What Oleria discovers
- RAM users, with their console sign-in, MFA and SSO state, and last activity (the later of their last console sign-in and their AccessKeys’ last use).
- The root account, with its MFA state and activity.
- User groups and their members.
- RAM policies as roles, with the users and groups each policy is attached to. RAM users (directly or through a group) and RAM roles with
AdministratorAccess, and the root account, are flagged as admins. - Non-human identities:
- RAM roles, and which users, accounts, and Alibaba Cloud services can assume each one.
- AccessKeys, and the RAM user that owns each one.
- Service credentials, and the RAM user that owns each one.
- OAuth applications created in your account, with their app secrets, and third-party OAuth applications installed in your account.
- Agents hosted in AgentRun, with their current version and the RAM role each one runs as. Oleria reads agents from every AgentRun region: Singapore, China (Beijing), China (Hangzhou), China (Shanghai), and China (Shenzhen).
- Activity from ActionTrail management events in your account’s global events storage region and the region you select, for up to 90 days of history.
Prerequisites
- An Alibaba Cloud account, and permission to create RAM users and attach policies in the RAM console.
- Admin access on the Oleria platform to add a new integration.
Use a dedicated RAM user for Oleria, not the root account. Oleria refuses AccessKeys that belong to the root account.
Create a RAM user and AccessKey for Oleria
1
Create the RAM user
In the RAM console, go to Identities -> Users and select Create User. Enter a Logon Name such as
oleria-connector. In the Access Mode section, select Permanent AccessKey only, and select the confirmation checkbox. Oleria doesn’t need console access.2
Copy the AccessKey
Alibaba Cloud creates an AccessKey for the new user. Copy the AccessKey ID and AccessKey secret - you’ll paste them into Oleria in the next section.
Alibaba Cloud shows the AccessKey Secret only once, when you create the AccessKey. Copy it now and store it securely.
3
Grant read access
On the Users page, find the user and select Attach Policy. Set Resource scope to Account level, and attach these system policies:Without
AliyunRAMReadOnlyAccessAliyunActionTrailReadOnlyAccess
agentrun:ListAgentRuntimes, Oleria skips agents and syncs everything else.4
(Optional) Grant permissions for remediation actions
To let Oleria run remediation actions, create a custom policy with this document and attach it to the RAM user:You can attach
AliyunRAMFullAccess instead, but it also lets the AccessKey create users and grant any permission.Oleria can’t read what a custom policy allows. It shows the actions as available once the RAM user has AdministratorAccess, AliyunRAMFullAccess or any custom policy attached, including the read policy above, so if one of these permissions is missing, the action fails when it runs.Connect Alibaba Cloud to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations, then select the Alibaba Cloud tile.
2
Complete the connection form
Fill in the connection form:
3
Save the integration
Select Authenticate to validate the credentials and save the integration.
Verify the integration
Confirm the new instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. Oleria syncs RAM users, groups, policies, non-human identities, and activity on its regular sync schedule once the initial sync completes.If you rotate the AccessKey in Alibaba Cloud, edit the integration in Oleria and enter the new AccessKey ID and AccessKey Secret. To change only the region, you can leave AccessKey Secret empty and Oleria keeps the stored secret. The new AccessKey must belong to the same Alibaba Cloud account. To connect a different account, add a new integration.
Remediation actions
Oleria can take these actions in Alibaba Cloud when the RAM user has the permissions listed above. Each action can be reverted.
Oleria never runs these actions on the root account. It also refuses to disable, remove from a group, or detach a policy from the RAM user it connects with, and to deactivate its own AccessKey.
RAM roles and OAuth applications have no disabled state in Alibaba Cloud, so Oleria can’t disable them.
Known limitations
- Email addresses are collected only for China-site accounts. Alibaba Cloud doesn’t return RAM user email addresses on the international site, so Oleria can’t match those RAM users to the same people in your other integrations by email.
- Credential report timing. Password-change dates and whether the root account has active AccessKeys come from the RAM credential report. Oleria reads the latest report on each sync and requests a new one for the next sync, so on a new connection these values can first appear on the second sync, and each sync shows the report requested during the previous one.
- Activity from other regions. Oleria reads ActionTrail events from the region you select and from your account’s global events storage region. Events from regional services in other regions aren’t collected.
- One account per connection. Resource Directory member accounts aren’t collected. Connect each account separately.
- CloudSSO users aren’t collected. Their activity in a connected account appears under the RAM role they assume.
- Cloud resources and the contents of policy documents aren’t collected. Oleria doesn’t distinguish policy attachments scoped to a resource group.