information, see Secure use of credentials.