Identity management
Avoid using your Alibaba Cloud account directly to access ApsaraDB RDS for PostgreSQL. Instead, use Resource Access Management (RAM) identities—RAM users, RAM user groups, and RAM roles—to control who can access your RDS resources and what they can do. This reduces the impact of compromised credentials and keeps permissions aligned with job responsibilities.
| Identity type | Best for | Credential type |
|---|---|---|
| RAM user | Individual people or applications | Username/password or AccessKey pair |
| RAM user group | Teams sharing the same permission set | Inherited from group policies |
| RAM role | Cross-service access or federated access | Temporary STS token (no permanent credentials) |
RAM users
A RAM user is an identity with specific permissions for a person or application. RAM users can be created by an Alibaba Cloud account or by RAM users and RAM roles that have administrative rights. After permissions are granted, a RAM user can access Alibaba Cloud resources within the account through the Alibaba Cloud Management Console or by calling API operations.
When creating a RAM user, configure the Access Mode parameter:
| Access mode | Authentication method | Recommendation |
|---|---|---|
| Console Access | Username and password | Enable multi-factor authentication (MFA) |
| Using permanent AccessKey to access | AccessKey pair via API calls | Store credentials in environment variables, not code |
| Both | Console and API | Apply both recommendations above |
Separate RAM users for people from those for applications to prevent accidental operations from affecting production systems.
Security practices:
Create one RAM user with administrative rights using your root Alibaba Cloud account, then use that RAM user to create and manage all other RAM users.
Grant permissions based on the principle of least privilege—only the minimum permissions required to complete the task.
Store AccessKey credentials in environment variables or use Security Token Service (STS) tokens. Never embed an AccessKey ID or AccessKey secret in code; a leaked AccessKey pair exposes all resources in the account.
Enable multi-factor authentication (MFA) for RAM users designated for console access.
Enable single sign-on (SSO) for RAM users if your organization uses a centralized identity management system.
Related topics:
RAM user groups
Group RAM users to simplify permission management. Permissions granted to a group apply to all members, so you can update access for an entire team by modifying one group policy rather than individual user policies.
Security practices:
Grant permissions to RAM user groups based on the principle of least privilege.
Remove a RAM user from a group when their job duties change.
Revoke permissions from a RAM user group when the group no longer needs them.
Related topics:
RAM roles
A RAM role is a virtual identity to which policies can be attached. Unlike RAM users, RAM roles have no permanent credentials—no logon password and no AccessKey pair. To use a RAM role, a trusted entity must assume it by calling the AssumeRole API operation to receive an STS token. The trusted entity then uses that token to access Alibaba Cloud resources as the RAM role.
STS tokens are valid for a limited period. The maximum validity period of an STS token equals the maximum session duration configured for the RAM role.
Security practices:
Do not frequently change the trusted entity of a RAM role after it is created. Changing the trusted entity can cause permission loss that disrupts your workloads; adding a new trusted entity may introduce privilege escalation risks. Test all changes thoroughly before applying them.
Set the STS token validity period to an appropriate value—short enough to limit exposure if a token is compromised.
Set the maximum session duration for the RAM role to an appropriate value.
Enable SSO for RAM roles if your organization uses a centralized identity management system.
Related topics: