Terms
This topic decribes the basic terms involved in Cloud Adoption Framework (CAF).
Term | Description |
Resource Access Management (RAM) | A service provided by Alibaba Cloud to manage user identities and resource access permissions. |
Alibaba Cloud account | Before using Alibaba Cloud services, you must create an Alibaba Cloud account. This account owns all resources, is billed for their usage, and has full control over them. By default, only the Alibaba Cloud account can access its resources. Other users require explicit authorization. The Alibaba Cloud account is akin to the root or administrator of an operating system. |
Identities | RAM provides three types of identities: RAM users, user groups, and roles. RAM users and user groups are entity identities, while RAM roles are virtual identities. |
RAM user | An entity identity with a fixed ID and credentials, representing a specific person or application.
|
User group | An entity identity containing multiple RAM users. User groups simplify the classification, authorization, and management of RAM users and their permissions.
|
RAM role | A virtual identity that can be created within an Alibaba Cloud account.
RAM roles are categorized based on the trusted entity:
|
Default domain name | Alibaba Cloud assigns one of these to each Alibaba Cloud account. The format is |
Account alias (enterprise alias) | When a RAM user logs on, the suffix of the logon name can be an account alias, the default domain name, or a domain alias. Each Alibaba Cloud account can set a globally unique account alias in RAM. The account alias is primarily used for RAM user logon and appears as the display name after logon. Example:
|
Domain alias | If you own a domain name that can be resolved on the public Internet, you can use it to replace your default domain name. This domain name is referred to as a domain alias. It's essentially an alternative name for the default domain name. Note
|
Logon password | An identity credential used to log on to the Alibaba Cloud Management Console. It verifies the user's identity during the login process. Note
|
AccessKey pair | Consists of an AccessKey ID and an AccessKey Secret. These are used for identity verification when accessing Alibaba Cloud services.
Note The AccessKey Secret is only displayed at the time of creation, and cannot be retrieved afterward. We recommend storing it securely for future use. |
Multi-factor authentication (MFA) | A best practice that adds an additional layer of security beyond usernames and passwords. It enhances the protection of your account by requiring two forms of authentication. If MFA is enabled for a RAM user, they must perform the following steps when logging into the Alibaba Cloud Management Console:
This process ensures that even if a password is compromised, unauthorized access is significantly reduced. |
Service provider | A service provider (SP) is an application that uses the identity management function of an IdP to provide specific services to users. An SP uses the user information that is provided by an IdP. In specific identity systems that do not comply with the SAML protocol, such as OpenID Connect (OIDC), SP is known as the relying party of an IdP. |
Identity provider | An identity provider (IdP) is a RAM entity that contains metadata about an external IdP. An IdP provides identity management services.
|
Security Assertion Markup Language 2.0 (SAML 2.0) | Security Assertion Markup Language 2.0 (SAML 2.0) is a standard protocol for enterprise-level user authentication. It is one of the technical implementations for communication between SPs and IdPs. SAML 2.0 is a standard that enterprises use to implement enterprise-level SSO. |
Single sign-on | Alibaba Cloud supports SAML 2.0-based SSO, also known as identity federation. Enterprises can use a SAML 2.0-compliant IdP (such as AD FS) to implement SSO with Alibaba Cloud based on their needs. Alibaba Cloud provides the following two SAML 2.0-based SSO methods:
|
Metadata file | The metadata file that is provided by your IdP. The metadata file is in the XML format in most cases. The metadata file contains the logon URLs, the public key that is used to verify SAML assertions, and the assertion format. |
SAML assertion | A core element that is defined in the SAML protocol. This element describes the authentication request and response. For example, the SAML assertion for an authentication response can contain user attributes. |
Trust | A mutual trust relationship between an SP and an IdP. In most cases, the trust relationship is established by using public and private keys. An SP can obtain the SAML metadata of a trusted IdP. The metadata includes a public key. The SP uses the public key to verify the integrity of the SAML assertion that is issued by the IdP. |
Alibaba Cloud OAuth 2.0 service | Authenticates users, accepts user authorizations for applications, generates tokens that represent user identities, and returns the tokens to authorized applications. |
OAuth application | Obtains user authorization and tokens that represent user identities to access Alibaba Cloud. The OAuth 2.0 service currently supports the following application types:
|
OAuth scope | The OAuth 2.0 service uses OAuth scopes to limit the access range of applications that impersonate users to log on to Alibaba Cloud. |
Access policy | A policy is a set of permissions defined using a structured syntax. It precisely describes the resources, operations, and conditions for authorization. Policies serve as a standardized language format for defining access control rules. In RAM, a policy is a resource entity. RAM supports two types:
You can attach one or more policies to RAM users, user groups, or roles to grant them the specific access permissions defined in the policies. |
Permission | Refers to whether a user is allowed to perform a specific action on a resource. It can be either Allow or Deny. Its operations include the following two types:
|
Resource | An abstract representation of an entity object with which users interact in a cloud service, such as an OSS bucket or an ECS instance. |
Condition | A basic element of a policy. It specifies when the policy takes effect. |
Action | A basic element of a policy. It indicates an operation on a specific resource. Valid values are the names of operations from Alibaba Cloud services. |
Effect | A basic element of a policy. It indicates what the authorization does. Valid values are Allow and Deny. |
Principal | The permission principal defined in a policy. It can be a RAM user, user group, or role. |
Resource directory | Allows you to manage the relationships among a number of accounts and resources. |
Tag | Used to identify resources. They let you categorize, search for, and aggregate resources that have the same characteristics from different dimensions, facilitating resource management. |
System tag | A tag that is automatically defined by the system. You can view but cannot edit them. |
Custom tag | A tag defined by users. |
Tag key-value pair | Namely a tag key and a tag value, which are what comprise a key-value pair. |
Resource sharing | Allows you to share the resources of your Alibaba Cloud account with other accounts, and access those shared by other accounts. |
Resource owner | The initiator of resource sharing and the owner of shared resources. It's typically an enterprise management account or a member account in a resource directory. |
Shared resource | A resource of an Alibaba Cloud service. For example, a vSwitch in a virtual private cloud (VPC). |
Principal | The beneficiary of resource sharing. It has specific operation permissions on shared resources. A principal is typically one or more member accounts in a resource directory. Note The operation permissions of each principal on the shared resources are determined by the Alibaba Cloud service to which the resources belong. |
Resource share | An instance of the resource sharing service. It is also a resource and has a unique ID and an Alibaba Cloud Resource Name (ARN). A resource share consists of a resource owner, principals, and shared resources. |
Resource group | A mechanism for grouping resources under an Alibaba Cloud account. Resource groups help you manage resources for multiple projects, or applications within a single cloud account, simplifying user authorization management. |
Folder | An organizational unit within a resource directory. Typically used to represent a company's branch, business line, or product project. Each folder can contain member accounts and nested subfolders, forming a tree-like resource organization structure. |
Root folder | The top-level folder in a resource directory. It has no parent folder. Resource relationships are organized hierarchically starting from the root folder. |
Member account | In a resource directory, member accounts serve as resource containers and are a type of resource grouping unit. A member account typically represents a project or application. Resources within one member account are physically isolated from resources in other member accounts. You can use the enterprise management account to grant RAM users, user groups, or roles access to resources in member accounts. Member accounts are classified into the following types:
|
Management account | The super administrator of a resource directory, and the initial account that activates the resource directory. It has full control over the resource directory and member accounts it creates.
To ensure the security of your business, we recommend creating a new Alibaba Cloud account and using it exclusively as the enterprise management account. Alternatively, create a RAM user for the enterprise management account and grant this RAM user administrative permissions. Then, use it to manage the entire resource directory. All operations in a resource directory must be performed by the enterprise management account or a RAM user with the appropriate permissions. Note An enterprise management account is located outside of the resource directory. It is not subject to any management policies of the resource directory. |
ActionTrail | A service that monitors and records the operations of your Alibaba Cloud account. These operations include access to and use of cloud services through the Alibaba Cloud Management Console, OpenAPI, and developer tools. ActionTrail records these activities as events. You can download these events from the ActionTrail console, or configure ActionTrail to deliver them to Log Service Logstores or OSS buckets. Based on these events, you can then perform actions such as behavior analysis, security analysis, resource change tracking, and compliance auditing. |
Shadow trail | If you create a trail to track operations across multiple regions, ActionTrail creates trails with the same configuration in those regions to collect operation events. These trails are called shadow trails. |
Platform event trail | A trail created by an Alibaba Cloud account to record platform events. |
Multi-account trail | A trail created by a management account to record operations of all member accounts. A multi-account trail delivers operation events from all member accounts to the specified OSS bucket or SLS Logstore. |
Single-account trail | A trail created by an Alibaba Cloud account to record operations of the current account. |
Trail | By creating a trail, you can save operation events to a specified OSS bucket or SLS Logstore for further analysis and storage. Based on the creator and scope, trails are categorized into single-account, multi-account, and platform event trails. |
Home region | The region where a trail is created. |
Global event | An operation event of a global service. On the Event Query page of the ActionTrail console, you can view all global events regardless of the selected region. However, when global events are delivered to a user-configured OSS bucket, they are stored in the same directory as events from the trail's home region. |
Global service | A global service, such as RAM, applies to all regions of Alibaba Cloud. Global services generate global events. |
Platform event | An event generated when the Alibaba Cloud O&M team performs maintenance operations on user services. You can create a platform event trail to deliver these events to a storage service. |
Operation event | A record of user activity when accessing and managing cloud services through the Alibaba Cloud Management Console, OpenAPI, or developer tools. Operation events include information such as time, personnel, resources, operation type, operation result, and source IP address. |
Cloud Config | A resource audit service that provides capabilities such as tracking resource configuration history and conducting configuration compliance audits. Cloud Config helps you manage large numbers of resources and maintain continuous compliance of your cloud infrastructure. |
Enterprise Edition of Cloud Config | Enterprise customers who use multiple management accounts in the cloud can upgrade to the Enterprise Edition of Cloud Config for centralized compliance management across accounts. When integrated with Resource Directory, Cloud Config allows enterprise customers to perform compliance audits on resource configurations of all member accounts from the management account. |
Personal Edition of Cloud Config | If you do not need cross-account compliance management, you can use the Personal Edition of Cloud Config to manage compliance audits for resources under a single Alibaba Cloud account. |
Classified protection precheck | Classified protection 2.0 precheck is a cloud-based compliance detection that dynamically and continuously checks the compliance of resources on Alibaba Cloud. This helps you avoid repeated remediation during formal inspections and quickly pass classified protection inspections. |
Compliance timeline | Rules are triggered when resource configurations change. Each configuration timeline has a corresponding compliance timeline, which is a historical record of each compliance evaluation result. The compliance records displayed in the compliance timeline depend on the trigger type:
|
Rule | A function used to determine whether a resource configuration is compliant. Cloud Config runs rule code using functions from Function Compute. When a rule is applied to a resource type in Cloud Config, any configuration change to a resource of that type triggers an evaluation based on the rule to check compliance. Cloud Config can also trigger rules at specified times to periodically evaluate the compliance of all resources. The rules in Cloud Config are divided into the following categories:
|
Configuration timeline | Cloud Config provides a configuration timeline for each monitored resource.
|
Monitoring scope | Defines the types of resources to be monitored.
|
Resource configuration | Cloud Config retrieves all your resources by using the APIs provided by Alibaba Cloud services. In the resource list, you can click a resource ID to view its configuration details. You can also manage the resource through the Alibaba Cloud Management Console. |
Resource type | A category of resources, such as ECS instances. Resources can be classified into the following types:
|
Cloud Enterprise Network (CEN) | A highly available network built on Alibaba Cloud's high-performance, low-latency private network. It helps establish private network connections between VPCs in different regions, and between VPCs and on-premises data centers. Through automatic route distribution and learning, CEN accelerates network convergence and improves the quality and security of cross-network communication. It enables full connectivity among all network resources, helping you build an enterprise-scale network with strong communication capabilities. |
Transit router | A CEN instance creates a transit router in each region, serving as the network management and operations center for that region. A transit router connects network instances within the same region, and acts as a bridge for communication between network instances in the same or different regions. Transit routers support features such as route tables, routing policies, and cross-region connections. You can use them to add routes, set routing policies, and meet various networking and management requirements. |
Virtual private cloud (VPC) | A custom private network created by users based on Alibaba Cloud. Different VPCs are logically isolated at Layer 2. Users can create and manage cloud product instances in their own VPCs, such as ECS, Server Load Balancer (SLB), and ApsaraDB RDS. A VPC is a private network dedicated to the user. You can configure the CIDR block, route tables, and gateways of your VPC. Alibaba Cloud services you can use within a VPC include ECS, SLB, and ApsaraDB RDS. |
vSwitch | A basic network device that composes a VPC, and is used to connect different cloud resource instances. A VPC is a regional resource and cannot span multiple regions, but it includes all availability zones within its region. You can create one or more vSwitches in an availability zone to define subnets within the VPC. |
Express Connect | Establishes private network communication channels between on-premises data centers and CEN in the cloud, providing customers with flexible, high-quality, and secure cross-network communication links. |
Smart Access Gateway (SAG) | A comprehensive solution that enables enterprises to connect their workloads to Alibaba Cloud. Enterprises can use SAG to implement encrypted access from nearby Internet locations, offering a more intelligent, reliable, and secure cloud experience. |