Skip to main content

Alibaba Cloud

Visualize Alibaba Cloud resources and monitor changes through queries and alerts.

Installation​

To install this integration, you will need to configure settings both within Alibaba Cloud and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your Alibaba account.

Configuration on Alibaba Cloud​

An AccessKey and Secret Key are required for the JupiterOne integration to interact with Alibaba Cloud's API.

In order to obtain an Access Key ID/Secret combination for the integration, an administrator of the Alibaba Cloud account will need to create a new RAM user the integration can use. Additionally, the user will need to have Read Only access to the account.

To do so, the administrator can:

  1. Navigate to the RAM page in the Alibaba Cloud console.
  2. Select Create User. We suggest the name of the user include JupiterOne.
  3. Check the Open API Access option while creating the new user.
  4. Obtain the Access Key ID/Secret combination that is generated.
  5. Grant the new user the ReadOnlyAccess permission.
info

For more information, refer to Alibaba Cloud's documentation for creating a RAM user or for generating the AccessKey ID and Secret Key.

Ingesting multiple accounts with a Resource Directory (optional)​

If your accounts are organized in an Alibaba Cloud Resource Directory, you can point a single JupiterOne integration instance at the management account and have JupiterOne automatically create and maintain a separate integration instance for each member account. There is no need to create a RAM user or an integration instance in every account.

This works by having the management account's RAM user assume a role in each member account:

  • When an account is created in or invited to a Resource Directory, Alibaba Cloud automatically creates a RAM role named ResourceDirectoryAccountAccessRole in that member account and grants the management account permission to assume it. This is the role JupiterOne assumes by default. See Alibaba Cloud's RAM roles in a resource directory for details.
  • Create the RAM user and AccessKey (as described above) in the management account. In addition to ReadOnlyAccess, this user needs permission to view the Resource Directory (for example, AliyunResourceDirectoryReadOnlyAccess) and permission to assume the member-account role via STS AssumeRole.

To exclude a specific member account from ingestion, add a tag with the key JupiterOne and the value SKIP to that account in the Resource Directory. JupiterOne skips tagged accounts and does not create an instance for them.

Configuration in JupiterOne​

To install the Alibaba Cloud integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Alibaba Cloud. Click New Instance to begin configuring the integration.

Creating an Alibaba Cloud instance requires the following:

  • The Account Name used to identify the Alibaba Cloud account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • Enter the Alibaba Cloud AccessKey ID and Secret Key generated for use by JupiterOne.

Click Create once all values are provided to finalize the integration.

Resource Directory settings (optional)​

To ingest every account in a Resource Directory from this instance (see Ingesting multiple accounts with a Resource Directory above), configure the following on the management account's instance:

  • Configure Resource Directory Accounts — When enabled, JupiterOne enumerates the accounts in the Resource Directory reachable from this instance's credentials and automatically creates a child integration instance for each account (except those tagged JupiterOne:SKIP). Child instances inherit their configuration from this instance. Do not enable this setting together with Account ID — the Resource Directory parent must run without an Account ID.

  • Resource Directory ID — Optionally pin the expected Resource Directory ID. If the ID does not match the directory reachable from this instance's credentials, JupiterOne stops instead of configuring instances against the wrong directory.

  • Auto-delete Removed Accounts — When enabled, JupiterOne automatically deletes the child instances it created for accounts that have since been removed from the Resource Directory. Defaults to disabled.

  • Role Name to Assume in Member Accounts — The name of the RAM role JupiterOne assumes in each member account. Defaults to ResourceDirectoryAccountAccessRole, which Alibaba Cloud creates automatically in each member account. Override this only if you use a custom role.

note

The Account ID field is set automatically on the child instances that the parent creates; you do not need to set it yourself. Child instances are managed automatically — avoid editing them manually.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.