Prerequisites - Before you begin onboarding Alibaba Cloud, you must review the following prerequisites. - Administrator Guide

Prerequisites - Before you begin onboarding Alibaba Cloud, you must review the following prerequisites. - Administrator Guide - Cortex CLOUD

Cortex Cloud Posture Management Documentation

Product

Cortex Cloud Application Security > Cortex CLOUD

License

Cloud Posture Management

Creation date

2025-01-22

Last date published

2026-06-04

Required RAM permissions in Alibaba Cloud

Before onboarding Alibaba Cloud to Cortex Cloud, ensure the user or role performing the onboarding has the necessary RAM permissions.

Use the following template to create a custom policy with the permissions required for onboarding an Alibaba Cloud account to Cortex Cloud. The custom policy can be created in Alibaba Cloud RAM Console at Permissions → Policies → Create Policy → Script and attach the policy to the RAM user or role that will run the Terraform apply.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:CreateRole",
        "ram:GetRole",
        "ram:UpdateRole",
        "ram:DeleteRole",
        "ram:ListRoles",
        "ram:CreatePolicy",
        "ram:GetPolicy",
        "ram:GetPolicyVersion",
        "ram:DeletePolicy",
        "ram:ListPolicies",
        "ram:ListPolicyVersions",
        "ram:CreatePolicyVersion",
        "ram:DeletePolicyVersion",
        "ram:SetDefaultPolicyVersion",
        "ram:AttachPolicyToRole",
        "ram:DetachPolicyFromRole",
        "ram:ListPoliciesForRole",
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    }
  ]
}

Add Cortex Cloud as an OIDC provider in Alibaba Cloud

In order to establish trust between Cortex Cloud and Alibaba Cloud, you must add an OpenID Connect (OIDC) provider. If you already have an existing OIDC provider for accounts.google.com, you can add Cortex Cloud as an audience to the existing provider. Otherwise, create a new OIDC provider.

Before you begin, obtain the Cortex Cloud Project ID of your tenant by clicking on the User menu and then selecting About.

In Alibaba Cloud Console, navigate to RAM → Integrations → SSO.
In SSO, select the OIDC tab.
Click Create IdP.
In Create IdP, enter the IdP Name. For example, CortexGCPProvider.
In Issuer URL, enter the GCP IdP URL: https://accounts.google.com.
In Client ID, enter: alibaba-cortex-wif-<accountID> where <accountID> corresponds to the Cortex Cloud Project ID.
In Fingerprint, enter the SHA1 fingerprint of the signing certificate for accounts.google.com. Note that this fingerprint changes periodically and must be kept up-to-date.
Save the changes.