Best practices for identity and access management

1. Avoid daily operations with the Alibaba Cloud account

• Best practice: Your Alibaba Cloud account is similar to the root user in a Linux system. It has unrestricted access and should not be used for daily tasks. We recommend the following:

  1. Create a RAM user with administrator privileges for daily management and technical operations.

  2. Use the Alibaba Cloud account only when necessary, and securely store its credentials, including its password and MFA device.

  3. Use the administrative RAM user for all daily tasks to avoid exposing the Alibaba Cloud account.

• Suggested actions:

  • Create dedicated RAM users: We recommend that you first create a RAM user as an administrator, and then create and authorize a RAM user for each member of your organization.

  • Enable MFA for your Alibaba Cloud account: Secure your Alibaba Cloud account by configuring MFA for your account. Use this account only when necessary, and securely store its credentials.

2. Strengthen logon security

• Best practice: Protecting your user credentials is critical. Complex passwords, regular rotation, and multi-factor authentication (MFA) significantly reduce the risk of credential compromise.

• Suggested actions in RAM:

  • Enforce a strong password policy: Configure a password policy for RAM users that requires a minimum length, complexity, a validity period (for example, 90 days), and a limit on failed logon attempts to enhance password security.

  • Enforce MFA for RAM users: MFA adds a second layer of security to a password. It effectively blocks unauthorized logons, even if a password is compromised. In Manage security settings for RAM users, you can require all RAM users in your account to MFA for RAM user sign-in.

3. Implement SSO for human identities

• Best practice: Use single sign-on (SSO) to federate your corporate identity provider (IdP) with Alibaba Cloud. This practice eliminates the need to maintain a separate password system in the cloud. It also centralizes identity lifecycle management, allowing you to manage user onboarding, offboarding, and permission changes in one place.

• Suggested action: Use RAM's SSO management feature to federate your corporate IdP, such as Microsoft Active Directory or Okta, with Alibaba Cloud based on the SAML 2.0 or OIDC protocol. You can configure user-based SSO or role-based SSO based on your environment and logon requirements.

  Note

  If your organization uses Resource Directory (RD) to manage multiple Alibaba Cloud accounts, we recommend that you use CloudSSO to implement centralized identity and permission management across multiple accounts.

1. Prioritize temporary credentials (STS tokens)

• Best practice: A long-term AccessKey pair remains valid until it is manually deleted. If an AccessKey pair is compromised, the security risk persists. In contrast, an STS token is a temporary credential that you can obtain by assuming a RAM Role. It automatically expires after the session duration. Even if an STS token is accidentally compromised, the window for misuse is extremely small.

• Suggested action: Use AccessKey-free methods to obtain an STS token, such as an ECS instance RAM role, a container instance RAM role, or a Function Compute service RAM role. This approach completely avoids exposing an AccessKey pair. For more information, see Best practices for using access credentials to access Alibaba Cloud OpenAPI.

2. Securely manage unavoidable AccessKey pairs

• Best practice: For scenarios where you cannot use STS tokens, such as for local development and debugging, you may need to use a long-term AccessKey. In these cases, avoid using the AccessKey of your Alibaba Cloud account. Ensure that each AccessKey is used for only one application in a single environment and is rotated regularly.

• Suggested actions:

  • Avoid using the AccessKey pair of your Alibaba Cloud account: In scenarios where you must use an AccessKey, use the AccessKey of a RAM user with appropriate permissions instead. See Do not use the AccessKey pair of an Alibaba Cloud account.

  • Avoid sharing an AccessKey pair: Create a separate RAM User and a dedicated AccessKey for each application and each environment, such as development, testing, and production. For more information, see Create an AccessKey pair.

  • Grant least privilege: Grant only the minimum required permissions to the RAM User associated with the AccessKey. Periodically identify over-privileged identities and manage permission policy grants as needed.

  • Never hard-code credentials: Manage an AccessKey by using methods such as configuring system environment variables or KMS Secrets Manager. Never embed a plain-text AccessKey in your code repository.

  • Restrict access: Configure a network access policy to restrict the AccessKey pair to specific IP addresses. For more information, see AccessKey network access restriction policy.

  • Promptly disable and delete idle AccessKey pairs: Set a maximum idle period for an AccessKey pair. We recommend a period of 90 days, but no more than 365 days. For more information, see Manage security settings for RAM users.

  • Monitor and audit: Use ActionTrail to monitor AccessKey pair usage and detect unusual activities in a timely manner.

Best practices for AccessKey pairs

An AccessKey pair is a long-term credential for programmatic access. If an AccessKey pair is compromised, the security of all resources under the account is at risk.

• We strongly recommend that you do not create an AccessKey pair for your Alibaba Cloud account.

• Minimize the creation of long-term AccessKey pairs. Prioritize the use of temporary credentials, such as STS tokens, to reduce the risk of credential compromise.

• Do not share AccessKey information or record it in public documents.

• Avoid hard-coding a plain-text AccessKey pair in your code.

• Disable an AccessKey pair immediately when it is no longer needed.

• Rotate AccessKey pairs regularly. For each RAM user, reserve a secondary AccessKey pair exclusively for rotation.

• Grant only the minimum necessary permissions to the RAM user.

For more information, see Best practices for using access credentials to access Alibaba Cloud OpenAPI.

1. Grant least privilege

• Best practice: Grant an identity only the minimum permissions required to perform its tasks. This minimizes the potential impact of a compromised credential.

• Suggested actions:

  • Use custom policies: For non-administrative scenarios, avoid using broad system policies such as AdministratorAccess. Create fine-grained permissions by using custom policies. Always specify the Resource, Action/NotAction, and Condition elements.

  • Review permissions regularly: Periodically identify over-privileged identities and manage permission policy grants as needed.

2. Simplify permission management with RAM user groups

• Best practice: Align permissions with job functions. Instead of managing permissions for individual RAM User, you can simplify permission management by moving users between RAM Group. This improves efficiency and ensures consistent permissions for each role.

• Suggested actions:

  1. Create RAM user groups: Create RAM user groups based on job roles within your organization, such as groups for network administrators or application developers.

  2. Configure permission policies: Grant permissions to RAM user groups based on job responsibilities instead of attaching policies directly to individual RAM User.

3. Set permission boundaries for multiple accounts

• Best practice: For organizations with multiple Alibaba Cloud accounts, use a Resource Directory in Resource Directory to set permission boundaries for RAM identities in member accounts.

• Suggested action: In a multi-account environment managed with Resource Directory, when a RAM User or RAM Role in a member account attempts to access an Alibaba Cloud service, Alibaba Cloud evaluates the control policy before checking the in-account RAM permissions. For more information, see Control policies. Before you attach a control policy, we recommend that you test it in a limited scope to ensure that the policy is effective and works as expected. Then, attach the policy to the target nodes, such as folders or members.