RAM use cases

1. Assign permissions to employees

Scenario: 

Sharing your Alibaba Cloud account credentials with multiple employees creates security risks: no accountability and excessive permissions. You need to grant each employee only the permissions their role requires.

Solution:

Create a RAM user for each employee and attach policies based on the principle of least privilege (PoLP), granting only the permissions necessary for their role (such as network administrator or security administrator). Group users with similar responsibilities and attach policies at the group level.

Benefits:

• Clear accountability: Each employee uses a separate identity. All actions are auditable and traceable.

• Security and compliance: Fine-grained access controls reduce risks from over-privileged users or shared credentials, supporting compliance requirements.

Examples:

• Assign different system policies to different O&M engineers, such as virtual machine O&M engineers and network O&M engineers. For more information, see Manage permissions for O&M engineers.

• Define and apply custom policies. Custom policies for ECS.

• Configure custom policies based on access conditions such as request sources or resource tags. Access Alibaba Cloud from specified IP addresses.

2. Isolate resources by project or environment

Scenario: 

Your organization runs multiple projects or environments (development, production) in a single Alibaba Cloud account. You need strict separation so developers in one project cannot access another project's resources or modify production resources.

Solution:

Use resource groups to organize cloud resources by project or environment, then attach RAM policies that grant access only to specific resource groups.

Benefits:

• Clear lines of responsibility: Using the Resource Group feature, you can divide permissions by project or environment. This ensures that team members can access only the resources for which they are responsible.

• Fine-grained cost management: Resource groups enable accurate cost allocation and billing analysis by project or environment.

Resource grouping and authorization.

3. Authorize cross-account resource access

Scenario: 

Your enterprise needs to grant partners, subsidiaries, or other third parties access to specific cloud resources without sharing long-term credentials like AccessKey pairs.

Solution:

Create a RAM role with a trust relationship to the other Alibaba Cloud account and grant it specific permissions. Users in the trusted account can then assume this role to obtain temporary credentials for accessing only the permitted resources.

Benefits:

• Secure and controllable: RAM roles enable secure cross-account access through temporary credentials that are valid only for a short duration, eliminating the need to share long-term credentials.

• Flexible permission management: Adjust role permissions or revoke authorization at any time to maintain control over shared resources.

• Fine-grained access control: Create separate RAM roles for different partners with distinct permission scopes.

Access resources across Alibaba Cloud accounts.

4. Enable passwordless console logon

Scenario:

Your team wants a more secure and convenient alternative to passwords for console logon, such as fingerprint or facial recognition.

Solution:

You can enable and use passkeys for passwordless authentication.

A passkey is a secure digital credential stored on a personal device or hardware security key that replaces traditional passwords. After you enable passkeys, team members can log on using biometric authentication (fingerprint or Face ID) or a device PIN.

Benefits:

• Eliminating password risks: No passwords to remember or enter, eliminating risks from password leaks and weak passwords.

• User-friendly logon experience: Using biometrics or a hardware security key makes the logon process faster and more convenient.

• Enhanced security: Built on public-key cryptography, passkeys resist phishing attacks and are more secure than traditional passwords.

For more information, see What is a passkey?

5. Integrate an enterprise IdP for SSO

Scenario:

Your enterprise wants employees to use existing corporate credentials from an identity provider (IdP) like Active Directory, Microsoft Entra ID, or Okta to log on to Alibaba Cloud, centralizing identity management and enabling single sign-on (SSO).

Solution: 

You can configure role-based SSO or user-based SSO to integrate your enterprise IdP with Alibaba Cloud.

Benefits:

• Simplified logon: Employees log on to the IdP portal once to access Alibaba Cloud and other trusted applications, eliminating multiple usernames and passwords.

• Centralized security policies: Security policies such as MFA, password rules, and IP restrictions are enforced centrally at the IdP level.

• Centralized management and auditing: Provision and revoke access centrally during employee onboarding and offboarding through your IdP, reducing management overhead and compliance risks.

For an example, see Example: Configure role-based SSO with Microsoft Entra ID.