Key concepts

Term

Description

Alibaba Cloud account

To use Alibaba Cloud, you must register an Alibaba Cloud account. An Alibaba Cloud account is the fundamental entity for resource ownership, metering, and billing. The account pays for all the resources it owns and has full control over them.

By default, only the Alibaba Cloud account can access its resources. Any other user requires explicit authorization from the account. An Alibaba Cloud account is equivalent to a root or Administrator user in an operating system, which is why it is sometimes called a root account or main account.

As a security best practice, avoid using your Alibaba Cloud account to log on to the console or create an AccessKey pair unless absolutely necessary. We recommend creating a RAM user under your Alibaba Cloud account, granting it administrative permissions, and using that RAM user for all management tasks.

account administrator

An account administrator has full management permissions for all resources in the account. An account administrator can be the Alibaba Cloud account (the main account) or a RAM user with the AdministratorAccess policy attached. We strongly recommend using a RAM user as the account administrator. For more information, see Create an account administrator.

RAM administrator

A RAM administrator has management permissions for all RAM resources within the account. A RAM administrator can be the Alibaba Cloud account (the main account) or a RAM user with the AliyunRAMFullAccess policy attached. We strongly recommend using a RAM user as the RAM administrator.

identity

RAM provides three types of identities: RAM users, RAM user groups, and RAM roles. RAM users and RAM user groups are physical identities, while RAM roles are virtual identities.

default domain name

Alibaba Cloud assigns a Default Domain to each Alibaba Cloud account in the format <AccountAlias>.onaliyun.com, where <AccountAlias> is the account alias. This default domain name serves as the unique identifier for the Alibaba Cloud account in scenarios such as RAM user login or SSO.

For more information about how to set the default domain name, see Manage logon domains for RAM users.

account alias

An account alias is also called an enterprise alias. The default value for an account alias is your Alibaba Cloud Account ID<AccountID>. The account alias is the <AccountAlias> in the default domain name. Setting a default domain name is equivalent to setting an account alias. For RAM user login, the account alias and the default domain name are interchangeable, and you can use either to log in.

For example, if an enterprise sets its account alias to company1, a RAM user named alice under this account can log on to the Alibaba Cloud console by using alice@company1.

For more information about how to set an account alias, see Manage logon domains for RAM users.

domain alias

If you own a publicly resolvable domain name, you can use it as a Domain Alias to replace your default domain name.

For more information about how to set a domain alias, see Create and verify a domain alias.

RAM user

A RAM user is a physical identity type in RAM with a fixed identity ID and credentials. It typically corresponds to a specific person or application. A RAM user has the following characteristics:

• An Alibaba Cloud account can have multiple RAM users, which can represent employees, systems, or applications within your organization.

• RAM users do not own any resources and are not individually billed. All resources and costs are owned by and billed to the parent Alibaba Cloud account.

• RAM users belong to an Alibaba Cloud account and are visible only within that account. They are not separate Alibaba Cloud accounts.

• RAM users must be granted permissions by the Alibaba Cloud account before they can log on to the console or use an API to access the account's resources.

For more information about how to create a RAM user, see Create a RAM user.

password

A password is an identity credential used to log on to Alibaba Cloud and verify a user's identity.

For more information about how to set the password of a RAM user, see Change the logon password of a RAM user.

AccessKey pair

An AccessKey pair is a long-term access credential provided by Alibaba Cloud for programmatic access. It consists of an AccessKey ID and an AccessKey secret.

• AccessKey ID: The public, unique identifier for the AccessKey pair.

• AccessKey secret: The secret component of the AccessKey pair used to sign API requests to verify their authenticity and integrity. You must keep your AccessKey secret strictly confidential.

RAM generates the AccessKey ID and AccessKey Secret. Alibaba Cloud encrypts them during both storage and transmission.

You cannot use an AccessKey pair to log on to the Alibaba Cloud console. Instead, use it for programmatic access to Alibaba Cloud APIs with tools like the CLI, SDKs, and Terraform.

For more information about how to create an AccessKey pair, see Create an AccessKey pair.

MFA

Multi-factor authentication (MFA) is a simple and effective security best practice that adds an extra layer of protection in addition to a username and password. This combination provides enhanced security for your account. When MFA is enabled, you must provide two factors of authentication when you log on:

1. The first factor: your username and password.

2. The second factor: a verification code from a virtual MFA device or authentication through a Universal 2nd Factor (U2F) security key.

For more information about how to set up MFA, see Enable a RAM user to bind an MFA device.

RAM user group

A RAM user group is an identity for managing RAM users who have the same responsibilities. Instead of assigning permissions to each user, you can assign them to the group, which simplifies management.

• If a RAM user's responsibilities change, simply move the user to the appropriate user group. This does not affect other RAM users.

  For more information about how to create a user group, see Create a RAM user group.

• When the permissions for a user group change, you only need to modify the policies attached to the group. The changes automatically apply to all RAM users in the group.

  For more information about how to grant permissions to a user group, see Grant permissions to a RAM user group.

RAM role

A RAM role is a virtual identity that can be granted a set of policies. Unlike a RAM user, a RAM role does not have long-term credentials like a password or an AccessKey pair. Instead, a RAM role is designed for a trusted entity to assume. After assuming a role, the entity receives a temporary STS token to access authorized resources.

RAM roles are categorized based on the type of trusted entity:

• RAM role for an Alibaba Cloud account: This role is used for cross-account access and temporary authorization. Only a RAM user from a trusted Alibaba Cloud account, which can be the current account or another one, can assume this role. For more information, see Create a RAM role for a trusted Alibaba Cloud account.

• RAM role for an Alibaba Cloud service: This role is used to grant an Alibaba Cloud service permission to access your resources. Only the trusted service can assume this role. For more information, see Create a RAM role for a trusted Alibaba Cloud service and Service-linked roles.

• RAM role for an identity provider: This role is used to enable SSO between Alibaba Cloud and an external IdP. Only users from the trusted IdP can assume this role. For more information, see Create a RAM role for a trusted IdP.

SP

A service provider (SP) is an application that provides services to users by using the identity management functions of an IdP. The SP uses the user information provided by the IdP. In some identity systems that do not use the SAML protocol, such as OpenID Connect, an SP is also known as a relying party.

IdP

A RAM entity that contains metadata about an external identity provider (IdP), which is a service that offers identity management.

• On-premises IdPs: Examples include Microsoft Active Directory Federation Services (AD FS) and Shibboleth.

• Cloud-based IdPs: Examples include IDaaS, Microsoft Entra ID, Google Workspace, Okta, and OneLogin.

SAML 2.0

A standard protocol for enterprise user authentication and one of the technical implementations for communication between an SP and an IdP. Security Assertion Markup Language (SAML) 2.0 is the de facto standard for implementing enterprise SSO.

SSO

Alibaba Cloud supports SSO based on SAML 2.0 and OpenID Connect (OIDC), also known as identity federation. Alibaba Cloud provides two SSO methods:

• User SSO

  Alibaba Cloud determines the mapping between an enterprise user and an Alibaba Cloud RAM user based on the SAML assertion issued by the IdP. After logging on, the user accesses Alibaba Cloud resources as that RAM user. For more information, see Overview of user-based SSO.

• Role SSO

  • SAML-based role SSO: Alibaba Cloud determines the RAM role that an enterprise user can assume based on the SAML assertion issued by the IdP. After logging on, the user assumes the RAM role specified in the SAML assertion to access Alibaba Cloud resources. For more information, see Overview of role-based SSO that uses SAML.

  • OIDC-based role SSO: An enterprise user calls an Alibaba Cloud API to assume a specified role by using an OIDC token issued by the IdP. The user then obtains a temporary STS token and uses it to securely access Alibaba Cloud resources. For more information, see Overview of role-based SSO that uses OIDC.

metadata file

The enterprise IdP provides this file, typically in XML format. It contains information such as the IdP's logon service URL, the public key for signature verification, and the assertion format.

SAML assertion

A core element in the SAML protocol used to describe authentication requests and responses. For example, specific user attributes are included in the assertion of an authentication response.

trust

A mutual trust mechanism established between an SP and an IdP, typically implemented using public and private keys. The SP securely obtains the IdP's SAML metadata, which contains the public key for verifying the signature of SAML assertions issued by the IdP. The SP uses this public key to verify the integrity of the assertions.

Alibaba Cloud OAuth 2.0 service

Authenticates a user, accepts the user's authorization for an application, generates a token that represents the user's identity, and returns it to the authorized application.

OAuth application

Obtains user authorization and acquires a token representing the user's identity to access Alibaba Cloud.

The OAuth 2.0 service currently supports the following application types:

• WebApp: A web application that interacts with users through a browser.

• NativeApp: A native application that runs on an operating system, such as a desktop or mobile application.

• ServerApp: An application that directly accesses Alibaba Cloud services without requiring a user to log on. Currently, only user synchronization applications based on the SCIM protocol are supported.

OAuth scope

The OAuth 2.0 service uses OAuth scopes to limit the scope of access that an application has on behalf of a user after the user logs on to Alibaba Cloud.

Term

Description

permission

A permission defines whether a user can perform a specific action on a specific resource. The effect can be either Allow or Deny.

Actions are divided into two main categories:

• Resource management actions: These relate to the lifecycle management and O&M of cloud resources. Resource owners or operations staff typically perform these actions. Examples include creating, stopping, or restarting ECS instances, and creating, modifying, or deleting OSS buckets.

• Resource usage actions: These relate to using the core functions of a resource. Developers or applications typically perform these actions. Examples include user actions within an ECS instance's operating system, or uploading and downloading data from an OSS bucket.

  Note

  • For services like Elastic Compute Service (ECS) and database services, RAM manages resource management actions, while each service instance manages resource usage actions. For example, access control for an ECS instance's operating system or permissions within a MySQL database.

  • For storage services like Object Storage Service (OSS) and Tablestore, RAM can manage both resource management and resource usage actions.

policy

A policy is a set of permissions, defined with a specific syntax and structure, that precisely describes the authorized resources, actions, and conditions. For more information about the language specification supported by RAM, see Policy structure and syntax.

In RAM, a policy is a resource entity. RAM supports the following two types of policies:

• System Policy: These policies are created and managed by Alibaba Cloud. You can use them but you cannot modify them. Alibaba Cloud maintains and updates these policies.

• Custom Policy: These are policies that you create and manage. You can create, update, and delete them to meet your specific requirements.

By attaching policies to RAM users, RAM user groups, or RAM roles, you grant them the permissions defined in those policies. For more information, see Grant permissions to a RAM user, Grant permissions to a RAM user group, and Grant permissions to a RAM role.

principal

A principal is the entity that receives the permissions defined in a policy. A principal can be a RAM user, a RAM user group, or a RAM role.

effect

A basic element of a policy that specifies the outcome of the authorization. The value can be Allow or Deny.

action

A basic element of a policy that specifies the operation on a resource. The value is the name of an API action defined by the cloud service.

condition

A basic element of a policy that specifies the conditions under which the policy takes effect.

resource

A resource is an object within a cloud service, such as an OSS bucket or an ECS instance.

ARN

An ARN is a global resource name that Alibaba Cloud defines for each resource. For RAM authorization, the ARN uses the following format: acs:<ram-code>:<region>:<account-id>:<relative-id>. The fields are described as follows:

• acs: An acronym for Alibaba Cloud Service. It represents the public cloud platform of Alibaba Cloud.

• ram-code: The RAM code for a cloud service. For more information, see the RAM Code column in Cloud services that support RAM.

• region: The information about the region. For global resources (resources that can be accessed without specifying a region), this field is an asterisk (*). For more information, see Regions and Zones.

• account-id: The ID of your Alibaba Cloud account. For example: 123456789012****.

• relative-id: The part of a resource description that is related to a cloud service. Its semantics are defined by the specific cloud service. The format of this part supports a tree-like structure (similar to a file path). For example, the format for an OSS object is: relative-id = "mybucket/dir1/object1.jpg".