Critical Operation Protection

Virtual MFA Device

1. Go to the Security Settings page.
2. Click the Critical Operations tab, and click Bind in the Virtual MFA Device row.

   Figure 1 Virtual MFA Device

   
   

3. Set up the MFA application by scanning the QR code or manually entering the secret key.

   Figure 2 Binding a virtual MFA device

   
   

   You can bind a virtual MFA device to your account by scanning the QR code or entering the secret key.

   • Scanning the QR code

     Open the MFA application on your mobile phone, and use the application to scan the QR code displayed on the Bind Virtual MFA Device page. Your account or IAM user is then added to the application.

   • Manually entering the secret key

     Open the MFA application on your mobile phone, and enter the secret key.

     Note

     The user can be manually added only using time-based one-time passwords (TOTP). You are advised to enable automatic time setting on your mobile device.

4. View the verification codes on the MFA application. The code is automatically updated every 30 seconds.
5. On the Bind Virtual MFA Device page, enter two consecutive verification codes and click OK.

Login Protection

• (Administrator) Enabling login protection for an IAM user

  To enable login protection for an IAM user, go to the Users page and choose Security Settings in the row that contains the IAM user. In the Login Protection area in the displayed Security Settings tab, click next to Verification Method, and select a verification method from SMS, email, or virtual MFA device or security key. You can enable or disable API login protection as needed when you select Virtual MFA device. The option is disabled by default. API login protection asks you for both a password and a virtual MFA device to obtain an IAM user token. Without API login protection, you can obtain the token with only a password. To obtain an IAM user token, see .

• Enabling login protection for your account

  To enable login protection, click the Critical Operations tab on the Security Settings page, click Enable next to Login Protection, select a verification method, enter the verification code, and click OK.

  Figure 3 Enabling login protection

  
  

Operation Protection

• Enabling operation protection

  After operation protection is enabled, you and IAM users created using your account need to enter a verification code when performing a critical operation, such as deleting an ECS. This function is enabled by default. To ensure resource security, keep it enabled.

  The verification is valid for 15 minutes and you do not need to be verified again when performing critical operations within the validity period.

1. Go to the Security Settings page.
2. On the Critical Operations tab, locate the Operation Protection row and click Enable.
3. Select Enable.

   Figure 4 Configuring operation protection

   
   

4. Click OK.

• Disabling operation protection

1. Go to the Security Settings page.
2. On the Critical Operations tab, locate the Operation Protection row and click Change.

   Figure 5 Disabling operation protection

   
   

3. Select Disable and click OK.

   Figure 6 Disabling operation protection

   
   

4. Enter a verification code.
   • Self-verification: The administrator who wants to disable operation protection completes the verification. Email and virtual MFA verification are supported.
   • Verification by another person: The specified person completes the verification. Only email verification is supported. Virtual MFA devices are not supported.

5. Click OK.

Access Key Management

• Enabling access key management

  After access key management is enabled, only the administrator can create, enable, disable, or delete access keys of IAM users. This function is disabled by default. To ensure resource security, enable this function.

  To enable access key management, click the Critical Operations tab on the Security Settings page, and click in the Access Key Management row.

• Disabling access key management

  After access key management is disabled, all IAM users can create, enable, disable, or delete their own access keys.

  To disable access key management, click the Critical Operations tab on the Security Settings page, and click in the Access Key Management row.

Information Self-Management

• Enabling information self-management

  By default, information self-management is enabled, indicating that all IAM users can manage their own basic information (login password, mobile number, and email address). Determine whether to allow IAM users to manage their own information and what information they can modify.

  To enable information self-management, click the Critical Operations tab on the Security Settings page, and click Enable in the Information Self-Management row. Select Enable, select the information types that IAM users can modify, and click OK.

• Disabling information self-management

  After you disable information self-management, only administrators can manage their own basic information. If you are an IAM user and want to change your login password, mobile number, or email address, contact the administrator. The administrator can modify the information by referring to Managing IAM User Information.

  To disable information self-management, click the Critical Operations tab on the Security Settings page, and click Change in the Information Self-Management row. In the displayed pane, select Disable and click OK.

Critical Operations