Alibaba Cloud
Alibaba Cloud shows up in due diligence more than it shows up in greenfield builds — usually a China market entry or an acquisition that came with an existing account. RAM discipline is the first thing to check.
Updated
How I use it
- RAM (Resource Access Management) permission review across accounts and services
- AccessKey lifecycle audit — age, last use, rotation policy
- Security Center configuration review for baseline threat detection
- Cross-border data flow review specific to PIPL and China's regulatory requirements
Recurring problems I find
- AccessKeys created years ago, never rotated, still active
- RAM roles copied from a tutorial with far broader permissions than the workload needs
- Security Center enabled at the free tier only, missing coverage the client assumes they have
RAM now supports passkey login and auto-disabling idle AccessKeys.
Related
Cloud security assessment
Configuration and architecture assessment for Azure, GCP and Alibaba Cloud: identity, network, data, logging and CSPM findings with a fix roadmap.
Alibaba ACA Cloud Security
Alibaba Cloud Associate in cloud security: platform security services, host and network protection, and data security on Alibaba Cloud.
Cloud security
Multi-cloud security practice: landing zones, identity, posture management, MITRE ATT&CK-aligned detection engineering and CIS hardening baselines.
Multi-cloud baseline
How to express a single set of security requirements — including AI workload guardrails — across Azure, Google Cloud and Alibaba Cloud without maintaining three unrelated standards.