Get a user credential report-Resource Access Management(RAM)-阿里云帮助中心

You can generate and download a user credential report from RAM for compliance audits. The report lists the credential status for your Alibaba Cloud account and RAM users, including console sign-in passwords, access keys, and multi-factor authentication (MFA).

Limitations

You cannot generate a user credential report if the number of RAM users exceeds 3,500.

Procedure

Log in to the RAM console as a RAM administrator.
In the left-side navigation pane, click Overview.
On the Overview tab, click Download Credential Report.
After the user credential report is generated, click Download to save the report to your computer.

Note
The time required to generate the report depends on the number of RAM users in your Alibaba Cloud account. If generation takes a long time, you can click Download Later. You can generate a new user credential report in CSV format in the console every 4 hours. If you request a report less than 4 hours after the previous one was generated, the system returns the existing report instead of generating a new one.

Report fields

The user credential report contains the following fields.

Parameter	Value	Description
user	username@company-alias.onaliyun.com	The name of the user. The first row is always the Alibaba Cloud account, displayed as `<root>`. Subsequent rows are for RAM users, displayed in User Principal Name (UPN) format.
user_creation_time	2019-11-11T12:33:18Z	The time when the RAM user was created. Note The time format follows ISO 8601 and is in UTC. Format: YYYY-MM-DDThh:mm:ssZ.
user_last_logon	2019-11-11T12:45:18Z	The last time the RAM user signed in to the console. Note A RAM user can log in by using a password or user SSO. If a RAM user has never logged in, this field shows `-`.
password_exist	TRUE	Indicates whether a console sign-in password exists. The value can be `TRUE` or `FALSE`. The values are described as follows: For a RAM user, the value depends on whether a logon profile exists. For Alibaba Cloud accounts, the default is `TRUE`. Note For a member account created in Resource Directory, password information for the Alibaba Cloud account is provided, but this password cannot be used. For more information, see Create a member.
password_active	N/A	Indicates whether the sign-in password is enabled. The valid values are `TRUE`, `FALSE`, or `N/A`. The details are as follows: If a RAM user lacks logon configuration information, the value is `N/A`. The Alibaba Cloud account defaults to `N/A`.
password_last_changed	2019-11-11T12:50:18Z	The last time the password was changed. If the RAM user's login configuration information does not exist, it is `N/A`. Note RAM records data only after April 5, 2016. If the last modification time is before this date, the value is `N/A`. The password modification time for an Alibaba Cloud account has a delay of up to 24 hours.
password_next_rotation	2019-11-13T12:50:18Z	The next time the password must be changed. If passwords are set to never expire under the password policy, the value is `-`. If the RAM user's login profile does not exist, the value is `N/A`. The Alibaba Cloud account defaults to `N/A`.
mfa_active	TRUE	Indicates whether an MFA device is enabled. The value can be `TRUE`, `FALSE`, or `N/A`. If the login configuration information for the RAM user does not exist, the value is `N/A`.
access_key_1_exist	TRUE	Indicates whether the first access key exists. The value can be `TRUE` or `FALSE`.
access_key_1_active	TRUE	Indicates whether the first access key is active. The value can be `TRUE`, `FALSE`, or `N/A`. If there is no AccessKey, the value is `N/A`.
access_key_1_last_rotated	2019-11-11T12:50:18Z	The time when the first access key was created or last changed. If you do not have an AccessKey, it is `N/A`.
access_key_1_last_used	2019-11-13T12:50:18Z	The last time the first access key was used. If the AccessKey has not been used since the system started tracking the last used time, it is `-`. If you do not have an AccessKey, this is `N/A`. Note Tracking for the last-used time started on June 1, 2019, and the data may have a delay of up to 2 hours.
access_key_2_exist	TRUE	Indicates whether the second access key exists. The value can be `TRUE` or `FALSE`.
access_key_2_active	TRUE	Indicates whether the second access key is active. The value can be `TRUE`, `FALSE`, or `N/A`. If there is no AccessKey, the value is `N/A`.
access_key_2_last_rotated	2019-11-11T12:50:18Z	The time when the second access key was created or last changed. If an AccessKey is not available, the value is `N/A`.
access_key_2_last_used	2019-11-13T12:50:18Z	The last time the second access key was used. If the AccessKey has not been used since the system started tracking the last used time, the value is `-`. If there is no AccessKey, the value is `N/A`. Note Tracking for the last-used time started on June 1, 2019, and the data may have a delay of up to 2 hours.

Note

Currently, RAM users can create only 2 AccessKeys. Due to historical reasons, some users have more than 2 AccessKeys. These additional AccessKeys are displayed at the end of the CSV file and begin with additional_access_key_.

Export user permission policies

The user credential report contains only credential status information, such as console sign-in passwords, access keys, and MFA, but not permission policies. To export permission policies for your RAM users, you can use the RAM API.

Follow these steps:

Call the ListUsers operation to obtain a list of all RAM users.
For each user, call the ListPoliciesForUser operation to obtain the name (PolicyName) and type (PolicyType) of the attached permission policies. The PolicyType can be System or Custom.

Example Alibaba Cloud CLI commands:

List RAM users:

aliyun ram ListUsers

List permission policies for a specific user:

aliyun ram ListPoliciesForUser --UserName <RAM user name>