Prerequisites - Before you begin onboarding Alibaba Cloud, you must review the following prerequisites. - Administrator Guide - Cortex XDR - Cortex

Prerequisites - Before you begin onboarding Alibaba Cloud, you must review the following prerequisites. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR 5.x Documentation

Product

Cortex XDR

License

XDR + Cloud

Creation date

2025-07-13

Last date published

2026-06-11

Required RAM permissions in Alibaba Cloud

Before onboarding Alibaba Cloud to Cortex XDR, ensure the user or role performing the onboarding has the necessary RAM permissions.

Use the following template to create a custom policy with the permissions required for onboarding an Alibaba Cloud account to Cortex XDR. The custom policy can be created in Alibaba Cloud RAM Console at Permissions → Policies → Create Policy → Script and attach the policy to the RAM user or role that will run the Terraform apply.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:CreateRole",
        "ram:GetRole",
        "ram:UpdateRole",
        "ram:DeleteRole",
        "ram:ListRoles",
        "ram:CreatePolicy",
        "ram:GetPolicy",
        "ram:GetPolicyVersion",
        "ram:DeletePolicy",
        "ram:ListPolicies",
        "ram:ListPolicyVersions",
        "ram:CreatePolicyVersion",
        "ram:DeletePolicyVersion",
        "ram:SetDefaultPolicyVersion",
        "ram:AttachPolicyToRole",
        "ram:DetachPolicyFromRole",
        "ram:ListPoliciesForRole",
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    }
  ]
}

Add Cortex XDR as an OIDC provider in Alibaba Cloud

In order to establish trust between Cortex XDR and Alibaba Cloud, you must add an OpenID Connect (OIDC) provider. If you already have an existing OIDC provider for accounts.google.com, you can add Cortex XDR as an audience to the existing provider. Otherwise, create a new OIDC provider.

Before you begin, obtain the Cortex XDR Project ID of your tenant by clicking on the User menu and then selecting About.

In Alibaba Cloud Console, navigate to RAM → Integrations → SSO.
In SSO, select the OIDC tab.
Click Create IdP.
In Create IdP, enter the IdP Name. For example, CortexGCPProvider.
In Issuer URL, enter the GCP IdP URL: https://accounts.google.com.
In Client ID, enter: alibaba-cortex-wif-<accountID> where <accountID> corresponds to the Cortex XDR Project ID.
In Fingerprint, enter the SHA1 fingerprint of the signing certificate for accounts.google.com. Note that this fingerprint changes periodically and must be kept up-to-date.
Save the changes.