Docs: Create Alibaba Cloud Account

Mon, 01 Jan 0001 00:00:00 +0000

Procedure

On the Cloud Accounts page, click “Create” above the list to open the create cloud account page.
Select Alibaba Cloud as the cloud platform, then click “Next: Configure cloud account”.
Configure the following parameters:
- Name: Alibaba Cloud account name.
- Account type: Currently supports connecting Alibaba Cloud public cloud and finance cloud accounts.
- Key ID / password: Connect to Alibaba Cloud via Access Key authentication. An Access Key consists of a key ID (Access Key ID) and a password (Access Key Secret). See How to obtain Alibaba Cloud parameters.
- Common parameters: see Common configuration parameters.
Click “Connection test” to verify that the parameters are correct.
After a successful test, click “Next: Configure sync regions” to configure resource sync regions (all regions are synced by default).
After configuration, click “Next: Billing file access information (optional)” to configure billing parameters.
Configure scheduled sync (optional), then click “OK” to create the Alibaba Cloud account.

To manage a public cloud platform on this platform, the cloud account must at least have management permissions on the resources you operate. Granting the cloud account management permissions for all platform features is recommended.

The domain of an added cloud account cannot be changed. To sync resources from the cloud account to another domain, delete the cloud account on the platform and add it again to the target domain. Deleting a cloud account on the platform only stops onboarding its resources and does not affect resources on the cloud account.

If the Alibaba Cloud account you add is new, enable the OSS service on Alibaba Cloud first.

If the Alibaba Cloud account has Resource Directory enabled and the credentials you enter are an AK/SK under a RAM sub-account (at least AliyunSTSAssumeRole, AccessAliyunOSSReadOnlyAccess, and AliyunResourceDirectoryReadOnlyAccess are required), sub-accounts under the entire Resource Directory are synced by default.

How to obtain Alibaba Cloud parameters

Obtain AccessKey with the primary account

Sign in to the Alibaba Cloud console with the primary account, click the profile icon in the upper right, expand the dropdown, and click “accesskeys” to open the security information management page.
On the security information management page, you can view existing AccessKey information or click “Create AccessKey” to create a new user AccessKey. When creating an AccessKey, Alibaba Cloud sends a verification code to the account contact’s phone; the AccessKey can be created only after verification succeeds.
The Access Key Secret is hidden by default. Click “Show”; Alibaba Cloud sends a verification code to the contact phone for the account. The Access Key Secret is displayed only after verification succeeds.

How a RAM sub-account obtains an Access Key

Sign in to the Alibaba Cloud console with the sub-account, click the profile icon in the upper right, expand the dropdown, and click “accesskey…” to open the security information management page.
On the security information management page, click “Create AccessKey” to create an AccessKey.
After creation succeeds, the AccessKeySecret is shown only once; save it promptly.

For an AccessKey that has already been created, the AccessKeySecret cannot be viewed again.

Permission configuration

To manage Alibaba Cloud resources through the platform, the cloud account needs sufficient permissions:

Permission description	Read-only	Read-write
Manage all Alibaba Cloud resources	ReadOnlyAccess	AdministratorAccess
Manage Elastic Compute Service (ECS)	AliyunECSReadOnlyAccess	AliyunECSFullAccess
Manage Virtual Private Cloud (VPC)	AliyunVPCReadOnlyAccess	AliyunVPCFullAccess
Manage Elastic IP Address (EIP)	AliyunEIPReadOnlyAccess	AliyunEIPFullAccess
Manage ECS elastic network interfaces	AliyunVPCNetworkIntelligenceReadOnlyAccess	AliyunECSNetworkInterfaceManagementAccess
Manage Object Storage Service (OSS)	AliyunOSSReadOnlyAccess	AliyunOSSFullAccess
Manage NAT Gateway	AliyunNATGatewayReadOnlyAccess	AliyunNATGatewayFullAccess
Manage Application Load Balancer (ALB)	AliyunALBReadOnlyAccess	AliyunALBFullAccess
Manage Server Load Balancer (SLB)	AliyunSLBReadOnlyAccess	AliyunSLBFullAccess
Manage ApsaraDB RDS	AliyunRDSReadOnlyAccess	AliyunRDSFullAccess
Manage ApsaraDB for Redis	AliyunKvstoreReadOnlyAccess	AliyunKvstoreFullAccess
Manage ActionTrail	AliyunActionTrailFullAccess	AliyunActionTrailFullAccess
Manage File Storage NAS	AliyunNASReadOnlyAccess	AliyunNASFullAccess
Manage Web Application Firewall (WAF)	AliyunYundunWAFReadOnlyAccess	AliyunYundunWAFFullAccess
Manage Resource Access Management (RAM)	AliyunRAMReadOnlyAccess	AliyunRAMFullAccess
Manage Public DNS	AliyunPubDNSReadOnlyAccess	AliyunPubDNSFullAccess
Manage Alibaba Cloud DNS	AliyunDNSReadOnlyAccess	AliyunDNSFullAccess
Manage enterprise finance	AliyunFinanceConsoleReadOnlyAccess	AliyunFinanceConsoleFullAccess
Manage CloudMonitor	AliyunCloudMonitorReadOnlyAccess	AliyunCloudMonitorFullAccess

How to grant permissions to a sub-account

Sign in to the Alibaba Cloud console with the primary account, click the profile icon in the upper right, expand the dropdown, and click “Access control” to open the access control page.
Click “User management” in the left menu to open the user management page.
On the user management page, click “Authorize” in the actions column for the target user to grant permissions.

Billing configuration

Cloud account type

Includes primary account and associated account. Before using an associated account, ensure the primary account has been imported to the platform, and select that primary account when using the associated account.

Bucket URL

URL of the bucket that stores billing files. See How to obtain the billing bucket URL?.

File prefix

When the billing bucket also stores files other than billing files, configure a file prefix to obtain only billing files from the bucket. For Alibaba Cloud, the billing file prefix is the account ID, which you can view under Account management – Security settings.

Billing analysis scope

Set the scope for the platform to analyze cloud account billing. Currently only accounts onboarded on this platform are supported.

Accounts onboarded on this platform: Collect billing for the primary account and its associated sub-accounts. If the primary account is used only as a payer for other accounts, billing files for those other accounts are discarded.

Collect billing immediately

By default, the platform automatically collects billing at 04:00 every day. When this option is enabled, billing is collected immediately after billing file access information is configured.

Time range

When “Collect billing immediately” is enabled, you can set a time range and collect billing for that range immediately. Collecting 1–6 months of billing is recommended; otherwise the large data volume may put pressure on the system and affect daily billing collection tasks.

How to obtain the billing bucket URL?

Alibaba Cloud international accounts do not have billing bucket configuration; contact Alibaba Cloud support to assist with pushing billing data.

Using an Alibaba Cloud primary account as an example, sign in to the Alibaba Cloud console with the primary account, click “Expenses” at the top, then “User Center” in the dropdown, and open the expenses user center page.
Click “Set billing data storage” to open the billing data storage page.
View and record the bucket names for BillingItemDetail and SplitItemDetailDaily. If they are not set, subscribe both billing reports to the same bucket on this page. After configuration, daily incremental billing data is stored on the corresponding OSS. Storing only billing files in that bucket is recommended.

Tags for resources such as Alibaba Cloud OSS do not appear in BillingItemDetail and are only shown in split billing. To analyze costs by tags, configure SplitItemDetailDaily to the bucket.

On the Object Storage page in the Alibaba Cloud console, view the overview of the corresponding bucket; the bucket domain name is the bucket URL.

Cloudpods – Alibaba Cloud