1. How do I get started with Alibaba Cloud RAM?
Once you have signed up for Alibaba Cloud, you can either use web-based Alibaba
Cloud Management Console or RAM APIs (for programmatic access) to create users and groups as well as
assign them permissions to access different resources.
2. How does a sub-user sign into the Alibaba Cloud Management Console?
Visit the logon page or refer to the links on the Management Console dashboard.
3. Which Alibaba Cloud products and services support RAM integration?
| Service |
Management Console |
API |
Reference |
| Elastic Compute Service |
√ |
√ |
ECS Permission |
| ApsaraDB for RDS |
√ |
√ |
RDS Permission |
| Server Load Balancer |
√ |
√ |
SLB Permission |
| Virtual Private Cloud |
√ |
√ |
VPC Permission |
| EIP |
√ |
√ |
EIP Permission |
| Object Storage Service |
√ |
√ |
OSS Permission |
| Table Store |
√ |
√ |
TableStore Permission |
| Message Service |
√ |
√ |
MessageService Permission |
| Alibaba Cloud CDN |
√ |
√ |
CDN Permission |
| ApsaraDB for Redis |
√ |
√ |
|
| ApsaraDB for Memcache |
√ |
√ |
|
| CloudMonitor |
√ |
√ |
|
| Server Guard |
√ |
〇 |
|
| Anti-DDoS |
√ |
〇 |
|
| Mobile Security |
√ |
〇 |
|
| Support Center |
√ |
〇 |
|
4. What is a RAM-role?
A RAM-Role is a virtual user (shadow account) or a type of RAM user. This user has a
fixed identity and can be granted policies. However, a RAM-Role must be assumed by an authorized real
user.
5. Which operation permissions are granted to a new RAM-user?
By default, a new RAM user has no operation permissions. A RAM user represents an
operator and must be explicitly authorized to perform any operation. The user can perform resource
operations through the RAM console or APIs, only after being authorized.
6. What are authorization policies?
An authorization policy is a group of permissions described using Authorization
Policy Language. It can precisely define the authorized resource set and operation set, as well as the
authorization conditions.
7. How do I view all system authorization policies supported by Alibaba
Cloud?
To view all the system authorization policies supported by Alibaba Cloud, log on to
the RAM console and go to the Authorization Policy Management page to view a list of all system
authorization policies.
8. What is a RoleARN?
A RoleARN is the global resource descriptor that specifies a role. RoleARNs follow
Alibaba Cloud’s ARN naming rules.
For example, the RoleARN for the “devops” role of an Alibaba Cloud account:
acs:ram::1234567890123456:role/devops.
9. How do I delete an authorization policy with multiple versions?
Authorization policies which have been edited and saved multiple times will have
several attached "versions". Once these have been deleted from the RAM console, the remaining "default"
authorization policy can be deleted, which will completely remove the policy from your Alibaba Cloud
account.
10. How do I assign commonly used permissions?
Alibaba Cloud provides System Authorization Policies, a set of commonly used
permissions that you can attach to RAM users, groups, and roles. These policies are a group of
comprehensive permission sets created and managed by Alibaba Cloud, such as read-only permission for ECS
or full permissions for ECS. You can use these policies but not modify them.
11. How do I create a custom authorization policy?
1. Access the RAM console, select Policy Management and then Custom Policies.
2. Click “New Authorization Policy.”
3. Select a template from the list (for example, AliyunOSSReadOnlyAccess).
4. Edit the name, remarks, and content of the authorization policy as needed.
5. After making necessary changes, click “Add Policy” to create the custom
authorization policy.
12. How do I attach an authorization policy to a group?
1. Logon to the RAM console and go to Group Management.
2. Select a group, and click “Authorize” to go to the Edit Authorization Policy
page.
3. Select the name of the relevant authorization policy to grant permissions to the
group.
13. How do I assign the same set of permissions to multiple RAM users?
You can attach authorization policird to RAM groups. All users in the group will be
granted the permissions associated with the group.
14. What kinds of security credentials can RAM users have?
RAM users can access cloud services through APIs or by logging into the Alibaba
Cloud Management console with the help of access keys. You can also enable Multi-Factor Authentication
(MFA) which requires another verification code (second security factor provided by the user’s MFA
device) after entering username and password. This provides another layer of security for your account.
