Realtime Compute for Apache Flink is fully compatible with Apache Flink APIs and provides security hardening across access control, network, storage, backup and restoration, and ActionTrail.
Tenant isolation
Realtime Compute for Apache Flink supports multi-tenant scenarios. Each Alibaba Cloud account authenticates using symmetric encryption based on AccessKey pairs, which signs every HTTP request. Data for different users is isolated and stored separately in a distributed file system, achieving real multi-tenant resource isolation that supports multi-user collaboration, data sharing, data confidentiality, and data security.
Access control
Multi-dimensional access control methods are provided to ensure data security. Use RAM to manage account-level permissions, namespace permissions to manage team-level access within a shared workspace, and whitelists and Kerberos authentication to secure connections to upstream and downstream systems.
RAM
RAM lets you control what operations different RAM users can perform on Realtime Compute for Apache Flink resources. RAM users can also log in to the Flink console as members of a resource directory, including as CloudSSO users. For details, see What is RAM? and Authorization overview.
Namespace permission management
Within a namespace, define roles and configure fine-grained permissions to control what different users can do during deployment development and O&M. This is useful when multiple users share the same namespace. For details, see Development console permissions.
Whitelist
By default, upstream and downstream storage systems deny access from external sources. Add the CIDR block of the Realtime Compute for Apache Flink vSwitch to the whitelist of each associated storage system. If the vSwitch is not in the same zone as the storage system, add the CIDR block to establish the network connection. For details, see Network connectivity FAQ.
Kerberos authentication for Hive clusters
Kerberos is a computer-network authentication protocol used for identity authentication to ensure the security of communication. If your deployment accesses a Hive cluster that uses Kerberos authentication, register the Kerberos-secured Hive cluster in the Realtime Compute for Apache Flink console and configure it in the deployment. For details, see Register a Kerberized Hive cluster.
Network isolation
Realtime Compute for Apache Flink can connect to upstream and downstream storage services over a virtual private cloud (VPC) or the Internet. To ensure security, we recommend using VPCs. You can also manage the domain names of upstream and downstream storage services in the Realtime Compute for Apache Flink console.
| Connection method | Recommendation | Use case |
|---|---|---|
| VPC | Recommended | All production workloads — private, isolated, high security |
| Internet via NAT gateway | Not recommended | When VPC access is not suitable |
VPCs
A VPC is a private network isolated from other networks at the network layer on top of physical-layer protocols. It provides high security, reliability, and flexibility. For details, see What is VPC?.
Internet access
Use the Alibaba Cloud Network Address Translation (NAT) gateway to connect a VPC to the Internet, allowing Realtime Compute for Apache Flink to reach upstream and downstream services over the Internet. We discourage you from using this access method. For details, see Network connectivity FAQ.
Domain name management
Manage the domain names of upstream and downstream services directly in the Realtime Compute for Apache Flink console.
Encryption
Variable management
Store AccessKey pairs and other credentials as variables instead of embedding them as plaintext in your code or configuration. Variables work across SQL draft development, JAR or Python deployments, log export configuration, and UI-based parameter setups. This reduces both security risk and configuration redundancy. For details, see Variable management.
Backup and restoration
Realtime Compute for Apache Flink uses a storage and computing separation architecture, storing checkpoints, savepoints, logs, and JAR packages in Object Storage Service (OSS). The service creates separate directories in the associated OSS bucket, with a default retention period of seven days. For details on workspace configuration, see Create a workspace.
Data restoration
Three savepoint options are available for restoring deployments:
Manual savepoints: Create a savepoint at any point while a deployment is running or after it is canceled. Use this for data restoration, quick business deployment, or data verification. See Manually create a job snapshot.
Scheduled savepoints: Define a savepoint creation cycle so the system automatically creates savepoints while the deployment runs. See Configure scheduled automatic creation of job snapshots.
Cross-deployment restore: Restore a deployment from a savepoint created by a different deployment. Before doing this, run a dual-run test to verify that the state data between the two deployments is compatible. See Restore a job from a specified snapshot (including from another job).
Deployment status backup
To view the status set of a deployment, go to the Deployments page, click the deployment name, and then click the Status tab on the deployment details page. For details, see View the state generation overview.
Cross-zone high availability
Cross-zone high availability (HA) enables disaster recovery between zones within a region. In a namespace configured with cross-zone compute units (CUs), the service automatically fails over to a secondary zone if the primary zone encounters a fault, keeping deployments running without interruption. For details, see Enable/Disable cross-zone HA.
ActionTrail
ActionTrail records operations performed on your Alibaba Cloud account through the Alibaba Cloud Management Console, APIs, and SDKs. Each recorded operation is stored as an event, which you can download or deliver to Simple Log Service (SLS) Logstores or OSS buckets for behavior analysis, security analysis, resource change tracking, and compliance auditing.
Realtime Compute for Apache Flink integrates with ActionTrail. View resource operation events in the ActionTrail console free of charge. For details, see What is ActionTrail? and View audit events.