Security guide

Secure Alibaba Cloud Architecture: Reference Design

A secure Alibaba Cloud architecture starts with identity: keep the main account for rare tasks, give people and applications RAM identities with least privilege, and replace long-term AccessKey pairs with RAM roles and STS tokens. Around that, record events with ActionTrail, keep OSS private with Block Public Access, narrow security group rules, hold secrets in KMS and put WAF and Security Center in front of and around the servers.

This guide draws that design, explains each area in plain words, maps it to Alibaba Cloud's own documentation and ends with a decision checklist. Every claim comes from Alibaba Cloud documentation read on 4 November 2026.

Updated 4 November 2026 (last reviewed)

TL;DR

The short version

5 points

Identity: the main account only for rare tasks; RAM identities or SSO with MFA; custom least-privilege policies.
Credentials: RAM roles with STS tokens; where unavoidable, one RAM user and AccessKey pair per application; never an account AccessKey.
Evidence: an ActionTrail trail with all management events, plus data events for sensitive buckets.
Data: OSS Block Public Access at the account level, private ACLs, fixed-principal bucket policies, secrets in KMS.
Network and edge: narrow security group rules, WAF tuned in monitor mode then enforced, Security Center as one layer among several.

The reference architecture

Read the figure from the top: identity controls sit above everything, traffic reaches the servers through WAF and security groups, secrets and storage are separate services, and ActionTrail records what every identity does.

Figure 1. Reference architecture. RAM decides who and what can act, with the main account held back; traffic passes WAF and security groups before reaching servers; secrets sit in KMS and storage is private; ActionTrail records what happened. The layout is our illustration of Alibaba Cloud's documented practices.

Design areas and where Alibaba Cloud documents them

The table maps each design area to the Alibaba Cloud pages that support it. The wording of the “what to do” column is ours.

Area	What to do	Source
Account and people	Main account for rare tasks only; RAM identities per person or SSO through SAML 2.0 or OIDC; MFA and passkeys.	What is RAM
Workload credentials	RAM roles with STS tokens; if unavoidable, one RAM user and AccessKey pair per application; no account AccessKey.	STS, AccessKey pairs
Authorization	Custom least-privilege policies, conditions (source CIDR, MFA), resource groups, explicit Deny for must-never actions.	RAM policies, What is RAM
Evidence	ActionTrail trail with all management events and data events for sensitive buckets.	ActionTrail, ActionTrail trails
Storage	Block Public Access at account level; private ACLs; fixed-principal bucket policies.	OSS Block Public Access, OSS bucket ACL
Secrets and keys	Secrets in KMS instead of code; server-side encryption where required.	KMS
Network	Security groups with narrow rules, isolation between instances, priorities understood.	Security group rules
Application edge	WAF with monitor-mode tuning then enforcement; rate control; origin not directly reachable.	WAF
Risk visibility	Security Center agent on servers; findings with owners; defence in depth.	Security Center

Identity, credentials and policies

RAM compares the Alibaba Cloud account to a Linux root user: it has extensive, unrestrictable permissions and is not suitable for daily use. Create a RAM administrator for daily management, use the main account only when necessary, and secure its password and MFA device. RAM identities are RAM users, user groups and RAM roles; RAM users must use MFA by default, passkeys are available, and SSO works over SAML 2.0 and OIDC.

For programs, an AccessKey pair is a long-term credential. The account's own pair is not recommended; a RAM user's pair inherits that user's permissions, and a separate user and key per application reduces the blast radius. STS issues temporary credentials for a RAM role that expire automatically, support cross-account access and federation, and can be narrowed with a session policy. RAM policies are deny by default, an explicit Deny overrides Allow, and conditions can limit source CIDR block or require MFA. Practise in the Alibaba Cloud Security Lab.

ActionTrail

ActionTrail records operations through the console, OpenAPI and developer tools. Management events are kept 90 days by default; data events, such as reading an OSS object, are not collected unless you create a data event trail. A trail delivers events to Simple Log Service or OSS (and, for single-account trails, MaxCompute) so you can keep them longer. Alibaba Cloud recommends delivering all management events, including read events, to maintain a complete record of AccessKey usage.

OSS and KMS

Block Public Access prevents anonymous access at account, bucket, access point and Object FC Access Point level; when enabled, existing public permissions are ignored and new ones cannot be created, and higher levels override lower ones. A bucket policy with a wildcard principal grants public access, and bucket ACLs of public-read or public-read-write allow it; public-read-write is called the highest-risk setting. Share through fixed principals instead. KMS stores sensitive data as secrets, which removes hard-coded credentials from code.

Security groups, WAF and Security Center

Security group rules match protocol, port range and an authorization object (CIDR block, address, security group or prefix list) and allow or deny by priority, with deny before allow at equal priority. Basic security groups allow internal communication by default; enterprise groups deny inbound and outbound by default. WAF inspects HTTP and HTTPS traffic and can allow, block or monitor; use monitor mode to tune false positives, then enforce. Security Center provides asset inventory, risk discovery (including leaked AccessKey pairs) and runtime protection, and the page recommends defence in depth.

Decision checklist

Answer each with yes, partly or no. Every “no” is a design decision to make. For a scored version with per-domain gaps and export, use the Alibaba Cloud Security Checklist.

Is the Alibaba Cloud account used only for rare tasks, with MFA and a secured password?
Does each person have their own RAM identity or federated sign-in, with MFA required?
Does any AccessKey pair still exist for the Alibaba Cloud account?
Do applications and CI use RAM roles and STS tokens, with long-term keys only where unavoidable and one RAM user per application?
Do policies grant only needed actions on needed resources, with conditions and resource groups where it matters?
Can you disable and delete a leaked AccessKey quickly and see what it did in ActionTrail?
Does a trail keep management events beyond 90 days, and do sensitive buckets have data events recorded?
Is Block Public Access on at the account level, with no public ACLs or wildcard bucket policies?
Are database passwords and API credentials held in KMS secrets rather than code?
Do security groups allow only the sources and ports needed, with SSH and database ports not open to 0.0.0.0/0?
Does WAF protect public sites in enforcement mode after monitor-mode tuning, and is the origin protected from direct access?
Is Security Center deployed on servers, with findings owned and defence in depth kept?

What this guide does not claim

We did not fetch or verify Alibaba Cloud documentation for VPC design, Cloud Firewall, Cloud Config or ApsaraDB, so this guide makes no claims about them. Add those from the vendor's current pages.
KMS is described only at overview level; we did not verify key rotation or deletion behaviour, so none is claimed.
The Alibaba Cloud pages we read do not print a last-updated date in the text, so none is claimed. We read them on 4 November 2026; last reviewed 4 November 2026.
The diagram is our illustration. This is not an audit or a compliance opinion, including for Chinese regulatory schemes.

Frequently asked questions

What is a secure Alibaba Cloud architecture?

It is an Alibaba Cloud setup where identity, credentials, evidence, data and network each have a control: RAM users or federated identities instead of the main account, MFA, RAM roles with STS tokens instead of long-term AccessKey pairs, least-privilege RAM policies, an ActionTrail trail, Block Public Access on OSS, security groups with narrow rules, secrets in KMS, and WAF and Security Center in front of and around the servers.

Why not use the Alibaba Cloud account day to day?

Alibaba Cloud compares the account to the root user: it has extensive, unrestrictable permissions, all operation records belong to it so you cannot identify the actual operator, and you cannot separate duties. RAM guidance is to create a RAM administrator for daily operations and use the account only when necessary.

When should I use STS instead of an AccessKey pair?

Whenever you can. STS issues temporary credentials for a RAM role that expire automatically, which Alibaba Cloud describes as more secure than long-term AccessKey pairs, and it supports cross-account access and federation without sharing long-term keys. If you must use an AccessKey pair, give each application its own RAM user.

Does ActionTrail record everything by default?

No. By default it keeps management events for 90 days and does not collect data events such as reading an OSS object. Create a trail to keep management events longer and to record data events; delivery goes to Simple Log Service or OSS and is charged by the destination service.

How do I keep OSS data private?

Turn on Block Public Access, ideally at the account level where it takes priority, keep bucket and object ACLs private, avoid bucket policies with a wildcard principal, and check policies with GetBucketPolicyStatus. Share through fixed principals or temporary credentials.

Is WAF plus Security Center enough?

No. Alibaba Cloud itself recommends defence in depth for Security Center because protection has limits, such as a startup delay after a restart. WAF protects HTTP and HTTPS traffic to applications. Keep patching, least privilege and narrow security groups beneath them.