Prerequisites - Before you begin onboarding Alibaba Cloud, you must review the following prerequisites. - Administrator Guide - Cortex XSIAM - Cortex

Prerequisites - Before you begin onboarding Alibaba Cloud, you must review the following prerequisites. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation

Product

Cortex XSIAM

Creation date

2025-07-15

Last date published

2026-06-16

Required RAM permissions in Alibaba Cloud

Before onboarding Alibaba Cloud to Cortex XSIAM, ensure the user or role performing the onboarding has the necessary RAM permissions.

Use the following template to create a custom policy with the permissions required for onboarding an Alibaba Cloud account to Cortex XSIAM. The custom policy can be created in Alibaba Cloud RAM Console at Permissions → Policies → Create Policy → Script and attach the policy to the RAM user or role that will run the Terraform apply.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:CreateRole",
        "ram:GetRole",
        "ram:UpdateRole",
        "ram:DeleteRole",
        "ram:ListRoles",
        "ram:CreatePolicy",
        "ram:GetPolicy",
        "ram:GetPolicyVersion",
        "ram:DeletePolicy",
        "ram:ListPolicies",
        "ram:ListPolicyVersions",
        "ram:CreatePolicyVersion",
        "ram:DeletePolicyVersion",
        "ram:SetDefaultPolicyVersion",
        "ram:AttachPolicyToRole",
        "ram:DetachPolicyFromRole",
        "ram:ListPoliciesForRole",
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    }
  ]
}

Add Cortex XSIAM as an OIDC provider in Alibaba Cloud

In order to establish trust between Cortex XSIAM and Alibaba Cloud, you must add an OpenID Connect (OIDC) provider. If you already have an existing OIDC provider for accounts.google.com, you can add Cortex XSIAM as an audience to the existing provider. Otherwise, create a new OIDC provider.

Before you begin, obtain the Cortex XSIAM Project ID of your tenant by clicking on the User menu and then selecting About.

In Alibaba Cloud Console, navigate to RAM → Integrations → SSO.
In SSO, select the OIDC tab.
Click Create IdP.
In Create IdP, enter the IdP Name. For example, CortexGCPProvider.
In Issuer URL, enter the GCP IdP URL: https://accounts.google.com.
In Client ID, enter: alibaba-cortex-wif-<accountID> where <accountID> corresponds to the Cortex XSIAM Project ID.
In Fingerprint, enter the SHA1 fingerprint of the signing certificate for accounts.google.com. Note that this fingerprint changes periodically and must be kept up-to-date.
Save the changes.