Application Real-Time Monitoring Service:Grant ARMS permissions to RAM users

ARMS permission policies

ARMS provides two system policies. Choose one based on the access level required:

Prerequisites

Before you begin, make sure that you have:

• Activated ARMS. For more information, see Activate ARMS

• An activated RAM service. For more information, see Activate RAM

Step 1: Create a RAM user

1. Log on to the RAM console with an Alibaba Cloud account or a RAM user that has administrative privileges.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User.

4. In the User Account Information section, configure the following parameters:

   Parameter	Description
   Logon Name	Up to 64 characters. Supports letters, digits, periods (.), hyphens (-), and underscores (_).
   Display Name	Up to 128 characters.
   Tag	Click the edit icon to add one or more key-value tags for organizing and managing the RAM user.

   Note

   To create multiple RAM users at once, click Add User.

5. In the Access Mode section, select an access mode.

   Select one access mode per RAM user to keep human and programmatic access separate:

   • Console Access -- for team members who access the Alibaba Cloud Management Console.

     Parameter	Description
     Set Console Password	Select Automatically Regenerate Default Password or Reset Custom Password. Custom passwords must meet the password policy requirements.
     Password Reset	Specify whether the RAM user must reset the password at next logon.
     Enable MFA	Enable multi-factor authentication (MFA) for the RAM user. After you enable MFA, bind an MFA device.

   • Using permanent AccessKey to access -- for applications that call API operations.

     The system generates an AccessKey ID and AccessKey secret automatically.

     Important

     • The AccessKey secret is displayed only at creation time. Back it up immediately -- it cannot be retrieved later.

     • Permanent AccessKey pairs pose security risks if leaked. For production workloads, use temporary credentials from Security Token Service (STS). For more information, see Best practices for using access credentials to call API operations.

6. Click OK.

7. Complete the security verification as prompted.

Step 2: Grant ARMS permissions to the RAM user

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. Find the target RAM user and click Add Permissions in the Actions column.

   Note

   To grant permissions to multiple RAM users at once, select the RAM users and click Add Permissions at the bottom of the page.

4. In the Grant Permission panel, configure the following parameters:

   1. Set Resource Scope:

      • Account: The policy applies to all resources under the current Alibaba Cloud account.

      • ResourceGroup: The policy applies only to resources in a specific resource group. Verify that ARMS supports resource groups before selecting this option. For more information, see Services that work with Resource Group.

   2. Verify the Principal. The current RAM user is selected by default.

   3. Select a Policy:

      • System policies: Created by Alibaba Cloud. You can use but cannot modify these policies. Version updates are maintained by Alibaba Cloud. Select AliyunARMSFullAccess or AliyunARMSReadOnlyAccess based on your requirements. For more information, see Services that work with RAM.

        Note

        The system flags high-risk policies such as AdministratorAccess and AliyunRAMFullAccess. Follow the principle of least privilege -- grant only the permissions each RAM user needs.

      • Custom policies: Define fine-grained permissions tailored to your requirements. For more information, see Create a custom policy.

   4. Click Grant permissions.

5. Click Close.

Next steps

After creating and authorizing a RAM user, share the credentials with the team member.