Alibaba Cloud

Alibaba Cloud provides cloud computing services and cloud Infrastructure as a service.

The Alibaba Cloud adapter enables Axonius to fetch and catalog cloud infrastructure assets, including compute instances and user identities, ensuring comprehensive visibility into your Alibaba Cloud environment.

Asset Types Fetched

• Devices, Users, Object Storage, Compute Services, Databases, Load Balancers, Networks, Disks

Before You Begin

Required Ports

• TCP port 443

Authentication Methods

• Alibaba Access Key ID
• Alibaba Access Key Secret

APIs

Axonius uses the Alibaba Cloud OpenAPI. Requests are signed with the Access Key ID and Access Key Secret. The following endpoints are called for each configured region, unless noted otherwise:

Required Permissions

The Access Key ID and Access Key Secret used for the connection must be associated with a user that has read permissions to the resources that you want to fetch.

The following RAM permissions are required for these advanced settings. Grant them on all resources ("Resource": "*"). Permissions scoped to specific instance ARNs are not enough.

• Fetch ObjectStorage from OSS - oss:ListBuckets
• Enrich OSS with OSS Tags - oss:GetBucketTagging
• Fetch ComputeServices of sub-type acr from ACR - cr:ListInstance
• Fetch ComputeServices of sub-type ack from ACK - cs:GetClusters (on all clusters)
• Fetch Databases from RDS - rds:DescribeDBInstances
• Enrich RDS with RDS Tags - rds:DescribeTags
• Fetch LoadBalancers of sub-type alb from ALB - alb:ListLoadBalancers
• Fetch LoadBalancers of sub-type clb from CLB - slb:DescribeLoadBalancers
• Fetch Networks from VPC - vpc:DescribeVpcs
• Fetch Disk from Disks - ecs:DescribeDisks

Connection Parameters

To connect the adapter in Axonius, provide the following parameters.

Required Parameters

1. Region ID - Specify a region ID based on the geographic location of your business operation. For the complete list of region IDs, see Alibaba Cloud Help Center - Regions and Zones.

   Note

   You can enter multiple region IDs separated by commas.

2. Alibaba Access Key ID and Alibaba Access Key Secret - Specify your account access key ID and secret, which you can get by doing as follows:

   1. Log on to the Alibaba Cloud console.
   2. At the upper-right corner, hover the cursor over the username, and select Access Keys from the shortcut menu that appears.
   3. In the security prompt box, click Continue to manage the Access Key. The Access Key ID and Access Key Secret are displayed.

Optional Parameters

1. HTTPS Proxy - Enter an HTTPS proxy address to connect the adapter to a proxy instead of directly connecting it to the domain.

To learn about additional optional/common adapter connection parameters, see Adding a New Adapter Connection.

Advanced Settings

• Fetch Devices of sub-type ecd from ECD (default: disabled) - Select this option to fetch Elastic Desktop Service (ECD) cloud desktops as Devices. The adapter queries ECD only in the regions of Region IDs where Alibaba Cloud provides ECD and skips the other configured regions without an error.
• Fetch Users from Users (default: disabled) - Select this option to fetch users from the Users endpoint. Note that the region must be in the supported regions of a CloudSSO directory (listed here) and CloudSSO must be activated for the Alibaba account in that region.
• Fetch ObjectStorage from OSS (default: disabled) - Select this option to fetch Object Storage Service (OSS) buckets as Object Storage.
  • Enrich OSS with OSS Tags (default: disabled) - Select this option to fetch the tags of OSS buckets and add them to the Object Storage assets. This setting is relevant when Fetch ObjectStorage from OSS is enabled.
• Fetch ComputeServices of sub-type acr from ACR (default: disabled) - Select this option to fetch Container Registry (ACR) instances as Compute Services.
• Fetch ComputeServices of sub-type ack from ACK (default: disabled) - Select this option to fetch Container Service for Kubernetes (ACK) clusters as Compute Services.
• Fetch Databases from RDS (default: disabled) - Select this option to fetch Relational Database Service (RDS) instances as Databases.
  • Enrich RDS with RDS Tags (default: disabled) - Select this option to fetch the tags of RDS instances and add them to the Databases assets. This setting is relevant when Fetch Databases from RDS is enabled.
• Fetch LoadBalancers of sub-type alb from ALB (default: disabled) - Select this option to fetch Application Load Balancer (ALB) instances as Load Balancers.
• Fetch LoadBalancers of sub-type clb from CLB (default: disabled) - Select this option to fetch Classic Load Balancer (CLB) instances as Load Balancers.
• Fetch Networks from VPC (default: disabled) - Select this option to fetch Virtual Private Cloud (VPC) networks as Networks.
• Fetch Disk from Disks (default: disabled) - Select this option to fetch Elastic Compute Service (ECS) disks as Disks.