RAM users

What is the RAM user login URL and username format?

RAM users can use the following URL to log on: RAM User Logon.

Note

You can also log on to the RAM console with an Alibaba Cloud account and find the RAM user logon URL on the Overview page. Using this URL pre-fills the default domain name, so users only enter their username.

RAM users can log on with any of the following username formats:

Default domain name: <UserName>@<AccountAlias>.onaliyun.com (example: username@company-alias.onaliyun.com).

Note
The logon name of the RAM user is in the User Principal Name (UPN) format. All logon names that are listed in the RAM console follow this format. <UserName> indicates the username of the RAM user. <AccountAlias>.onaliyun.com indicates the default domain name. For more information, see Key concepts and Manage RAM user logon domains.
Account alias: <UserName>@<AccountAlias> (example: username@company-alias).

Note
<UserName> indicates the username of the RAM user. <AccountAlias> indicates the account alias. For more information, see Key concepts and Manage RAM user logon domains.
Domain alias (requires configuration): <UserName>@<DomainAlias> (example: username@example.com).

Note
<UserName> indicates the username of the RAM user. <DomainAlias> indicates the domain alias. For more information, see Key concepts and Create and verify a domain alias.

What are the default domain name and domain alias?

Each Alibaba Cloud account has a unique default domain name in the format <AccountAlias>.onaliyun.com, used for RAM user logon and single sign-on (SSO). For more information about how to manage the default domain name, see Manage RAM user logon domains.

A domain alias is a publicly resolvable custom domain that replaces the default domain name. For more information, see Create and verify a domain alias.

Note

After domain ownership is verified, the domain alias replaces the default domain name in all applicable scenarios.

What permissions does a RAM user need to purchase resources?

To purchase pay-as-you-go services, the RAM user needs permissions to create instances or resources.
To purchase subscription resources, the RAM user needs both instance creation and payment permissions. Attach the AliyunBSSOrderAccess policy to grant payment permissions.

Creating a resource may require additional permissions to use or create dependent resources.

Example policy for creating ECS instances:

With this policy, a RAM user can create ECS instances from launch templates.

{
    "Version": "1",
    "Statement": [{
            "Action": [
                "ecs:DescribeLaunchTemplates",
                "ecs:CreateInstance",
                "ecs:RunInstances",
                "ecs:DescribeInstances",
                "ecs:DescribeImages",
                "ecs:DescribeSecurityGroups"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Creating an ECS instance may require additional permissions for dependent resources:

Operation	Policy
Use a snapshot to create an ECS instance	`ecs:DescribeSnapshots`
Create and use a VPC	`vpc:CreateVpc` `vpc:CreateVSwitch`
Create and use a security group	`ecs:CreateSecurityGroup` `ecs:AuthorizeSecurityGroup`
Assign a RAM role to an ECS instance	`ecs:DescribeInstanceRamRole` `ram:ListRoles` `ram:PassRole`
Use an AccessKey pair	`ecs:CreateKeyPair` `ecs:DescribeKeyPairs`
Create an ECS instance on a dedicated host	`ecs:AllocateDedicatedHosts`

Note

For more information about how to create custom policies, see Create a custom policy.
Grant permissions to the RAM user.

Why can't a RAM user access resources after being granted permissions?

Services with permission diagnostics show causes and solutions directly. For more information, see Troubleshoot access denied errors

For services without permission diagnostics, use the following table to identify and resolve the issue.

Cause	Solution
The policy is invalid.	Verify the policy attached to the RAM user is valid and meets your requirements.
A Deny statement is configured in a custom policy.	Check for `"Effect": "Deny"` in policies attached to the RAM user or their user group. A Deny statement always takes precedence over Allow. For example, if the RAM user has `AliyunECSReadOnlyAccess` but the following Deny policy is also attached, the RAM user cannot view ECS instances: `{ "Statement": [{ "Action": "ecs:", "Effect": "Deny", "Resource": "" }], "Version": "1" }`
The resources do not support the related authentication method.	Authentication methods vary by service. Verify the supported method is used: To obtain the services that support RAM-based authentication, refer to Services that support RAM. To obtain the services that support resource group-based authentication, refer to Services that work with Resource Group. To obtain the services that support tag-based authentication, log on to the Resource Management console, choose Tag > Tag in the left-side navigation pane, click the Resource Types Supported by Tag in the upper-right corner of the page, and then find the resource types for which the value of Tag Ram Support is Support.
The access control policy of a resource directory denies access to the resources.	If the Alibaba Cloud account belongs to a resource directory and an access control policy denies access, the RAM user cannot reach the affected resources. Contact the management account owner to modify or detach the control policy. Find the management account of the resource directory to which the member belongs. View the information about the resource directory to which a member belongs. Contact the owner of the management account to modify or detach the control policy. For more information, see Modify a custom control policy or Detach a Custom Control Policy.

Why can a RAM user access resources without explicit permissions?

For example, a RAM user can view ECS instances even if the AliyunECSFullAccess system policy, the AliyunECSReadOnlyAccess system policy, or related custom policies are not attached to the RAM user.

Check policies attached to the RAM user's user group.
Check whether other attached policies include the required permissions.

For example, AliyunCloudMonitorFullAccess includes "ecs:DescribeInstances", "rds:DescribeDBInstances", and "slb:DescribeLoadBalancer". A RAM user with AliyunCloudMonitorFullAccess can view ECS, ApsaraDB RDS, and SLB instances.

How do I grant renewal permissions to a RAM user?

No universal renewal policy exists. Create a service-specific custom policy with purchase and payment permissions, then attach it to the RAM user.

For example, to allow a RAM user to renew ECS instances, attach the following custom policy and the AliyunBSSOrderAccess system policy:

{
    "Version": "1",
    "Statement": [{
            "Action": [
                "ecs:DescribeLaunchTemplates",
                "ecs:RenewInstance",
                "ecs:DescribeInstances",
                "ecs:DescribeImages",
                "ecs:DescribeSecurityGroups"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

How are RAM users billed?

All fees incurred by RAM users are billed to the parent Alibaba Cloud account.
RAM users inherit the discounts of the parent Alibaba Cloud account by default.
Financial configurations (consumption budget, credit limit, payment methods) apply account-wide and cannot be set per RAM user.
RAM users can be authorized to add funds to the parent account. Added funds belong to the Alibaba Cloud account.
RAM users and user groups are not billed separately.

To allocate costs within your account, use the Resource Management service. For more information, see Allocate the costs of ECS instances by resource group and Tag-based cost allocation.

Why don't my RAM permissions work immediately?

RAM replicates permission data across multiple regions and zones for high availability. This follows eventual consistency, meaning changes may not appear everywhere simultaneously.

Permission updates are distributed globally, which can cause a brief delay before all services recognize the change. This multi-region design also enables automatic failover if a zone becomes unavailable.

What do I do if the number of policies attached to a RAM user exceeds the limit (LimitExceeded.User.Policy)?

When you attach policies to a RAM user and the number of attached policies exceeds the quota, the error LimitExceeded.User.Policy is reported.

To resolve this issue, request a quota increase by performing the following steps:

Log on to Quota Center.
Find the Number of policies attached to each RAM user quota item.
Click Apply to submit a quota increase request.

FAQ about CloudSSO quick logon links

Is the CloudSSO quick logon link a security risk?

No. The quick logon link is a helper feature that generates a URL shortcut. After you click the link, you are still required to complete standard identity authentication. The link is not a passwordless logon mechanism and does not pose a security risk.

Can I disable the CloudSSO quick logon link feature?

No. The CloudSSO quick logon link module cannot be disabled.

Can I query the generation records of quick logon links?

No. The system does not provide generation record queries. The quick logon link is a URL that is concatenated based on fixed rules. No backend generation logs are recorded.

Can I query the logon name of another Alibaba Cloud account?

No. An Alibaba Cloud account cannot directly query the username (logon name) of another account. The username is private account information, such as an email address or custom alias, and cross-account queries are not supported.

What do I do if a RAM user cannot access specific features despite having a FullAccess policy?

A product-level FullAccess policy may not cover all actions or features. If a RAM user has been granted a FullAccess policy but still receives an access denied error, check the following scenarios:

Scenario 1: Accessing Model Studio (Bailian) workspaces

In addition to the RAM authorization, you must add the RAM user as a member in the Model Studio console and assign a role. Go to the Workspaces page in the Model Studio console, select the target workspace, and add the RAM user as a member.

Scenario 2: API calls return errors such as log:CreateStoreView or yundun-sas:GetSwitchRegionDetail

The FullAccess policy may not include certain specific actions. Create a custom policy that contains the exact actions reported in the error message, and attach the custom policy to the RAM user.

Scenario 3: Copilot or AI assistant access

Verify that the AliyunSupportFullAccess policy has been attached to the RAM user and that the number of attached policies has not exceeded the quota.

Scenario 4: Domain name verification

Verify that the AliyunDNSFullAccess policy has been attached to the RAM user.

How do I grant a RAM user permissions to purchase cloud services?

To allow a RAM user to purchase cloud services such as ECS, grant the following permissions:

Product permissions: Attach the FullAccess policy for the target product. For example, attach the AliyunECSFullAccess policy to allow ECS operations, or create a custom policy that includes the required actions such as ecs:RunInstances.
Payment permissions: If the RAM user needs to purchase subscription (yearly or monthly) instances, you must also attach the AliyunBSSOrderAccess policy to allow the RAM user to place and pay for orders.
All-product purchasing permissions: To allow the RAM user to purchase all cloud products, attach the AdministratorAccess policy. Exercise caution when granting this policy because it provides full administrative access.

To grant permissions, go to the RAM console, choose Identities > Users, select the target user, and click Grant Permission.

Does revoking or removing certain permissions from a RAM user affect other cloud services?

Cloud service permissions are typically independent of each other. The impact of removing a policy depends on the scope of that policy:

Removing the AliyunRAMFullAccess policy revokes RAM management capabilities but does not affect business services such as Message Service (MNS).
Removing the PowerUserAccess policy does not affect business backend access, but the RAM user loses the ability to manage billing and resource directories.

Before removing a policy, verify its impact by using one of the following methods:

Use Permission Diagnostics in the RAM console to check which resources and actions are covered by the policy.
Use Access Analysis to review the recent usage of the policy and its associated resources.

Follow the principle of least privilege: promptly clean up unnecessary high-risk permissions to reduce the attack surface.

How does a RAM user request permissions or reuse existing permissions?

Requesting permissions

Alibaba Cloud does not support self-service permission approval for RAM users. To obtain permissions, the RAM user must contact the Alibaba Cloud account administrator to grant the required policies in the RAM console.

Reusing permissions

A RAM user can reuse already-granted product permissions to access different feature modules. For example, if a RAM user has been granted speech synthesis permissions, the same user can access speech recognition features without creating a separate RAM user for each module.

Viewing current permissions

RAM users cannot directly view their complete permission list. To confirm the current permissions, try accessing the target features, or contact the Alibaba Cloud account administrator to review the attached policies.

What do I do if a RAM user receives a logon error such as "current account does not allow RAM user logon" or "RAM logon required"?

Check the following scenarios based on the error message:

Scenario 1: Console logon is not enabled

Go to the RAM user details page, and check the Console Access status under Authentication > Logon Information. If the status is Disabled or Not Enabled, click Modify Logon Settings to enable console logon and reset the password.

Scenario 2: Global security policy restrictions

Check the security policy configured for the Alibaba Cloud account:

In the RAM console, go to Settings > Account Security Policy.
Check whether the Prohibit all RAM users from logging on option is selected.
Check whether a Logon Mask (IP whitelist) is configured. Verify that the RAM user's current IP address is within the allowed range.

Scenario 3: Risk control triggered by unusual logon behavior

Newly created accounts or logon attempts from unusual environments, such as proxy IP addresses or locations that differ from the usual pattern, may trigger automatic system blocking.

Have the administrator reset the RAM user's password in the RAM console to lift the restriction.
If the account was blocked due to security risks such as AccessKey leakage, first clean up any abnormal resources, disable compromised AccessKeys, and then request removal of the restriction.

Scenario 4: CloudSSO and RAM settings conflict

Disabling password logon in CloudSSO does not affect the independent RAM logon configuration. If you need to completely disable password logon for a RAM user, you must disable Console Access for that user in the RAM console.

What are the limits on RAM user logon methods, session duration, and environments?

Phone verification code and password logon coexistence

After console password logon is enabled for a RAM user, phone number verification code logon remains available. Both logon methods work independently and do not affect each other. A RAM user is not required to bind a phone number. Skipping MFA verification does not affect the security settings of the Alibaba Cloud account.

Alibaba Cloud App session limit

The maximum logon session duration for a RAM user on the Alibaba Cloud App is 24 hours. Permanent long-lived sessions are not supported.

Multi-account logon on the same device

Logging on to both an Alibaba Cloud account and a RAM user account simultaneously using different browsers on the same device does not typically trigger security exceptions. However, high-risk network environments such as public proxies, data center IPs, or frequent IP changes may still trigger security blocks. Use a stable and trusted network environment to avoid such issues.