Docs
Open the console →
Guides

Connect an Alibaba Cloud account

Connect Alibaba Cloud to Snowtrol with a RAM OIDC provider and AssumeRoleWithOIDC — keyless federation with read-only access, no AccessKey/Secret ever exchanged.

Snowtrol connects to Alibaba Cloud keylessly via STS AssumeRoleWithOIDC: a RAM OIDC provider in your account trusts Snowtrol's issuer, and a RAM role trusts that provider with a subject condition unique to your connection. No AccessKey/Secret is ever exchanged — the platform refuses to boot with an Alibaba AccessKeySecret in its environment.

Connect

  1. Start the connection

    On Cloud accounts → Connect, choose Alibaba Cloud and enter your 16-digit account UID (optionally a custom RAM role ARN acs:ram::<uid>:role/<name> and OIDC provider ARN).

  2. Run the aliyun script

    The connect panel renders a ready-to-run aliyun CLI script with your real resolved values: it creates the RAM OIDC provider (trusting Snowtrol's issuer) and a RAM role whose trust policy allows sts:AssumeRoleWithOIDC for your connection's subject, then attaches ReadOnlyAccess and AliyunBSSReadOnlyAccess (for cost).

  3. Verify

    Click Verify connection. A healthy check starts the first sync; failures name the exact problem.

Alibaba syncs ECS, VPC/VSwitch, RDS and SLB inventory plus NAT/route-table/security-group topology (hand-signed OpenAPI RPC calls), and BSS billing feeds the cost engine. Deploy blueprints (OSS bucket / ECS instance / VPC) are available like any other cloud's. Security groups feed the reachability engine; OSS/ACK/Function Compute configuration depth is honestly empty pending their dedicated readers.