Separation of console users and program users

Potential risks

We recommend the single-responsibility principle for all scenarios. If a RAM user has both console logon and open API access enabled and the RAM user is reclaimed after the individual who uses the RAM user resigns, API calling fails and service failures occur.

Risk level

Medium-level risks may occur.

Best practices

Application users and human users must be kept separate. They must not be used interchangeably. The details are as follows:

• RAM users for applications: Enable only OpenAPI call access. Use separate RAM users for different applications and staging environments, and grant permissions based on the principle of least privilege.

• RAM users for individuals: Enable only console access. Use single sign-on (SSO) for logon to reduce the threat of identity exposure.

Governance suggestions

1. Determine if the current RAM user (User1) needs console access.

   • None: Disables console access. For more information, see Modify console logon settings.

   • If so, proceed to the next step.

2. Create a new RAM user (User2) and enable console access.

   For more information, see Create a RAM user and Enable console logon.

3. Grant User2 the same permissions as User1.

   For more information, see Grant permissions to a RAM user.

4. Disable console access for User1 and enable only OpenAPI call access.

   For more information, see Modify console logon settings for a RAM user.

Governance difficulty

The governance difficulty is low.