> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Alibaba Cloud

> Connect an Alibaba Cloud account with a RAM user's AccessKey so Oleria can discover RAM users, groups, policies, non-human identities, and ActionTrail activity.

Connect Alibaba Cloud to Oleria to see who and what can act on your Alibaba Cloud account through Resource Access Management (RAM), and what they do with that access. Each connection covers one Alibaba Cloud account.

## What Oleria discovers

* **RAM users**, with their console sign-in, MFA and SSO state, and last activity (the later of their last console sign-in and their AccessKeys' last use).
* **The root account**, with its MFA state and activity.
* **User groups** and their members.
* **RAM policies** as roles, with the users and groups each policy is attached to. RAM users (directly or through a group) and RAM roles with `AdministratorAccess`, and the root account, are flagged as admins.
* **Non-human identities**:
  * RAM roles, and which users, accounts, and Alibaba Cloud services can assume each one.
  * AccessKeys, and the RAM user that owns each one.
  * Service credentials, and the RAM user that owns each one.
  * OAuth applications created in your account, with their app secrets, and third-party OAuth applications installed in your account.
* **Agents** hosted in AgentRun, with their current version and the RAM role each one runs as. Oleria reads agents from every AgentRun region: Singapore, China (Beijing), China (Hangzhou), China (Shanghai), and China (Shenzhen).
* **Activity** from ActionTrail management events in your account's global events storage region and the region you select, for up to 90 days of history.

Oleria uses this data for dormant account detection, access reviews, and NHI discovery, refreshed on Oleria's [regular sync schedule](/integrations/overview.md#sync-model).

## Prerequisites

* An Alibaba Cloud account, and permission to create RAM users and attach policies in the RAM console.
* Admin access on the Oleria platform to add a new integration.

> [!NOTE]
>
> Use a dedicated RAM user for Oleria, not the root account. Oleria refuses AccessKeys that belong to the root account.

## Create a RAM user and AccessKey for Oleria

**1. Create the RAM user**

In the [RAM console](https://ram.console.alibabacloud.com), go to **Identities** -> **Users** and select **Create User**. Enter a **Logon Name** such as `oleria-connector`. In the **Access Mode** section, select **Permanent AccessKey** only, and select the confirmation checkbox. Oleria doesn't need console access.

**2. Copy the AccessKey**

Alibaba Cloud creates an AccessKey for the new user. Copy the **AccessKey ID** and **AccessKey secret** - you'll paste them into Oleria in the next section.

> [!NOTE]
>
> Alibaba Cloud shows the AccessKey Secret only once, when you create the AccessKey. Copy it now and store it securely.

**3. Grant read access**

On the **Users** page, find the user and select **Attach Policy**. Set **Resource scope** to **Account level**, and attach these system policies:

* `AliyunRAMReadOnlyAccess`
* `AliyunActionTrailReadOnlyAccess`

Then create a custom policy with this document and attach it too. Oleria uses it to generate the RAM credential report, which provides password-change dates and whether the root account has active AccessKeys, and to list your AgentRun agents:

```json theme={null}
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:GenerateCredentialReport",
        "agentrun:ListAgentRuntimes"
      ],
      "Resource": "*"
    }
  ]
}
```

Without `agentrun:ListAgentRuntimes`, Oleria skips agents and syncs everything else.

**4. (Optional) Grant permissions for remediation actions**

To let Oleria run [remediation actions](#remediation-actions), create a custom policy with this document and attach it to the RAM user:

```json theme={null}
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:UpdateLoginProfile",
        "ram:UpdateAccessKey",
        "ram:UpdateServiceCredential",
        "ram:AddUserToGroup",
        "ram:RemoveUserFromGroup",
        "ram:AttachPolicyToUser",
        "ram:DetachPolicyFromUser",
        "ram:CreateGroup",
        "ram:DeleteGroup"
      ],
      "Resource": "*"
    }
  ]
}
```

You can attach `AliyunRAMFullAccess` instead, but it also lets the AccessKey create users and grant any permission.

> [!WARNING]
>
> `ram:AttachPolicyToUser` on its own lets the AccessKey attach `AdministratorAccess` to any user. Treat an AccessKey with remediation permissions as an admin credential.

Oleria can't read what a custom policy allows. It shows the actions as available once the RAM user has `AdministratorAccess`, `AliyunRAMFullAccess` or any custom policy attached, including the read policy above, so if one of these permissions is missing, the action fails when it runs.

## Connect Alibaba Cloud to Oleria

**1. Open the integration**

Go to your Oleria workspace, select **Integrations**, then select the **Alibaba Cloud** tile.

**2. Complete the connection form**

Fill in the connection form:

| Field | Notes |
| :- | :- |
| AccessKey ID | Required. The AccessKey ID of the RAM user you created. |
| AccessKey Secret | Required. The AccessKey Secret shown when you created the AccessKey. |
| Region | Required. Your account's primary region, for example `Singapore – ap-southeast-1`. Oleria reads ActionTrail events from this region and from your account's global events storage region, so choose the region where most of your regional activity happens. |

**3. Save the integration**

Select **Authenticate** to validate the credentials and save the integration.

## Verify the integration

Confirm the new instance appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. Oleria syncs RAM users, groups, policies, non-human identities, and activity on its [regular sync schedule](/integrations/overview.md#sync-model) once the initial sync completes.

> [!NOTE]
>
> If you rotate the AccessKey in Alibaba Cloud, edit the integration in Oleria and enter the new **AccessKey ID** and **AccessKey Secret**. To change only the region, you can leave **AccessKey Secret** empty and Oleria keeps the stored secret. The new AccessKey must belong to the same Alibaba Cloud account. To connect a different account, add a new integration.

## Remediation actions

Oleria can take these actions in Alibaba Cloud when the RAM user has the permissions listed above. Each action can be reverted.

| Action | What it does | Revert |
| :- | :- | :- |
| Disable user account | Turns off the RAM user's console sign-in, and deactivates the user's active AccessKeys and service credentials. | Turns back on only what the action turned off. |
| Enable user account | Turns the RAM user's existing console sign-in back on. It doesn't reactivate AccessKeys or service credentials, and it fails for a user without console sign-in. To undo **Disable user account**, revert that action instead. | Turns console sign-in off again. |
| Add or remove a user from a group | Adds or removes a RAM user in a user group. | Reverses the change. |
| Add or remove a role | Attaches or detaches a policy directly on a RAM user, at account scope. Removing doesn't affect a policy the user gets through a user group - remove the user from that group instead. | Reverses the change. |
| Disable non-human identity | Deactivates an AccessKey or a service credential. | Activates it again. |
| Create group | Creates a RAM user group. If a group with that name already exists, nothing changes. | Deletes the group, but only while it has no members and no attached policies. |

Oleria never runs these actions on the root account. It also refuses to disable, remove from a group, or detach a policy from the RAM user it connects with, and to deactivate its own AccessKey.

> [!NOTE]
>
> RAM roles and OAuth applications have no disabled state in Alibaba Cloud, so Oleria can't disable them.

## Known limitations

* **Email addresses** are collected only for China-site accounts. Alibaba Cloud doesn't return RAM user email addresses on the international site, so Oleria can't match those RAM users to the same people in your other integrations by email.
* **Credential report timing.** Password-change dates and whether the root account has active AccessKeys come from the RAM credential report. Oleria reads the latest report on each sync and requests a new one for the next sync, so on a new connection these values can first appear on the second sync, and each sync shows the report requested during the previous one.
* **Activity from other regions.** Oleria reads ActionTrail events from the region you select and from your account's global events storage region. Events from regional services in other regions aren't collected.
* **One account per connection.** Resource Directory member accounts aren't collected. Connect each account separately.
* **CloudSSO users** aren't collected. Their activity in a connected account appears under the RAM role they assume.
* **Cloud resources** and the contents of policy documents aren't collected. Oleria doesn't distinguish policy attachments scoped to a resource group.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.