Working on Alibaba Cloud: ECS, RAM Users, Security and Billing
Alibaba Cloud’s core services and AI platform, the RAM and MFA security baseline, session and logon controls, and how pay-as-you-go and subscription billing compare.
Alibaba Cloud is the largest cloud provider in Asia and a serious option for teams that need presence in China and the wider region, or want access to the Qwen family of open models. This guide covers the core services, the security baseline built around Resource Access Management (RAM), the account controls that are specific to Alibaba Cloud, and how billing works. For ECS, OSS and regions, start with our Alibaba Cloud fundamentals guide.
What you can build on Alibaba Cloud #
| Service | What it does |
|---|---|
| Elastic Compute Service (ECS) | Cloud servers on recent CPUs and high-speed memory, deployable in a few clicks and scalable on demand |
| Qwen (Tongyi Qianwen) models | Alibaba’s open large language models, among the most downloaded open-source LLMs |
| Platform for AI (PAI) | A machine learning and deep learning platform covering labeling, modeling, training, optimization and deployment |
| Model Studio (Bailian) | Build generative AI applications on Qwen-Max, Qwen-VL and other models, with workloads isolated in VPC environments |
| Storage and databases | Object Storage Service (OSS), block storage and a database portfolio recognized as a leader in Gartner’s Magic Quadrant for Cloud Database Management Systems for four consecutive years |
| Network and CDN | Low-latency global networking and a CDN with more than 3,200 nodes |
| Security services | End-to-end protection recognized by authorities in China and overseas |
Developers use ECS and OSS for applications with an Asian user base; businesses use it for regional expansion; AI teams use PAI and Model Studio, often starting with the free trial tokens Alibaba Cloud offers for its models. Our comparison of AI infrastructure across providers shows how these fit alongside AWS, Google Cloud and Azure.
Securing an Alibaba Cloud account #
- Enable multi-factor authentication (MFA) on the Alibaba Cloud account. MFA adds a dynamic code from a mobile token or hardware key on top of the password.
- Set a complex password and rotate it. Weak passwords are a primary cause of account breaches; Alibaba Cloud recommends changing passwords every 90 days.
- Create RAM users for team members. Give each person a separate RAM user with limited permissions instead of sharing the account credentials, which isolates risk.
- Use ECS RAM roles instead of AccessKeys. Applications on ECS that call Alibaba Cloud APIs should assume a RAM role rather than hold a long-term AccessKey, which prevents credential leakage.
- Set billing alerts in the Expenses and Costs console.
- Configure a logon mask (IP whitelist) if your team works from static public addresses, so only those addresses can log on to the console.
- Review security group rules to control inbound and outbound traffic to ECS instances.
Management essentials #
- Resource groups and tags organize resources by project, environment or department and make cost allocation possible.
- Cost monitoring in the Expenses and Costs console, with alerts at thresholds that matter.
- Least privilege through RAM policies attached to users and roles.
- Session duration: the default console session is 48 hours; it can be set from 1 to 72 hours depending on your security requirements.
- Backups: automated snapshots for ECS disks and backups for databases, with a tested restore.
How Alibaba Cloud billing works #
| Model | How it works |
|---|---|
| Pay-as-you-go | Hourly billing that starts when an instance is created and stops when it is released; usage under an hour is billed as a full hour |
| Subscription | Prepay for a term at a discount compared with pay-as-you-go |
| Free trial | New users may receive trial credits, and Alibaba Cloud has offered a large allowance of free tokens for its AI models, under its current terms |
| Payment methods | Credit cards, PayPal and other methods depending on country and region |
Cost habits: set billing alerts, right-size instances, release instances you no longer need (stopped pay-as-you-go instances may still bill for disks and IPs), use subscriptions for long-running baseline capacity, and watch outbound traffic.
How teams use Alibaba Cloud #
Developers use ECS and OSS for applications serving Asian regions, with RAM users to keep projects and clients separate. Startups build on managed databases and the CDN for regional reach. Application teams combine ECS or container services with Server Load Balancer and OSS for assets. AI teams start in Model Studio with Qwen models, then move custom training to PAI. Agencies have each client own their account and grant the agency a RAM user, which keeps real-name verification and billing with the client.
A first-week checklist #
- Enable MFA, set a strong password and configure a logon mask if you work from fixed addresses.
- Create RAM users and groups for teammates with least-privilege policies.
- Attach RAM roles to ECS instances that call APIs; do not store AccessKeys on servers.
- Set billing alerts in the Expenses and Costs console.
- Tighten security group rules to the ports the application needs.
- Schedule snapshots for ECS disks and test a restore.
Official references #
The Alibaba Cloud documentation covers ECS, RAM, billing and security settings. Our Alibaba Cloud platform overview summarizes the platform and how to sign up officially.
Frequently asked questions #
Can I send email from an Alibaba Cloud ECS instance?
Port 25 is disabled by default on ECS for security reasons. Send through port 465 with SSL to an authenticated mail service, or use an email API provider. See SMTP port 25 on cloud servers.
How do I manage my Alibaba Cloud account?
Through the console, or the Alibaba Cloud CLI and SDKs for automation. RAM users and roles handle team access.
Why avoid AccessKeys on ECS?
A long-term AccessKey stored on a server can be leaked. An ECS RAM role provides short-lived credentials automatically, so there is nothing to leak.
