Environment variables for Alibaba Cloud CLI - Alibaba Cloud CLI

The Alibaba Cloud CLI supports configuring credentials, region, behavior options, and other runtime parameters using environment variables. In CI/CD pipelines, container environments, or automation scripts, environment variables are the preferred method for passing credentials and runtime configuration. This topic lists all supported environment variables and explains their priority order to help you quickly locate the required configuration items.

Priority order

When reading configuration, the Alibaba Cloud CLI applies settings in the following priority order, from highest to lowest:

Command-line parameters (such as --profile and --region)
Configuration file (~/.aliyun/config.json)
Environment variables

For more information, see Understand command-line parameters.

Credentials and identity

Use environment variables to configure credential information such as AccessKey, Security Token Service (STS) token, OpenID Connect (OIDC), and RAM roles without storing secrets in plaintext in configuration files.

Environment variable	Description
`ALIBABA_CLOUD_ACCESS_KEY_ID`	AccessKey ID.
`ALIBABA_CLOUD_ACCESS_KEY_SECRET`	AccessKey secret.
`ALIBABA_CLOUD_SECURITY_TOKEN`	STS temporary security token. Use together with AccessKey ID and AccessKey secret.
`ALIBABA_CLOUD_CREDENTIALS_URI`	Credential service endpoint for CredentialsURI mode. No alias available.
`ALIBABA_CLOUD_OIDC_PROVIDER_ARN`	ARN (Alibaba Cloud Resource Name) of the OIDC identity provider.
`ALIBABA_CLOUD_OIDC_TOKEN_FILE`	Path to the OIDC token file.
`ALIBABA_CLOUD_ROLE_ARN`	RAM role ARN, used with RamRoleArn and ChainableRamRoleArn authentication modes.
`ALIBABA_CLOUD_EXTERNAL_ID`	External ID, used in cross-account role assumption scenarios.
`ALIBABA_CLOUD_SSO_CLIENT_ID`	Cloud SSO OIDC client ID. When set, it overrides the default client ID built into the CLI.

For configuration methods and applicable scenarios for each credential type, see Configure credentials.

Profile selection

Control which profile the CLI uses.

Environment variable	Description
`ALIBABA_CLOUD_PROFILE`	Specifies the profile name to use. Equivalent to the `--profile` parameter.
`ALIBABA_CLOUD_IGNORE_PROFILE`	When set to `TRUE` (must be uppercase and is case-sensitive), the CLI ignores profiles in the configuration file and uses only credentials provided by environment variables.

Region and endpoint

Environment variable	Description
`ALIBABA_CLOUD_REGION_ID`	Default region ID, such as `cn-hangzhou`.
`ALIBABA_CLOUD_ENDPOINT`	Custom API endpoint address. When set, the CLI sends requests directly to this address and skips automatic endpoint resolution.
`ALIBABA_CLOUD_ENDPOINT_TYPE`	Endpoint type. For example, set to `vpc` to use a VPC private network endpoint. Leave empty or unset to use the public network endpoint.

Plugin management

Control plugin auto-installation behavior, storage location, and download source.

Environment variable	Description
`ALIBABA_CLOUD_CLI_PLUGIN_AUTO_INSTALL`	When set to `true`, the CLI automatically installs missing plugins when invoking plugin commands.
`ALIBABA_CLOUD_CLI_PLUGIN_AUTO_INSTALL_ENABLE_PRE`	When set to `true`, allows automatic installation of pre-release plugin versions.
`ALIBABA_CLOUD_CLI_PLUGINS_DIR`	Custom plugin installation directory. Default is `~/.aliyun/plugins/`.
`ALIBABA_CLOUD_CLI_PLUGIN_NO_CACHE`	When set to `true` or `1`, bypasses the plugin index cache and fetches the latest index from the remote source every time.
`ALIBABA_CLOUD_CLI_PLUGIN_SOURCE_BASE`	Base URL for a custom plugin download source. Useful in private network environments or private image scenarios.

Network, timeout, and language

The CLI automatically passes the following settings from the current profile to plugin child processes. To adjust timeout and retry policy, use the aliyun configure command or edit the configuration file directly.

Environment variable	Description
`ALIBABA_CLOUD_READ_TIMEOUT`	I/O read timeout, in seconds.
`ALIBABA_CLOUD_CONNECT_TIMEOUT`	Connection timeout, in seconds.
`ALIBABA_CLOUD_RETRY_COUNT`	Number of retries on request failure.
`ALIBABA_CLOUD_LANGUAGE`	CLI language setting. Valid values are `en` (English) or `zh` (Chinese).