The RAM user only needs the built-in
ReadOnlyAccess policy. TigerGate can
never create, modify, or delete resources in your account.Alibaba Cloud is connectable and scannable, but its checks are not yet listed
in the Cloud Security → Checks catalog the way AWS, Azure, GCP, and others
are.
Before you start
In TigerGate, go to Integrations → Cloud Providers and choose Alibaba Cloud. You’ll fill in three values once the RAM user exists:| Value | What it is |
|---|---|
| AccessKey ID | The RAM user’s AccessKey ID. |
| AccessKey Secret | The RAM user’s AccessKey Secret — from the same key pair. |
| Region ID | Default region for API calls (e.g. cn-hangzhou). |
1. Create the RAM user
Create the user
In the RAM Console → Identities →
Users → Create User, name it
tigergate-cspm-scan and enable
OpenAPI Access (this generates an AccessKey pair, not console
access).Attach the read-only policy
On the user’s Permissions tab, click Add Permissions and attach
the system policy
ReadOnlyAccess.2. Connect it in TigerGate
Paste the keys and region
In Integrations → Cloud Providers → Alibaba Cloud, enter the
AccessKey ID, AccessKey Secret, and a Region ID (e.g.
cn-hangzhou, ap-southeast-1).Test
Click Test. TigerGate confirms the AccessKey ID, AccessKey Secret,
and Region ID are all present and marks the connection connected. A
live Alibaba Cloud auth round-trip isn’t performed at this step yet, so
a present-but-invalid or revoked key is only surfaced when a scan runs.
Troubleshooting
The Test button only checks that all three fields are filled in. The Alibaba API errors below surface when a scan actually runs against your account.| Error | When | Cause | Fix |
|---|---|---|---|
Alibaba Cloud requires: access_key_id, access_key_secret, region_id | Test | One or more fields left blank | Fill in all three values |
InvalidAccessKeyId.NotFound | Scan | AccessKey ID is wrong or was deleted | Re-check the ID, or generate a new AccessKey pair |
SignatureDoesNotMatch | Scan | Wrong/rotated AccessKey Secret | Re-copy both values from the same key pair |
Forbidden.RAM on read calls | Scan | ReadOnlyAccess policy not attached | Attach it under the RAM user’s Permissions tab |
| Scan runs but few findings | Scan | Region ID doesn’t match where resources live | Alibaba Cloud is region-scoped per API — confirm resources actually live in the configured region |