ACA Identity and Access Management Flashcards

What is the primary purpose of Alibaba Cloud RAM (Resource Access Management)?

Answer: To control user identities and access permissions to cloud resources

RAM is Alibaba Cloud's identity and access management service that lets you control who can access which cloud resources and under what conditions.

Which of the following best describes a RAM user?

Answer: An entity created under an Alibaba Cloud account representing a person or application

A RAM user is a sub-identity created within an Alibaba Cloud account to represent a specific person or application with its own credentials.

What is the difference between a System Policy and a Custom Policy in Alibaba Cloud RAM?

Answer: System policies are predefined by Alibaba Cloud; custom policies are user-defined

System policies are maintained by Alibaba Cloud with preset permissions for common services, while custom policies are authored by the account holder for fine-grained control.

Which RAM entity should be used to grant an ECS instance permission to call other Alibaba Cloud services without embedding credentials?

Answer: RAM Role

A RAM role assigned to an ECS instance lets the instance obtain temporary credentials automatically, eliminating the need to embed AccessKey credentials.

What does STS (Security Token Service) provide in the context of Alibaba Cloud RAM?

Answer: Temporary security credentials with a configurable expiration time

STS issues short-lived tokens with a defined TTL, reducing risk by ensuring credentials expire and cannot be reused indefinitely.

In Alibaba Cloud RAM, what is the effect of attaching a Deny statement to a policy when the same action is also allowed by another policy?

Answer: The Deny always overrides the Allow, blocking the action

Alibaba Cloud RAM follows an explicit Deny-overrides model, so any Deny statement on an action will block that action regardless of any Allow policies.