Avoid accessing Certificate Management Service with your Alibaba Cloud account directly unless otherwise required. Instead, use Resource Access Management (RAM) users to control who can access the service and what they can do—without sharing your account credentials.
RAM users
RAM users are identities you create within your Alibaba Cloud account. After you grant a RAM user the required permissions, that user can access Alibaba Cloud resources within the Alibaba Cloud account through the Alibaba Cloud Management Console or by calling API operations.
RAM users can be created by the Alibaba Cloud account owner or by any RAM user or RAM role with administrative rights.
Access modes
When creating a RAM user, set the Access Mode based on how that user will interact with Alibaba Cloud:
| Access mode | How the user authenticates | Typical use |
|---|---|---|
| Console Access | Username and password | Human operators |
| Using permanent AccessKey to access | AccessKey ID and AccessKey secret | Automated programs and scripts |
Keep console users and program users separate. If a program user's credentials are compromised, the blast radius is limited to automated access only—it does not affect console operations.
Best practices for RAM users
Enable MFA for console users
Enable multi-factor authentication (MFA) for every RAM user with console access. This protects against credential theft.
Apply the principle of least privilege
Grant each RAM user only the permissions needed for their tasks. Least-privilege permissions reduce the risk of accidental changes and limit the damage from compromised credentials.
Protect AccessKey credentials
Never embed an AccessKey ID or AccessKey secret directly in code. If a hardcoded credential is exposed, it puts all resources in your account at risk. Instead:
Use Security Token Service (STS) tokens for short-lived, scoped access
Store credentials in environment variables and read them at runtime
Use your Alibaba Cloud account only to bootstrap
Use your Alibaba Cloud account to create one RAM user with administrative rights. Then use that RAM user to create and manage all other RAM users. This keeps the root account credentials out of day-to-day operations.
Enable SSO if your organization uses an identity provider
If your team authenticates through a corporate identity system, enable single sign-on (SSO) for RAM users. SSO lets your team log in to Alibaba Cloud resources directly from your organization's identity management system.
Related topics
RAM user groups
When your Alibaba Cloud account has multiple RAM users, organize them into RAM user groups to simplify permission management. You can grant the same permissions to all RAM users in a group at once.
Best practices for RAM user groups
Apply the principle of least privilege when granting permissions to a group.
Remove a RAM user from a group when their job responsibilities change.
Revoke group permissions when the group no longer needs them.