By Jeremy Pedersen
Welcome back for the 10th installment in our weekly Q&A blog series! In this week's column, we'll take a look at questions from trainings past. Read on.
Great question. aliyun.com is Alibaba Cloud's mainland China website, while alibabacloud.com is our portal for users from everywhere else.
Both of these websites have access to the same set of Alibaba Cloud regions and zones, but there are some important differences. I've summarized them here:
It's also worth noting that when new products are launched, they usually go live on aliyun.com first, and aliyun.com offers some services that have no direct equivalent outside China (for instance, the aliyun.com marketplace offers a service to verify Chinese ID cards).
However, unlike some other major cloud providers, Alibaba Cloud's account system is a unified account system. This means that - regardless of whether you sign up for aliyun.com or alibabacloud.com - you will have full access to every Alibaba Cloud region.
The most restrictive policy wins! RAM uses "Deny first" logic, when applying policies to RAM users, groups, and roles.
Let's examine a simple case. We have a RAM user, let's call her Stephanie. Stephanie has two policies bound to her RAM user account. The first one is an "Allow everything" policy, which looks like this:
{
"Statement": [
{
"Action": "*",
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "1"
}The second policy is a "Deny everything" policy, which looks like this:
{
"Statement": [
{
"Action": "*",
"Effect": "Deny",
"Resource": "*"
}
],
"Version": "1"
}So what will happen when Stephanie logs into the Alibaba Cloud console? What actions will she be allowed to perform?
Can she create a VPC group? Nope:
Can she manage Resource groups? Also no:
Here we see RAM's "Deny first" policy evaluation logic in action. Although this user has both an "Allow all" and a "Deny all" policy attached, the "Deny" policy takes precedence, so our user isn't able to do anything.
Not all of the features of security center are free. When this happens, it means you've tried to use a feature that isn't included in your current plan, and you need to upgrade to use it!
Security Center has quite a lot of different features, and there's no need to turn on every single feature. You should consider carefully what your security needs are before you purchase any additional features.
There's a table here (click on "Pricing") which summarizes the features included in each Security Center Edition.
No, Alibaba Cloud is not a CA, because the certificates we issue are generated and signed by our partners, such as GlobalSign or Entrust. We help automate the process of applying for (and deploying) SSL certificates, but we don't generate them directly. Don't worry, though: any SSL certificate that you manage from within Alibaba Cloud's SSL Certificate Service can be one-click deployed onto Alibaba Cloud Server Load Balancer, CDN, or other supported web-facing Alibaba Cloud services.
For more information about what types of SSL certificates we support (as well as who generates them for us), look here.
You can enable ActionTrail trails for a single Alibaba Cloud account or for multiple accounts.
Log Service does have some support for regular expressions, but the native query and analysis syntax for Log Service looks more like SQL. You can learn more about how log search works here and there's information about the Log Service query language here
If you have enabled indexing and full-text search, then you can search for just about anything in Log Service: it's just a matter of asking it the right questions!
Cloud Config is a "global" service, which means it applies to all resources under your account. However, when you write custom Cloud Config rules, you can of course create different rule-sets for different regions. For instance, you could create a rule that only checks the Security Group configurations for ECS instances in the Singapore region, if you wanted.
See this page to learn how to create a Cloud Config rule.
Whew, finally an easy question! Yes, it is enabled by default. Users don't have to do anything to turn on this basic DDoS protection: it's built right into the Alibaba Cloud platform, and applies across every Alibaba Cloud region.
## I've Got A Question!
Great! Reach out to me at jierui.pjr@alibabacloud.com and I'll do my best to answer in a future Friday Q&A blog.
You can also follow the Alibaba Cloud Academy LinkedIn Page. We'll re-post these blogs there each Friday.
JDP - May 7, 2021
JDP - June 4, 2021
JDP - March 26, 2021
JDP - May 14, 2021
JDP - April 9, 2021
JDP - April 30, 2021
Fortinet Security Solution on Alibaba Cloud
Native integration with Fortinet to provide advanced multi-layered security on the cloud.
Learn More
Security Solution
Alibaba Cloud is committed to safeguarding the cloud security for every business.
Learn More
Log Service
An all-in-one service for log-type data
Learn More
CEN
A global network for rapidly building a distributed business system and hybrid cloud to help users create a network with enterprise level-scalability and the communication capabilities of a cloud network
Learn MoreMore Posts by JDP
