Identity management
ApsaraDB for SelectDB integrates with Resource Access Management (RAM), Alibaba Cloud's identity and access control service. Do not use your Alibaba Cloud account directly to access ApsaraDB for SelectDB. Instead, use RAM identities — RAM users, RAM user groups, or RAM roles — to control who can access your databases and what they can do. Your Alibaba Cloud account has unrestricted access to all your resources; any credential compromise affects everything. RAM identities let you apply the principle of least privilege, separating access by person, team, and purpose.
The three RAM identity types serve different needs:
| Identity type | Best for | Access method |
|---|---|---|
| RAM user | Individual people or service programs | Logon password (console) or AccessKey pair (API) |
| RAM user group | Teams with shared permissions | Group-level permission policies applied to all members |
| RAM role | Cross-service or federated access | Temporary STS token (no permanent credentials) |
RAM users
A RAM user represents a person or a program. RAM users can be created by an Alibaba Cloud account or by RAM users and RAM roles that have administrative rights. After a RAM user is granted the required permissions, it can log on to the Alibaba Cloud Management Console or call API operations to access resources within the account.
When creating a RAM user, set the Access Mode parameter to match the user's purpose:
Console Access — the user logs on with a username and password. Enable multi-factor authentication (MFA) for all console users to protect against compromised passwords.
Using permanent AccessKey to access — the user makes API calls using an AccessKey ID and AccessKey secret. Reserve this mode for programs and automated scripts, not for human users.
Best practices
Separate individual users from program users. Create distinct RAM users for people and for programs. This prevents a person from accidentally running a script with their own credentials, and makes it easy to revoke access for one without affecting the other.
Create one RAM user with admin rights first, then use it to manage others. Use your Alibaba Cloud account to create a single RAM user and grant it administrative rights. From then on, use that RAM user to create and manage additional RAM users — keeping the root account credentials locked away.
Apply least-privilege permissions. Grant each RAM user only the permissions required for their specific tasks. Overly broad permissions mean a mistake or a breach affects far more resources than necessary.
Never embed credentials in code. Hardcoding an AccessKey ID or AccessKey secret in source code exposes the credentials to anyone who reads the code — including version control history. A leaked AccessKey pair creates security risks for all resources in the account. Use Security Token Service (STS) tokens or store credentials in environment variables instead.
Enable SSO for enterprise users. If your organization has an identity management system, enable single sign-on (SSO) for RAM users so they can access Alibaba Cloud resources without managing a separate set of credentials.
Related operations
RAM user groups
A RAM user group lets you manage permissions for multiple RAM users at once. Instead of granting and revoking permissions user by user, assign policies to the group and all members inherit those permissions automatically.
Best practices
Grant least-privilege permissions to groups, not individuals. Define the minimum permissions a team needs to do their work, then assign those permissions to the group. This keeps your permission structure auditable and prevents permissions from accumulating silently over time.
Remove users from groups when their role changes. If a team member moves to a different project or leaves the organization, remove them from the group immediately. Leaving stale group memberships in place is a common cause of privilege creep.
Revoke group permissions when they are no longer needed. When a project ends or a team's responsibilities change, audit and remove any permissions the group no longer needs.
Related operations
RAM roles
A RAM role is a virtual identity that carries policies but has no permanent credentials — no logon password and no AccessKey pair. To use a RAM role, a trusted entity must assume it. After assuming the role, the trusted entity receives a temporary STS token and uses that token to access Alibaba Cloud resources as the role.
This design makes RAM roles the right choice for scenarios where permanent credentials are a risk: cross-service access, federated identity, and temporary elevated permissions.
Best practices
Lock down the trusted entity configuration after creation. Changing a RAM role's trusted entity after the role is in use can cause permission loss that disrupts running services. Adding a new trusted entity can introduce privilege escalation risks if the new entity has broader access than intended. Test all trusted entity changes in a non-production environment before applying them.
Enable SSO for federated access. If your organization uses an enterprise identity provider, configure SSO for RAM roles so users can access Alibaba Cloud resources directly from your corporate identity management system without needing a separate Alibaba Cloud identity.