Onboarding guide

Alibaba Gov Cloud uses cluster deployments in independent data centers. Regions are deployed based on customer demand. The China (North) 2 - Alibaba Gov Cloud 1 region is currently available. This region:

• Includes four zones: China (North) 2 - Alibaba Gov Cloud 1 Zone A (cn-north-2-gov-1a), China (North) 2 - Alibaba Gov Cloud 1 Zone B (cn-north-2-gov-1b), China (North) 2 - Alibaba Gov Cloud 1 Zone C (cn-north-2-gov-1c), and China (North) 2 - Alibaba Gov Cloud 1 Zone D (cn-north-2-gov-1d).

• Uses a VPC network environment and supports custom network addresses.

• You can access Alibaba Gov Cloud services over the Internet, or connect to the platform using a leased line or VPN.

To use Alibaba Gov Cloud, you must register a dedicated Alibaba Cloud account and then complete identity verification and Gov Cloud authentication. After an account is authenticated for Alibaba Gov Cloud, it can no longer be used to access public cloud resources. When you register an Alibaba Gov Cloud account, take note of the following:

• Account isolation:

  • The Alibaba Gov Cloud platform uses account isolation to separate environments. This means that cloud resources in different accounts are isolated from each other.

  • We recommend that you use separate Alibaba Cloud accounts for different environments, such as production, pre-production, User Acceptance Testing (UAT), and development/integration testing.

• Gov Cloud authentication:

  • A single business entity can authenticate multiple Gov Cloud accounts.

  • Accounts that are successfully authenticated for Alibaba Gov Cloud cannot be used to access public cloud resources.

  • If you use a public cloud account for Gov Cloud authentication, you must first release all public cloud resources in that account.

  • For easier account management, we recommend that you request a new Alibaba Cloud account for your Alibaba Gov Cloud services.

Alibaba Gov Cloud implements strict risk control measures that comply with government industry standards. The following restrictions apply to Internet access:

• Accessing the console: To access the web console, you must enable multi-factor authentication (MFA). After you enter your username and password, you must authenticate again using a dynamic key.

• Remote Operations and Maintenance (O&M): To perform remote O&M operations on an ECS instance, you must enable MFA and configure the necessary security group rules.

• You cannot use a private IP address allocated by Alibaba Gov Cloud to directly access an RDS instance. RDS instances can be accessed only from ECS instances in the same private network.

• Accessing cloud products from the Internet: Alibaba Gov Cloud restricts network access by direction and port. The methods for accessing the Internet differ from those on the public cloud:

  • If an ECS instance needs to initiate outbound Internet access, you must assign public bandwidth to it. If outbound Internet access is not required, set the bandwidth to 0.

  • For Server Load Balancer, only the following ports can be exposed to the Internet: 80, 443, 2800-3300, 5000-10000, 13000-14000, 21234, 22223, and 22225.

You must comply with all national and industry laws, regulations, and directives related to data security and privacy protection. Alibaba Cloud provides a range of services and features with configuration options that you can use to implement various levels of control. You are responsible for managing your network and data security risks, such as system vulnerabilities, computer viruses, network attacks, network intrusions, and data breaches. You must create your own cloud security policies and ensure that your cloud product configurations comply with these policies to prevent, monitor, and respond to these risks.