Alibaba Cloud

Alibaba Cloud (Aliyun)

Purpose

Design, deploy, and manage Alibaba Cloud infrastructure using Terraform/Alibaba Cloud CLI with security, cost optimization, and operational excellence.

Agent Protocol

Trigger

Exact user phrases: "Alibaba Cloud", "Aliyun", "ECS", "ACK", "OSS", "SLB", "RDS", "ApsaraDB", "Alibaba Cloud Kubernetes", "Container Service", "VPC", "RAM", "terraform alicloud", "aliyun cli".

Input Context

Before activating, verify:

• Region and zone preference (Alibaba Cloud has 30+ regions; China regions require ICP license).
• Service type needed: compute (ECS/ECI), container (ACK/ASK), serverless (FC/SAE).
• Authentication method (RAM user key, STS token, RAM role).
• Compliance requirements (ISO 27001, SOC 2, PCI DSS, MLPS in China).
• Network topology (VPC with NAT gateway vs Internet gateway, VPN/CEN for hybrid).

Output Artifact

Writes to Terraform HCL (alicloud provider), Alibaba Cloud CLI commands, RAM policies, YAML for ACK/ASK deployments, and ROS (Resource Orchestration Service) templates.

Response Format

Terraform HCL, RAM policy JSON, ACK YAML, or CLI commands. No extraneous explanation.

No preamble. No postamble. No explanations. No filler/hedging/transitions.

Completion Criteria

• Core infrastructure defined (VPC, subnets, security groups, NAT gateway).
• RAM roles and policies follow least privilege.
• Cost optimization with Pay-As-You-Go or subscription billing applied.
• High availability across multiple zones (at least 2 zones).
• Monitoring and alerting configured (CloudMonitor, ActionTrail).

Max Response Length

Direct file write. No response text.

Architecture Decision Trees

Compute: ECS vs ECI vs ACK vs SAE vs FC

Database: RDS vs PolarDB vs Redis vs MongoDB vs HBase

Networking: Internet vs NAT vs VPN vs CEN

Quick Start

VPC with public/private subnets across 2 zones → RAM role with least privilege → ECS/ACK in private subnets → OSS bucket with versioning → CloudMonitor alerts → Cost tags on all resources.

Core Workflow

Step 1: VPC and Networking

# Terraform: VPC with public + private subnets across 2 zones
terraform {
  required_providers {
    alicloud = {
      source  = "aliyun/alicloud"
      version = "~> 1.209.0"
    }
  }
}

provider "alicloud" {
  region = "cn-hangzhou"
}

resource "alicloud_vpc" "main" {
  vpc_name   = "main-vpc"
  cidr_block = "10.0.0.0/16"
}

resource "alicloud_vswitch" "public" {
  count             = 2
  vpc_id            = alicloud_vpc.main.id
  cidr_block        = "10.0.${count.index}.0/24"
  zone_id           = data.alicloud_zones.available.zones[count.index].id
  vswitch_name      = "public-${count.index}"
}

resource "alicloud_vswitch" "private" {
  count             = 2
  vpc_id            = alicloud_vpc.main.id
  cidr_block        = "10.0.${count.index + 10}.0/24"
  zone_id           = data.alicloud_zones.available.zones[count.index].id
  vswitch_name      = "private-${count.index}"
}

resource "alicloud_nat_gateway" "ngw" {
  vpc_id           = alicloud_vpc.main.id
  specification    = "Small"
  nat_gateway_name = "main-nat"
}

Step 2: RAM Roles and Policies

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetObject",
        "oss:ListObjects",
        "oss:PutObject"
      ],
      "Resource": [
        "acs:oss:*:*:my-app-assets",
        "acs:oss:*:*:my-app-assets/*"
      ],
      "Condition": {
        "StringEquals": {
          "acs:SourceAccount": "1234567890123456"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": ["oss:DeleteObject"],
      "Resource": ["acs:oss:*:*:my-app-assets/backup/*"]
    }
  ],
  "Version": "1"
}

Step 3: ECS Instance with Auto Scaling

resource "alicloud_security_group" "app" {
  name   = "app-sg"
  vpc_id = alicloud_vpc.main.id
}

resource "alicloud_security_group_rule" "allow_http" {
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "80/80"
  priority          = 1
  security_group_id = alicloud_security_group.app.id
  cidr_ip           = "0.0.0.0/0"
}

resource "alicloud_ecs_auto_snapshot_policy" "daily" {
  name            = "daily-snapshots"
  repeat_weekdays = ["1", "2", "3", "4", "5", "6", "7"]
  retention_days  = 7
  time_points     = ["1"]
}

resource "alicloud_ess_scaling_group" "app" {
  scaling_group_name = "app-asg"
  min_size           = 2
  max_size           = 10
  default_cooldown   = 300
  vswitch_ids        = alicloud_vswitch.private[*].id
  removal_policies   = ["OldestInstance", "NewestInstance"]
}

resource "alicloud_ess_scaling_configuration" "app" {
  scaling_group_id  = alicloud_ess_scaling_group.app.id
  image_id          = "aliyun_3_x64_20G_alibase_2023_v2"
  instance_type     = "ecs.g6.large"
  security_group_id = alicloud_security_group.app.id
  system_disk_category = "cloud_essd"
  system_disk_size     = 40
  internet_max_bandwidth_in  = 5
  internet_max_bandwidth_out = 0
  active = true
  enable = true
}

Step 4: OSS with Best Practices

resource "alicloud_oss_bucket" "assets" {
  bucket = "my-app-assets-production"
  acl    = "private"

  lifecycle_rule {
    id      = "archive"
    enabled = true
    prefix  = "logs/"
    transitions {
      days          = 90
      storage_class = "Archive"
    }
    expiration {
      days = 365
    }
  }

  versioning {
    status = "Enabled"
  }

  server_side_encryption_rule {
    sse_algorithm = "KMS"
    kms_master_key_id = alicloud_kms_key.oss.id
  }
}

resource "alicloud_oss_bucket_public_access_block" "assets" {
  bucket              = alicloud_oss_bucket.assets.id
  block_public_access = true
}

Step 5: Container Service for Kubernetes (ACK)

resource "alicloud_cs_managed_kubernetes" "ack" {
  name                   = "my-ack-cluster"
  cluster_spec           = "ack.pro.small"
  worker_vswitch_ids     = alicloud_vswitch.private[*].id
  worker_instance_types  = ["ecs.g6.large"]
  worker_number          = 3
  password               = var.ack_node_password
  pod_cidr               = "172.16.0.0/16"
  service_cidr           = "172.17.0.0/20"
  new_nat_gateway        = false
  slb_internet_enabled   = false
  slb_internet_charge_type = "PayByBandwidth"
  enable_ssh             = false
  node_port_range        = "30000-32767"
  kube_config            = var.kube_config_path
  maintenance_window {
    enable        = true
    weekly_period = "Monday"
    daily_period  = "03:00:00Z-05:00:00Z"
    duration      = "2h"
  }
}

resource "alicloud_cs_autoscaling_config" "default" {
  cluster_id            = alicloud_cs_managed_kubernetes.ack.id
  is_scale_in_enabled   = true
  scale_down_enabled    = true
  utilization_threshold = "0.5"
  unneeded_duration     = "15m"
}

Step 6: CloudMonitor and Alerts

resource "alicloud_cms_alarm" "high_cpu" {
  name              = "app-high-cpu"
  project           = "acs_ecs_dashboard"
  metric            = "CPUUtilization"
  dimensions        = {
    instanceId = alicloud_ess_scaling_configuration.app.id
  }
  statistics        = "Average"
  period            = 300
  operator          = ">"
  threshold         = 80
  triggered_count   = 2
  contact_groups    = ["ops-team"]
  notify_type       = 1
  enabled           = true
  start_time        = 0
  end_time          = 24
  silence_time      = 86400
}

resource "alicloud_cms_alarm" "disk_usage" {
  name              = "app-high-disk"
  project           = "acs_ecs_dashboard"
  metric            = "diskusage_utilization"
  dimensions        = {
    instanceId  = "*"
    mountPoint  = "/"
    device      = "/dev/vda1"
  }
  statistics        = "Average"
  period            = 300
  operator          = ">"
  threshold         = 85
  triggered_count   = 1
  contact_groups    = ["ops-team"]
}

Tool Comparison: Alibaba Cloud vs Other Providers

Anti-Patterns

Anti-Pattern 1: Ignoring Zone Disasters

Failing to deploy across at least 2 zones. Alibaba Cloud zones can fail independently; single-zone deployments are not covered by SLA for most services.

Anti-Pattern 2: Public IPs on All ECS Instances

Assigning public IPs to every ECS instance instead of using NAT Gateway + SLB. This creates a large attack surface and bypasses centralized security controls.

Anti-Pattern 3: Over-Provisioned ECS Instances

Choosing ecs.g7.4xlarge when ecs.g6.large suffices. Right-sizing based on CloudMonitor metrics can save 40-60% on compute costs. Use subscription billing for steady-state workloads.

Anti-Pattern 4: No OSS Lifecycle Policies

Storing logs and temporary files in OSS indefinitely without lifecycle transitions. Logs older than 90 days should transition to Archive tier ($0.003/GB/month vs $0.02/GB/month Standard).

Anti-Pattern 5: Hardcoded RAM Access Keys

Embedding AccessKey ID/Secret in application code or configuration files. Always use RAM roles (for ECS/ACK) or STS temporary tokens for external apps.

Production Considerations

Security

• Enable ActionTrail for all regions to audit API calls.
• Use RAM roles for cross-account access instead of sharing AccessKey pairs.
• Enable SSL/TLS on SLB listeners; disable legacy protocols (SSLv3, TLS 1.0).
• Use KMS for encryption of OSS buckets, RDS instances, and disk snapshots.
• Enable Security Center (SAS) for threat detection and vulnerability scanning.
• Use PrivateLink instead of public IP for accessing Alibaba Cloud services from VPC.

Cost Optimization

• Subscription billing: 1-month, 1-year, 3-year terms. 1-year ECS subscription saves ~50% vs Pay-As-You-Go.
• Reserved instances for RDS/PolarDB: Up to 50% discount for 1-year commitment.
• Preemptible instances: Up to 90% discount for fault-tolerant batch workloads (max 24h).
• OSS lifecycle: Tier data from Standard → Infrequent Access → Archive based on access patterns.
• NAT Gateway: Use NAT Gateway only when instances have no public IP; use EIP for single-instance egress.
• CDN: Use Alibaba Cloud CDN for static assets to reduce origin OSS data transfer costs.

High Availability

• Deploy across minimum 2 availability zones (available in all major regions).
• Use SLB with cross-zone load balancing for HTTP/HTTPS traffic.
• Use RDS with multi-zone deployment (standby in different zone).
• Configure auto-scaling for ECS and ACK to handle traffic spikes.
• Use DNS round-robin or GeoDNS for multi-region failover.

Troubleshooting Guide

Rules & Constraints

• Never hardcode Alibaba Cloud AccessKey — use RAM roles, STS, or Alibaba Cloud CLI profiles.
• Always enable OSS bucket versioning and server-side encryption.
• Every security group must have least-privilege rules; no 0.0.0.0/0 for SSH/RDP.
• Tag all resources with Project, Environment, Owner, and CostCenter tags.
• Enable CloudMonitor detailed monitoring for production ECS instances.
• Use PrivateLink or VPC endpoints over public endpoints for Alibaba Cloud service access.
• Deploy ACK clusters with private SLB only; expose via Application Load Balancer (ALB).
• Enable deletion protection on RDS and OSS buckets.
• Use Alibaba Cloud CLI with ram profile for scripting, never plaintext keys.
• Enable ActionTrail trail for all regions with OSS storage for audit logs.

Output Format

Terraform HCL (alicloud provider), Alibaba Cloud CLI commands, RAM policy JSON, or ROS templates.

References

• references/alibaba-cloud-advanced.md
• references/alibaba-cloud-fundamentals.md
• references/aliyun-database.md
• references/aliyun-ecs-vpc.md
• references/aliyun-kubernetes.md
• references/aliyun-security.md
• references/network-comparison.md

Handoff

After completing this skill:

• Next skill: terraform — Terraform for multi-cloud IaC with alicloud provider
• Pass context: VPC ID, security group IDs, RAM role ARN, region

Implementation Patterns

Terraform: Multi-region ECS Cluster with Autoscaling

resource "alicloud_cs_managed_kubernetes" "multi_region" {
  for_each           = var.regions
  name               = "k8s-${each.key}"
  cluster_spec       = "ack.pro.small"
  worker_vswitch_ids = each.value.vswitch_ids
  worker_instance_types = ["ecs.g6.xlarge"]
  load_balancer_spec = "slb.s2.small"
  worker_disk_size   = 200
  worker_disk_category = "cloud_essd"
}

resource "alicloud_ess_scaling_group" "cluster_asg" {
  for_each          = alicloud_cs_managed_kubernetes.multi_region
  scaling_group_name = "asg-${each.value.name}"
  min_size           = 3
  max_size           = 30
  default_cooldown   = 300
  vswitch_ids        = each.value.worker_vswitch_ids
}

YAML: RAM Policy for Cross-account Access

PolicyDocument:
  Version: "1"
  Statement:
    - Effect: Allow
      Action:
        - ecs:DescribeInstances
        - rds:DescribeDBInstances
        - slb:DescribeLoadBalancers
      Resource: "*"
    - Effect: Allow
      Action:
        - ram:*
      Resource: "*"
      Condition:
        StringEquals:
          acs:SourceArn: "acs:ram::${source_account}:role/cross-account-reader"

Production Considerations

• Enable Resource Groups and Tags on every resource for cost allocation and governance
• Use Resource Access Manager (RAM) for cross-account sharing instead of copying resources
• Configure Alarm Contact Groups before deploying production workloads
• Enable Operation Orchestration Service (OOS) for automated patching and maintenance
• Deploy Cloud Monitor dashboards for every production service with p99 latency alerts
• Use Terraform workspaces to separate dev/staging/prod Alibaba Cloud accounts
• Enable ActionTrail for all API call auditing and feed logs into Log Service

Anti-Patterns

• Using the root account for daily operations — always create RAM users with least privilege
• Hardcoding AccessKey ID/Secret in Terraform or application code — use RAM Roles or Secrets Manager
• Skipping VPC planning — deploying all resources in the default VPC leads to network conflicts
• Over-provisioning ECS instances without autoscaling — results in unnecessary cost
• Ignoring zone affinity — spread instances across multiple availability zones for resilience
• Mixing production and test resources in the same Resource Group — makes cost tracking impossible
• Using Classic Network instead of VPC — Classic Network lacks isolation and security group support

Performance Optimization

• Use ESSD (Enhanced SSD) for all ECS system and data disks; avoid Ultra disks
• Enable CDN with Alibaba Cloud CDN for static asset delivery and DDoS shielding
• Configure SLB connection draining and health checks for zero-downtime deployments
• Use Redis Tair for session caching instead of local ECS memory (survives restarts)
• Tune RDS PG/MySQL connection pools with max_connections = 200 and innodb_buffer_pool_size = 70% of RAM
• Deploy Container Service for Kubernetes (ACK) with cluster autoscaler for burst workloads
• Set ECS hibernate for non-production instances to save compute costs while idle

Security Considerations

• Rotate AccessKey every 90 days via RAM; use temporary STS tokens for short-lived access
• Enable Security Center (Enterprise tier) for vulnerability scanning and baseline checks
• Configure WAF for all public-facing ALB/SLB endpoints to block SQLi and XSS
• Use KMS to encrypt RDS instances, OSS buckets, and disk snapshots at rest
• Enable ActionTrail global trail with Log Service alerting for suspicious API activity
• Restrict Security Group ingress to specific CIDR blocks; never use 0.0.0.0/0 for SSH/RDP
• Implement Resource Directory with SCPs to enforce security baselines across accounts