Docs

Elastic Compute Service

IAM

IAM overview

Identity and Access Management (IAM) is a free service that the platform provides to users. It is a permission management system that controls access to cloud resources by different identities, enables delegated permission management, improves management efficiency, and reduces the risk of information leakage.

Why use IAM

To use cloud resources, you need to first register an account. After registration, you obtain an account that is referred to as "Root Account". By default, the root user has full administrative permissions over all resources under it.

Using only the root account to manage resources may cause the following issues:

Multiple users use the same root user, and you cannot identify the actual user.

The root account has extensive permissions, so any leak would have severe consequences.

Using the root account directly for O&M tasks involves higher risks.

You can avoid the above issues by using IAM features. You can create IAM users, user groups, and roles under the root account. New IAM users, user groups, and roles have no permissions initially. You can grant them appropriate permissions based on actual needs to achieve multi-identity management and granular permission control. For more features, refer to Product introduction.

IAM-related information

Introduction	Detailed description	Related documents
IAM-related concepts	Using IAM for permission management involves many technical terms, such as IAM identities (user, user group, and role), policies, and single sign-on (SSO).	Concepts
IAM limits	IAM resources are limited by resource quotas. If exceeding the quota limit, new resources cannot be created.	Limits
IAM usage process	IAM user: You can authorize IAM users directly or authorize them by adding them to a user group.	Creating users and authorizing them Granting users management permission over API access keys
IAM usage process		IAM role: You can associate the ECS service role with an instance to obtain temporary access credentials for other cloud resources.	Authorizing ECS instances to access other cloud resources based on instance IAM roles
IAM policy overview	A policy is a set of permissions described using a syntax structure. Policy type: IAM supports two types of policies: system default policies and custom policies. Policy syntax structure: IAM policies follow a fixed syntax format, allowing you to create diversified and customized IAM policies as needed. Policy scope: IAM policies support two scopes: global permissions and project-level permissions.	IAM policy syntax ECS IAM policy types

Last updated: 2026.06.18 17:48:25