This topic introduces the core concepts, key features, and security guidelines of Alibaba Cloud Resource Access Management (RAM) to help you securely access your cloud resources.
What is RAM
Resource Access Management (RAM) is an Alibaba Cloud service that allows you to centrally manage user identities and their access to your resources. With RAM, you can create and manage various identities and grant them granular permissions to securely access your cloud resources.
Billing
RAM is available free of charge. You can use RAM after your Alibaba Cloud account completes real-name verification. You cannot disable RAM.
Why use RAM
Using your Alibaba Cloud account or sharing its credentials for daily operations creates the following management and security challenges:
Excessive permissions and security risks: Your Alibaba Cloud account has unrestricted access to all of your resources. Sharing these credentials can lead to privilege misuse, giving any user with access full control. If the credentials are compromised, all your cloud resources face severe security risks.
Lack of accountability: All operation logs are attributed to the Alibaba Cloud account. When a security incident occurs, you cannot identify the actual operator, which undermines security auditing and accountability.
Difficulty in separating duties: You cannot grant specific permissions, such as "view-only billing" for finance staff or access to operate only in specific environments for developers. This violates the principle of least privilege.
RAM effectively addresses these issues by allowing you to create separate identities and grant them precise permissions, making it fundamental to securing your cloud resources.
Key concepts
What is an identity
An identity is an entity that accesses resources and performs actions in a cloud environment. It is the entity that receives permissions. There are two main types of identities in a cloud environment: human identity and machine identity.
Human identity: Represents people in your organization, such as security administrators, operations engineers, or developers. Human identities access and manage cloud resources interactively through tools like the console or CLI.
Machine identity: Represents an application or service that typically accesses cloud resources and data non-interactively through an API. Machine identities are suitable for scenarios like automated scripts, application development, and service integrations.
What is authentication
Authentication is the process of verifying an identity. To prove their identity, users must provide credentials, such as a username and password.
Credentials come in many forms, such as familiar usernames and passwords, one-time passcodes, or the AccessKey pairs used by machine identities.
To enhance security, multi-factor authentication (MFA) requires you to provide at least two different types of credentials to verify your identity, such as a password combined with a one-time passcode. Single sign-on (SSO) allows you to access all trusted applications or resources after one successful authentication without needing to sign in again.
What is authorization
Authorization is the process of determining whether an authenticated identity has permission to access a specific resource.
The core difference between authentication and authorization is as follows:
Authentication answers the question, "Who are you?" to verify an identity.
Authorization answers the question, "What are you allowed to do?" to grant or deny permissions.
Authentication is a prerequisite for authorization. After an identity is authenticated, it is then authorized to determine which resources it can access and actions it can perform.
By granting different permissions to different types of identities, you can achieve granular control over your cloud resources, ensuring each identity acts only within its designated scope.
Core features
Identity management: Create and manage various types of identities, such as RAM users, RAM user groups, and RAM roles.
Identity authentication: Provide multiple authentication methods, such as passwords, AccessKey pairs, MFA, and SSO.
Authorization management: Use policies to implement fine-grained access control for identities.
Identity federation: Integrate with your corporate identity system to enable unified identity management and single sign-on.
Permission auditing: Identify the permissions assigned to RAM identities and record the last time a permission was used.
Identity types
RAM provides three types of identities: RAM user, RAM user group, and RAM role. A RAM user group is a collection used to classify and manage RAM users. Both RAM users and RAM roles can be used as human or machine identities.
Alibaba Cloud account vs. RAM user
After you complete Step 1: Create an Alibaba Cloud account, you get an Alibaba Cloud account. An Alibaba Cloud account is similar to the root user in a Linux system. It is highly privileged and not suitable for daily use. You can create RAM User for day-to-day management. The core differences are as follows:
Item | Alibaba Cloud account | RAM user |
Identity role | The owner of resources. Has full ownership and the highest level of permissions. | A user of resources and services. The Alibaba Cloud account (or an administrative RAM user) grants the permissions. It usually corresponds to a specific person or application. |
Owns cloud resources | Yes | No. The resources are owned by the Alibaba Cloud account. |
Default permissions | Full permissions. Cannot be restricted. | No permissions by default. Permissions must be granted by the Alibaba Cloud account (or a RAM user with administrator permissions). |
Recommended use | For critical management operations only, such as authorization, payment, and account management. | Daily tasks, such as development, operations, and deployment. |
Security best practices for your Alibaba Cloud account
Create a RAM user with administrator permissions for daily management and technical operations.
Use your Alibaba Cloud account only when necessary and securely store its credentials, including its password and MFA device.
Perform all daily operations by using the administrative RAM user to avoid exposing your Alibaba Cloud account credentials in daily work environments.
Identity type comparison
Different RAM identity types are suitable for different use cases. The following table describes the definitions and primary use cases for each identity type in RAM:
Identity type | Definition | Primary use case |
RAM User | Represents an individual or application identity. It has credentials for specific access methods, such as a logon password for console sign-in or an AccessKey pair for programmatic calls. | Corresponds to a specific employee, system, or application in an enterprise. It is used for scenarios that require long-term access to cloud resources. |
RAM Group | A collection of RAM User that simplifies permission management. Attaching a policy to a user group grants the specified permissions to all users in that group. | Grant or revoke permissions in batches for multiple RAM User with the same job function, such as development or test teams, to simplify permission management. |
RAM Role | A virtual identity that can be granted permissions but does not have long-term credentials like a password or an AccessKey pair. A RAM role must be assumed by an entity, such as an Alibaba Cloud account, a cloud service, or an identity provider, to obtain temporary security credentials for access. | Used for scenarios such as cross-account resource access, authorizing a cloud service to access other resources, and integrating with an IdP to implement single sign-on (SSO). |
Authentication methods
Authentication method comparison
RAM supports multiple authentication methods for different use cases:
Console sign-in scenarios
Authentication method | Definition | Use case |
Logon password | Credentials used for interactive sign-in. | RAM users signing in to the console or other scenarios that require interactive authentication. |
Multi-factor authentication (MFA) | An extra layer of security on top of logon password authentication. | Used with a logon password to enhance sign-in security. By default, all RAM users are required to use MFA to sign in. |
Passkey | A passwordless authentication solution based on the FIDO2 standard that allows users to securely and conveniently authenticate by using their device's biometrics (such as a fingerprint or face ID) or a PIN. | Further enhances sign-in security and convenience and prevents password leaks and phishing attacks. Recommended if you do not frequently change your access device and your current device supports passkeys. |
DingTalk account sign-in | Users can sign in quickly without a password by scanning a QR code or using one-click sign-in in the DingTalk mobile app. | Provides unified identity authentication for RAM users within an enterprise to improve the daily experience of accessing the management console. |
Single sign-on (SSO) | Users authenticate through their corporate identity provider (IdP) and can access multiple trusted cloud services with a single sign-on. | Enterprise users accessing Alibaba Cloud by using their existing identity system, such as Microsoft Entra ID or Okta. |
Programmatic access scenarios
Authentication method | Definition | Use case |
AccessKey pair | A key pair that consists of an AccessKey ID and an AccessKey secret. It is owned by a RAM user and is valid long-term. | Applications, CLIs, or services calling cloud services through APIs. This method is less secure. |
STS token | A temporary credential obtained after a RAM role is successfully assumed. It includes a temporary AccessKey pair and a security token, and has a limited validity period. | Applications, CLIs, or services calling cloud services through APIs. Also used for cross-account resource access, identity federation (SSO), or temporarily granting permissions to cloud services. This method is more secure. |
Long-term vs. temporary credentials
Long-term credentials: Credentials that remain valid until they are manually disabled, deleted, or rotated. Examples include a logon password and an AccessKey pair.
Temporary credentials: Credentials that have a preset validity period, for example, from 15 minutes to several hours, and expire automatically. An example is an STS token.
Temporary credentials offer higher security than long-term credentials. If long-term credentials are leaked, they can be exploited, posing a continuous security threat. In contrast, temporary credentials have a preset validity period. Even if leaked, their impact is limited to their validity period and the permissions granted, which reduces the security risk. Therefore, we recommend using temporary credentials whenever possible. For more information, see Best practices for accessing Alibaba Cloud OpenAPI by using credentials.
An STS token is issued by Alibaba Cloud Security Token Service (STS) after a RAM role is authenticated. To learn what STS is, see What is STS?. To learn how to obtain an STS token, see Obtain temporary credentials by assuming a RAM role.
Policies
After an identity is authenticated, RAM evaluates its attached policies to determine whether to grant or deny the request. RAM follows a deny-by-default principle: any access request that is not explicitly allowed is denied.
Policy types
Permissions are managed by using a policy, which is a set of rules that defines permissions. RAM supports the following two types of policies:
System policy: Created and managed by Alibaba Cloud. These policies cover common authorization scenarios. You can attach system policies directly to identities, but you cannot modify their content.
Custom policy: A policy that you can create and manage. By writing a policy document in JSON format, you can precisely define allowed or denied actions (Action), resources (Resource), and conditions (Condition) to implement fine-grained access control.
For more information, see Overview of policies.
Authorization scope
The authorization scope can be limited to an entire Alibaba Cloud account, or to specific projects or environments by using resource groups.
For more information, see Policy model.
Conditional control
RAM uses an attribute-based access control (ABAC) model that allows you to set conditions in custom policies to implement conditional access control. For example, you can restrict access requests to a specific source IP address range or require sign-in with MFA before a specific action can be performed.
Conditions can include system-predefined attributes, such as identity attributes, resource attributes, and request environment attributes, as well as custom attributes like tags.
Conditional control must be configured in a custom policy.
For more information, see Basic elements of a policy.
Enterprise identity federation
RAM supports single sign-on (SSO) based on the SAML 2.0 and OpenID Connect (OIDC) protocols. This capability is also known as identity federation.
Why use identity federation
In multi-cloud and enterprise IT environments, employees often need to access various internal systems and cloud services. Frequently switching between accounts and remembering different passwords affects operational efficiency and increases security risks. Compared with managing individual RAM user credentials, identity federation provides the following benefits:
Simplified sign-in: Employees sign in to your identity provider (IdP) portal only once to access Alibaba Cloud and other applications that have a trust relationship with the IdP. This eliminates the need to maintain multiple sets of usernames and passwords.
Centralized security policies: Corporate security policies, such as MFA, password policies, and IP address restrictions, are configured and enforced at the IdP level.
Centralized management and auditing: You can centrally configure and revoke user permissions through your existing identity management platform. This synchronizes employee onboarding and offboarding with cloud permissions, reducing management costs and compliance risks.
Supported SSO methods
Alibaba Cloud RAM supports the following two SSO modes to meet the requirements of different business scenarios:
User-based SSO
This method maps users from your identity provider (IdP) to Alibaba Cloud RAM User. Users then sign in to the console as their corresponding RAM users.Role-based SSO
Federated users assume an Alibaba Cloud RAM Role to obtain an STS token for resource access. This method supports scenarios such as cross-account authorization, multiple IdPs, and programmatic access. Role-based SSO better aligns with the principle of least privilege and security best practices.
For more information, see Overview of SSO.
RAM security
We recommend that you follow these best practices to build a secure, efficient, and easy-to-maintain identity and permission system.
Identity and permission management
RAM security audit
Use ActionTrail to query operation records: ActionTrail records all operations performed by RAM identities for security auditing, compliance reviews, and issue tracing. For more information, see Use ActionTrail to query events.
Identity and access governance: Continuously detect security risks related to the identities and permissions of your Alibaba Cloud account and its RAM users, such as long-inactive AccessKey pairs and non-compliant password policies. For more information, see Overview of identity and access governance.
Access analysis: Analyze and identify access from the internet and over-privileged identities in your account and receive governance suggestions.
For more information, see Identity and permission management best practices.
Next steps: Quick start
You can get started with RAM by following these common use cases: