Skip to main content

Least-Privilege Policies

Cloudaware’s Alibaba Cloud integration is designed to use read‑only access wherever possible. Use the patterns below to grant only the minimum rights required for each scenario.

Identity Model​

  • Prefer a RAM role assumed by Cloudaware using an External ID.
  • Alternatively use a RAM user with access keys for specific or legacy setups.
  • Cloudaware provides a ROS template that creates the required role and policies for you.
  • Trust policy:
    • Trusts the Cloudaware Alibaba account ID as a principal.
    • Requires an External ID generated in Cloudaware for cross‑account protection.
  • Permissions:
    • The Cloudaware ROS template attaches policies that grant read‑only access across supported services (ECS, VPC, SLB, OSS, ACK, Function Compute, SAE, etc.).
  • Scope:
    • Per Alibaba Cloud account; create one role per account.

Use this model when you can run ROS stacks and prefer not to manage long‑lived access keys.

RAM User with Access Keys​

  • Create a dedicated RAM user used only by Cloudaware.
  • Attach Cloudaware’s collector policies (or equivalent read‑only policies) to that user.
  • Generate an access key ID and secret, then configure them in Cloudaware.
  • Avoid broad administrative policies; keep the user limited to discovery and read‑only operations.

Rotate access keys regularly according to your security policies; update Cloudaware when keys change.

Tagging From Cloudaware​

To allow Tag Analyzer and other workflows to manage tags on Alibaba Cloud resources, you must grant additional write permissions for tag operations.

If you use access keys, make sure that the RAM user policy includes permissions similar to the following:

{
  "Action": [
    "tag:*",
    "*:ListTagResources",
    "*:DescribeTags",
    "*:DescribeTagKeys",
    "*:ListTagKeys",
    "*:ListTagValues",
    "*:Tag*",
    "*:Untag*",
    "*:UnTag*",
    "*:AddTags*",
    "*:RemoveTags*"
  ],
  "Resource": [
    "*"
  ],
  "Effect": "Allow"
}

When you use a RAM role created from the Cloudaware ROS template, review the deployed policy to ensure similar tag actions are present, and adjust the scope (accounts, regions, resource types) to match your organization’s tagging strategy.

To learn how to work with tags in Cloudaware, see Cloudaware Tag Analyzer.

Scoping Recommendations​

  • Use dedicated roles or users rather than reusing existing production identities.
  • Keep permissions read‑only unless specific future features require write access.
  • For large environments, standardize the RAM role name and policies across accounts using ROS and Cloudaware templates.
  • Review roles and policies periodically and remove unused capabilities to keep the privilege footprint small.