Identity Authentication

The IAM service requires the access requester to present the identity credential and verifies the identity validity. In addition, the IAM service provides login protection and verification policies to harden the security of identity authentication.

Identity Credentials and Their Security

IAM can be accessed using accounts and IAM users. Both of them support identity authentication using usernames and passwords, access keys, and temporary security credentials. IAM implements security design for each identity credential to protect user data and enable users to access IAM more securely. For details, see Table 1.

**Table 1** IAM identity credentials and security design
Access Credential	Principal	Security Description	Reference
Username and password	Account root users and IAM users	You can configure the character type and minimum length of a user password as required. You can also configure the password validity period policy and minimum password validity period policy.	Password Policy
Access Key	Account root users and IAM users	AK is used together with SK to sign requests cryptographically, ensuring that the requests are secret, complete, and correct.	Access Keys
Temporary security credential	Agency or trust agency	In addition to the access key feature, a temporary access key has a validity period that can be customized. If the validity period expires, the temporary access key becomes invalid and you have to obtain a new one.	Temporary Security Credentials

Login Protection and Verification Policy

As described in Table 2, in addition to requiring users to show credentials and verify their validity during login, IAM also provides login protection and supports login verification policies to prevent user information from being stolen.

**Table 2** Login authentication policy
Login Protection Method	Description	Functions
Login Protection	In addition to entering the username and password on the login page (first-time authentication), you need to enter a verification code on the Login Verification page (second-time authentication). Verify that virtual MFA devices are supported. For details, see Multi-Factor Authentication.	Login Protection
Login Authentication Policy	IAM supports the session timeout policy. If a user does not log in to the system within a specified period, the user needs to log in again. IAM supports the account lockout policy. If the number of login failures exceeds the threshold, the account is locked. IAM supports the account disabling policy. If a user does not log in to the system for a long time, the account is disabled. IAM supports the display of recent login information to allow users to view the last login time.	Login Authentication Policy