Require MFA for accessing cloud resources

Step 1: Create a custom policy

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

4. On the Create Policy page, click the JSON Editor tab.

   The page displays a JSON editor. The default policy template includes a Version element (set to "1") and a Statement array. Each statement includes Effect (defaults to "Allow"), Action, Resource, and Condition elements. You must populate the Action and Resource elements.

5. Enter the policy document.

   Example policy: Only RAM users with MFA enabled can access ECS resources in the console. You can implement this by using the Condition element to set the value of acs:MFAPresent to true.

   {
       "Statement": [
           {
               "Action": "ecs:*",
               "Effect": "Allow",
               "Resource": "*",
               "Condition": {
                   "Bool": {
                       "acs:MFAPresent": "true"
                   }
               }
           }
       ],
       "Version": "1"
   }

   Note

   The Condition element applies only to the actions specified in this permission policy. You can modify the policy document to restrict access to other cloud resources as needed.

6. At the top of the page, click Optimize, and then click Perform to perform advanced optimization on the policy.

   The advanced policy optimization feature performs the following tasks:

   • Splits resources or conditions for incompatible actions.

   • Narrows the scope of resources.

   • Removes duplicate statements or merges statements.

7. On the Create Policy page, click OK.

8. In the Create Policy dialog box, enter a policy name and Description, and then click OK.

Step 2: Create a RAM user

1. Sign in to the RAM console using your Alibaba Cloud account or as a RAM user with administrative permissions (a user to which the AliyunRAMFullAccess policy is attached).

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User.

4. On the Create User page, in the User Account Information section, configure the user's basic information.

   • Logon Name (required): Up to 64 characters. Allows letters, digits, periods (.), hyphens (-), and underscores (_).

   • Display Name (optional): The name can be up to 128 characters long.

   • Tag (optional): Click , then enter a tag key and tag value to categorize and manage users.

   • Security Phone (optional): Enter a mainland China mobile number in +86 format. +86 is the country/region code and is selected by default; enter only the phone number itself. After the first binding, the number must be activated through SMS verification.

   Note

   Click Add User to create multiple RAM users in bulk.

5. In the Access Mode section, select an access mode based on the user type.

   Important

   • As a security best practice, select only one access mode per user to separate human console access from programmatic application access. If a RAM user needs both console sign-in and API call capabilities, you can select both access modes. After you select Permanent AccessKey, you must select the I confirm that I must create an AccessKey checkbox to continue.

   • A leaked AccessKey pair compromises your account. Use Security Token Service (STS) tokens (temporary credentials) instead to reduce risk. Best practices for using access credentials to call Alibaba Cloud APIs.

   Console access

   Select Console Access.

   • Set Logon Password: Auto-generate or set a custom password. Custom passwords must meet the configured complexity requirements. Set a password policy for RAM users.

   • Password Reset: Specify whether the user must reset the password at next sign-in.

   • Enable MFA: MFA is required for all users by default. To change this setting, see Manage RAM user security settings. Users must bind an MFA device at first sign-in. Bind an MFA device.

   Programmatic access

   Select Permanent AccessKey.

   The system automatically creates an AccessKey ID and AccessKey secret for the RAM user.

   Important

   The AccessKey secret is displayed only at creation and cannot be retrieved later. You must immediately download or copy and save the AccessKey secret. A leaked AccessKey pair compromises all resources under your account. Create an AccessKey pair.

Step 3: Grant permissions

Grant the custom policy that you created in Step 1 to the RAM user that you created in Step 2.

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the target RAM user and click Actions column > Attach Policy.

   You can also select multiple RAM users and click Attach Policy below the user list for batch authorization.

4. In the Grant Permission panel, configure the following settings:

   • Resource scope:

     • Account level: Permissions apply to all resources in your Alibaba Cloud account.

     • Resource group level: Permissions apply only within the specified resource group. After logging on, the RAM user must switch to the authorized resource group in the top navigation bar.

       Note

       1. The system marks high-risk system policies (such as AdministratorAccess and AliyunRAMFullAccess) with a warning indicator. These policies typically grant full control over all cloud resources or full management of RAM. Grant these policies with caution.

       2. For resource group authorization examples, see Control RAM user access to specific ECS instances.

   • Principal:

     The principal is the RAM user receiving permissions. From the Users page, the system auto-selects the current user. From the Grants page, you must manually select the user. Batch selection is supported.

   • Permission policy:

     • System policy: Search and select. Filter by product name (e.g., ECS, OSS), access level (e.g., ReadOnly, FullAccess), or full policy name. For example, to grant permissions for financial management (expenses and costs), search for BSS to find AliyunBSSFullAccess (full access to Billing and Cost Management) and other finance-related policies.

       The following table lists system policy names for commonly requested Alibaba Cloud products to help you quickly find the right policy.

       Product	System policy name	Access level
       Billing and cost management (finance)	AliyunBSSFullAccess	Full access
       Cloud Monitor	AliyunCloudMonitorReadOnlyAccess	Read-only
       China Gateway (Website Builder)	AliyunWebsiteBuildFullAccess	Full access
       Alibaba Cloud DevOps	AliyunYunxiaoFullAccess	Full access
       Model Studio (Bailian)	AliyunBailianFullAccess	Full access
       Alibaba Cloud DNS	AliyunDNSFullAccess	Full access
       SSL Certificates Service	AliyunYundunCertFullAccess	Full access
       Cloud Phone	AliyunECDFullAccess	Full access
       Support Center	AliyunSupportFullAccess	Full access
       Resource Center	AliyunResourceCenterFullAccess	Full access
       AgentBay	AliyunAgentBayFullAccess	Full access
       Security Center	AliyunYundunSASFullAccess	Full access

       If you cannot find the policy for your target product, see the System policy reference for the complete list, or create a custom policy for fine-grained access control.

     • Custom policy: You must Create a custom policy before you can grant it.

     • Pagination limit for select all: The policy list is paginated. Selecting all applies only to the current page. After you switch pages, previously selected policies remain in the selected list, but policies on the new page are not automatically selected; you must select them page by page.

     • Quickly grant administrator permissions: To grant administrator permissions, search for AdministratorAccess in the search box and select it directly, instead of selecting policies page by page. Selecting this policy triggers a high-risk authorization warning.

   • (Optional) Description: Enter the authorization reason or scenario for audit purposes.

   • Click Confirm.

5. Review the authorization result and click Close.

Step 4: Enable MFA

Enable MFA for the RAM user you created in Step 2. For more information, see Bind an MFA device for a RAM user.