The permission management mechanism of Alibaba Cloud includes Resource Access Management (RAM) and Security Token Service (STS). RAM user accounts with different permissions can be created to access Tablestore, and temporary access permission can also be granted to RAM users. RAM and STS greatly improve management flexibility and security.
RAM is used to control the permissions of each account. RAM allows you to manage permissions by granting different permissions to different RAM user accounts created under Alibaba Cloud accounts. For more information, see What is RAM?.
STS is a security credential (token) management system that grants users temporary access permission. For more information, see What is STS?.
Background
RAM and STS enable you to securely grant permissions to users without exposing your Alibaba Cloud account AccessKey pair. If the AccessKey pair of your Alibaba Cloud account is leaked, other users can operate on the resources under the account and access important information.
RAM allows you to manage permissions granted to RAM users on different entities and minimizes the adverse impact if the AccessKey pair of a RAM user is leaked. RAM user accounts are often used long term to perform operations. To ensure account confidential, the AccessKey pairs of RAM user accounts must be kept confidential.
In contrast to the permanent permission management function provided by RAM, STS provides temporary access authorization through a temporary AccessKey pair and token to allow temporary access to Tablestore. The permissions obtained from STS are restricted and are only valid for a limited period of time to minimize the adverse impact on the system in case of information leakage.
Terms
The following table describes terms related to RAM and STS. For more information, see Terms.
Term | Description |
RAM user | A physical identity that has a fixed ID and credential information. A RAM user represents a person or an application. A RAM user has the following characteristics:
|
RAM role | RAM roles are identities to which policies are attached. However, RAM roles do not have logon passwords or AccessKey pairs. If an entity user assumes a RAM role, the entity user can obtain and use the Security Token Service (STS) token of the RAM role to access the required resources. |
policy | A set of permissions that are described based on the policy structure and syntax. You can use policies to describe the authorized resource sets, authorized operation sets, and authorization conditions. A policy is a type of simple language specification that describes a set of permissions. For more information, see Policy structure and syntax. In RAM, a policy is a resource entity. RAM supports the following two types of policy:
You can attach one or more policies to RAM users, RAM user groups, and RAM roles. |
resource | A manageable object that is provided by an Alibaba Cloud service, such as individual Tablestore instances, all Tablestore instances, or a certain table in an instance. |
The relationship between a RAM user account and its roles is similar to a relationship between an individual and their social identities in different scenarios. For example, a person can assume the role of employee in a company and a role of parent at home. Different roles are assigned corresponding permissions. Roles are not actual users that can perform operations. Roles are complete only when being assumed by RAM user accounts. Furthermore, a role can be assumed by multiple users at the same time. The user who assumes a role is automatically assigned all permissions of the role.
Example:
Assume that an Alibaba Cloud account named Alice has two Tablestore instances named alice_a and alice_b. Alice has full permissions on both instances.
To maintain the security of the Alibaba Cloud account, Alice uses RAM to create two RAM user accounts: Bob and Carol. Bob has read and write permissions on alice_a, and Carol has read and write permissions on alice_b. Bob and Carol both have their own AccessKey pairs. If the AccessKey pair of Bob or Carol is leaked, only the corresponding instance is affected. Alice can then revoke the permissions of the compromised RAM user account through the console.
If Alice needs to authorize another RAM user to read the tables in alice_a, instead of disclosing Bob's AccessKey pair to the user, Alice can create a new role such as AliceAReader and grant that role the read permission on alice_a. However, AliceAReader cannot be used directly because it does not have a corresponding AccessKey pair.
To obtain temporary authorization, Alice can call AssumeRole to inform STS that the RAM user account Bob wants to assume the AliceAReader role. If AssumeRole is successfully called, STS returns a temporary AccessKey ID, AccessKey secret, and security token as access credentials. A temporary user assigned with these credentials is authorized to temporarily access alice_a. The expiration time of the credentials is specified when AssumeRole is called.
Design philosophy behind RAM and STS
RAM and STS are designed with complexity to achieve flexible access control at the cost of simplicity.
RAM user accounts and roles are separated to keep the entity that performs operations separating from the virtual entity that represents a group of permissions. Assume that a user requires multiple permissions such as read and write permissions, but each operation only requires one of the permissions. In this case, you can create two roles: one with the read permission and the other one with the write permission. Then you can create a RAM user account that does not have any permissions but can assume these roles. When the user needs to read or write data, the RAM user account can temporarily assume the role with the required permission. In addition, roles can be used to grant permissions to other Alibaba Cloud users, which makes collaborations easier and maintains strict account security.
Flexible access control does not mean that you have to use all these functions. You may only use a subset of functions as needed. For example, if you do not need to use temporary access credentials that have an expiration time, you can use only the RAM user account function.