Identity Authentication

The IAM service requires the access requester to present the identity credential and verifies the identity validity. In addition, the IAM service provides login protection and verification policies to harden the security of identity authentication.

Identity Credentials and Their Security

IAM can be accessed using accounts and IAM users. Both of them support identity authentication using usernames, passwords, access keys, and temporary access keys. IAM implements security design for each identity credential to protect user data and enable users to access IAM more securely. For details, see Table 1.

**Table 1** IAM identity credentials and security design
Access Credential	Security Description	Reference
Username and password	You can configure the character type and minimum length of a user key as required. You can also configure the password validity period policy and minimum password validity period policy.	Password Policy
Access Key	AK is used together with SK to sign requests cryptographically, ensuring that the requests are secret, complete, and correct.	Access Keys
Temporary Access Key	In addition to the access key feature, a temporary access key has a validity period that can be customized. If the validity period expires, the temporary access key becomes invalid and you have to obtain a new one.	Temporary Access Key (for Federated Users)

Login Protection and Authentication Policies

As described in Table 2, in addition to requiring users to show credentials and verify their validity during login, IAM also provides login protection and supports login verification policies to prevent user information from being stolen.

**Table 2** Login protection and authentication policies
Login Protection Method	Description	Functions
Login Protection	In addition to entering the username and password on the login page (first-time authentication), you need to enter a verification code on the Login Verification page (second-time authentication). Verify that mobile numbers, email addresses, and virtual MFA devices are supported. For details, see MFA Authentication.	Login Protection
Login Authentication Policy	IAM supports the following login authentication policies: Session timeout policy: If a user does not log in to the system within a specified period, the user needs to log in again. Account lockout policy: If the number of login failures exceeds the threshold, the account is locked. Account disabling policy: If a user does not log in to the system for a long time, the account is disabled. Display of recent login information: Allows users to view the last login time.	Login Authentication Policy