Disable or delete RAM users that are no longer needed to maintain account security. Deleted users move to a recycle bin for 30 days and can be restored during that period.
Security assessment before deleting a RAM user
Before deleting a RAM user, confirm that no system or application still relies on the user. Disable the user first, then delete after a safe observation period.
Final pre-deletion checklist
Before you delete the user, complete the following checks:
Check AccessKey activity:
In the RAM console, go to the user details page and click the Credential tab to view the Last Used Service / Time of the AccessKey.
You can also log on to the ActionTrail console. On the AccessKey Pair Audit tab, search by
AccessKey IDto confirm no recent API calls are associated with the user's AccessKey.
Check console logon activity:
In the RAM console, go to the user details page and click the Authentication tab to check the Last Logined Time time.
You can also check the Events tab, or log on to the ActionTrail console. On the Event Query tab, filter by the RAM user's username as the
Operator Nameto confirm no recent console operations exist for this user.
Check service dependencies:
Check whether any cloud services use the RAM user to request other credentials, such as kubeconfig for ACK.
Check whether any tasks run as the RAM user, such as tasks in big data services like DataWorks and MaxCompute.
In the RAM console, go to the user details page. On the Policy Access Beta tab, confirm the services that the user is authorized to access and the Last Accessed At. Permission audit overview.
Back up user information (optional): Restoring a user does not restore permissions. Before deletion, export the user's policies and group memberships via API or script.
Best practice: Disable before deleting
If you are unsure whether a user is still in use, disable their access credentials first and observe. If workloads remain stable, proceed with deletion. This approach is recommended for employee offboarding or application decommissioning.
Temporarily disable the user:
Disable console logon: On the user details page, click the Authentication tab. In the Login Profile section, click Modify Logon Settings and set Console Access to Disabled.
Disable the AccessKey: On the user details page, click the Credential tab and set all AccessKeys to Disabled. The user can no longer log on or make API calls, but their identity and permission configuration are retained for easy reactivation.
Monitor workloads: Keep the user disabled for at least 7 to 15 days to confirm no workloads break.
Delete the user: After the observation period, if no issues arise, proceed with the deletion steps below.
Recycle bin mechanism for RAM users
When you delete a RAM user, the user's status changes as follows:
To prevent accidental deletions from causing service interruptions, RAM provides a recycle bin:
Deleting a user moves them to the recycle bin: Deleting a RAM user does not permanently purge the user. Instead, the user moves to the recycle bin.
Disabled state: Users in the recycle bin cannot log on or make API calls. The system removes their permissions and bindings, including MFA devices.
Retention and purge: Users remain in the recycle bin for 30 days before automatic purging. You can restore or manually purge a user at any time during this period.
Restoration limitations: Restoring a user from the recycle bin restores only the user's identity. You must manually reconfigure permissions and MFA device, and restore or re-create the AccessKey.
Quota limit: The recycle bin holds up to 1,000 users. When the limit is reached, the system purges the oldest users to make room.
Procedure
1. Move a RAM user to the recycle bin
This action disables the user and moves them to the recycle bin, starting a 30-day countdown to automatic purging. Once in the recycle bin, console logon, API calls (AccessKey), all permissions, MFA device, and DingTalk binding are disabled or removed.
Console
Log on to the RAM console with your Alibaba Cloud account or a RAM user with administrator permissions (
AliyunRAMFullAccess).In the left-side navigation pane, choose .
On the Users page, find the target RAM user and click Delete User in the Actions column.
You can also select multiple RAM users and click Delete User below the user list for batch deletion. This is not recommended due to the higher risk of accidental deletion.
In the Delete User dialog box, carefully read the impact of the deletion, enter the name of the target RAM user, and click Move to Recycle Bin.
OpenAPI
Call the DeleteUser operation to move a RAM user to the recycle bin.
2. Manage users in the recycle bin
You can view, restore, or permanently purge users in the recycle bin.
View users and AccessKeys
On the Users page, click Recycle Bin in the upper-right corner.
On the Recycle Bin page, you can perform the following actions:
On the Users tab, view the list of RAM users in the recycle bin.
On the AccessKey tab, view the list of AccessKeys in the recycle bin.
Restore a user
Use this operation to restore an accidentally deleted user.
Restoring a RAM user from the recycle bin restores only basic information: logon name, display name, UID, creation time, and console logon password (if still valid). All other information cannot be restored and must be manually reconfigured.
On the Users page, click recycle bin in the top-right corner.
On the Users tab, find the target RAM user and click Restore in the Actions column.
You can also select multiple RAM users and click Restore Users below the user list to restore them in a batch.
In the Restore Users dialog box, click Restore Users.
Post-restoration checklist:
Re-grant the required permissions to the user.
Add the user back to the required user groups.
If API access is required, create a new AccessKey for the user, or restore the user's previous AccessKey by clicking Restore on the AccessKey tab in the Recycle Bin.
Remind the user to rebind their MFA device.
Re-add notes, mobile phone number, email address, and tags as needed.
Rebind the DingTalk account.
Permanently purge a user
This irreversible action permanently purges the user and all their information.
Once a RAM user is permanently purged, no information can be recovered, including AccessKeys. Perform this action only when you are certain the user is no longer needed.
RAM users remain in the recycle bin for 30 days before automatic purging. To manually purge a user:
On the Users page, click Recycle Bin in the top-right corner.
On the Users tab, find the target RAM user and click Delete in the Actions column.
In the Delete User dialog box, enter the name of the target RAM user, and then click Delete User.