Consolidate from multiple accounts to a single account - Cloud Firewall

Background

As organizations expand their presence on the cloud, managing a growing number of resources, projects, and permissions becomes increasingly complex. A single account can no longer handle the operational load, making a multi-account strategy essential. This necessitates centralized management of resources across accounts, especially for security, compliance, networking, and operations.

To meet these requirements, Cloud Firewall uses the trusted service feature of Alibaba Cloud Resource Directory. This allows you to group multiple Alibaba Cloud accounts into a single resource directory, where each account is a member account. You can then designate one member as a delegated administrator account. This account is authorized to access the resources of all other member accounts within the resource directory. This setup enables centralized traffic protection, policy configuration, traffic analysis, intrusion prevention, attack defense, threat detection, and log auditing for the Internet assets and VPC assets across all your accounts.

Before you begin, understand the following account roles:

Account type	Description	Resource directory permissions	Cloud Firewall permissions
management account	Can invite other Alibaba Cloud accounts that are not in a resource directory to join as members for centralized management.	Has administrative permissions for all assets of the enterprise.	Can manage all assets protected by Cloud Firewall.
delegated administrator account	A member account that the management account designates to manage a specific trusted service. Once designated, the delegated administrator account can access organization and member information and manage the service across the entire resource directory. Note Using a delegated administrator account separates organization management tasks from service management tasks. The management account performs organization tasks, while the delegated administrator account performs service-specific tasks for the trusted service.	Has administrative permissions for all assets of the enterprise.	Can manage all assets protected by Cloud Firewall.
member account	An account invited by the management account that has joined the resource directory.	Can manage only its own assets.	Cannot purchase or enable Cloud Firewall.

Use case

An enterprise has separate Cloud Firewall instances for Alibaba Cloud account A, Alibaba Cloud account B, and Alibaba Cloud account C. This setup increases management complexity and administrative overhead. To simplify operations, the enterprise decides to use the Cloud Firewall multi-account management feature. They designate Alibaba Cloud account A as the delegated administrator account, making Alibaba Cloud accounts B and C member accounts. As a result, only Alibaba Cloud account A needs a Cloud Firewall instance, which is then shared with accounts B and C.

Prerequisites

A Resource Directory is enabled for the management account. For more information, see Enable a resource directory.
You have activated a Cloud Firewall subscription (Advanced, Enterprise, or Ultimate Edition) or the pay-as-you-go edition for Alibaba Cloud account A. For more information, see Subscription 2.0.

Note
Currently, only the subscription editions of Cloud Firewall support multi-account management. Ensure the account you select as the delegated administrator account uses a supported edition. Different subscription editions support different numbers of member accounts. For more information, see Subscription 2.0.

If the default number of supported member accounts does not meet your needs, you can upgrade your Cloud Firewall edition to increase the limit.

Step 1: Invite members to Resource Directory

The management account can invite Alibaba Cloud accounts from outside the Resource Directory to join as member accounts for centralized resource management.

Log on to the Resource Directory console by using the management account.
In the left-side navigation pane, choose Resource Directory > Invite.
Click Invite Member Account.
In the Invite Member Account panel, enter the IDs of Alibaba Cloud account A, Alibaba Cloud account B, and Alibaba Cloud account C in the ID or Email Address of Invited Account field. Then, review and select the risk notification checkbox.

Note
Use the email address that you used to register the account, not a secondary email address bound to the account later. You can invite multiple Alibaba Cloud accounts at once by separating their account IDs or login emails with commas (,).
Click OK.

Step 2: Add a delegated administrator for Resource Directory

Using a delegated administrator account separates organization management tasks from service management tasks. The management account performs organizational tasks in Resource Directory, while the delegated administrator account performs service-specific tasks for a trusted service. In this scenario, Alibaba Cloud account A is the delegated administrator account.

Log on to the Resource Directory console by using the management account.
In the left-side navigation pane, choose Resource Directory > Trusted Services.
On the Trusted Services page, find the trusted service for Cloud Firewall and click Manage in the Actions column.
In the Delegated Administrator Account section, click Add.
In the Delegated Administrator Account panel, select the ID of Alibaba Cloud account A.
Click OK.

After you add the account, it can access the multi-account management module of the trusted service and perform management operations across the entire resource directory.

Step 3: Unsubscribe or release Cloud Firewall for members

Because member accounts cannot have their own Cloud Firewall instances, you must unsubscribe from or release the instances for accounts B and C before they can join account A. Follow the steps below based on your billing method (subscription or pay-as-you-go). Before you proceed, review the following notes and refund rules. For detailed refund rules, see Self-service unsubscription.

Notes

After you unsubscribe from or release an instance, assets previously protected by the Internet firewall will no longer be protected.
If you have a VPC firewall enabled, you must disable it before you can unsubscribe from or release Cloud Firewall. Disabling the firewall removes protection from your services. This process may cause business interruptions due to route switching. We recommend that you perform this operation during off-peak hours.
Unsubscribing from or releasing an instance deletes all existing access control and intrusion prevention policies.

Unsubscribe from a subscription Cloud Firewall

Perform the following steps for both Alibaba Cloud account B and Alibaba Cloud account C:

Go to the Resource Unsubscription page and click the Unsubscribe from Resource tab.
On the Unsubscribe from Resource tab, click Regular Cloud Products and select Partial Unsubscription.
Locate the subscription Cloud Firewall instance and click Unsubscribe from Resource in the Operation column.
On the Unsubscribe from Resource page, confirm the resource information and set the Reason for Unsubscription. Then, read and select I have carefully read the Unsubscription Rules and confirm the refund amount and I confirm that the data of the unsubscribed instance has been backed up and migrated.
Click Unsubscribe Now. In the dialog box that appears, confirm the information and click OK.
After the unsubscription request is submitted, you can click Order List to view the processing details.

Release a pay-as-you-go Cloud Firewall

Log on to the Cloud Firewall console with Alibaba Cloud account B and Alibaba Cloud account C, respectively.
On the Overview page, choose More > Self-service Release in the upper-right corner.
In the Warning dialog box, confirm the release information and click OK.

Step 4: Add member accounts in Cloud Firewall

Cloud Firewall uses the trusted service feature of Resource Directory to group multiple Alibaba Cloud accounts into a resource directory, to enable resource sharing among all member accounts.

Log on to the Cloud Firewall console by using Alibaba Cloud account A.
In the left-side navigation pane, choose Settings > Multi-Account.
On the Multi-Account page, click Add Member.
In the Add Member dialog box, add the account IDs of Alibaba Cloud account B and Alibaba Cloud account C to the Selected Members list on the right. Then, click OK.

Alibaba Cloud account A has now successfully added accounts B and C as its member accounts.

Important

After a member account is added, Cloud Firewall is authorized by default to access the cloud resources in that account. However, if your VPC firewall protects network instances within a Cloud Enterprise Network (CEN) that includes a VPC from another account, you must manually authorize Cloud Firewall to access the resources in that other account. For more information, see Authorize Cloud Firewall to access cloud resources.

Step 5: Configure Cloud Firewall for shared resources

Because unsubscribing deletes existing policies, you must re-enable the firewalls for the shared resources and reconfigure their policies.

Notes

The Internet firewall can be enabled within seconds.
Re-enabling the VPC firewall may cause business interruptions due to route switching.
You must reconfigure access control and intrusion prevention policies.

Log on to the Cloud Firewall console by using Alibaba Cloud account A.
In the left-side navigation pane, click Firewall.
On the Firewall page, click Synchronize Assets. The system synchronizes the asset information of the current account and its member accounts.

This process takes 1 to 2 minutes.

After the asset synchronization is complete, you can enable Cloud Firewall protection for the shared resources.

Enable the Internet firewall

For more information, see Internet firewall.

Enable the VPC firewall

Select one of the three supported VPC firewall scenarios based on your business requirements.

VPC Firewall Type	Scenario	Operation Guide
VPC Firewall for Enterprise Edition Transit Router	Supports protection for: Traffic between multiple VPCs in the same region Traffic between multiple VPCs across regions through Enterprise Edition Transit Router Traffic between VPCs and Virtual Border Routers (VBRs) (that is, traffic between VPCs and on-premises data centers) Traffic between VPCs and Cloud Connect Networks (CCNs) Traffic between multiple VBRs Traffic between CCNs and VBRs Traffic between VPCs and public VPNs Does not support protection for: Traffic between multiple CCNs	Connect multiple CCNs
VPC Firewall for Basic Edition Transit Router	Supports protection for: Traffic between multiple VPCs in the same region Traffic between multiple VPCs across regions through Basic Edition Transit Router Traffic between VPCs and Virtual Border Routers (VBRs) (that is, traffic between VPCs and on-premises data centers) Traffic between VPCs and Cloud Connect Networks (CCNs) Does not support protection for: Traffic between multiple VBRs Traffic between CCNs and VBRs Traffic between multiple CCNs	Configure the VPC firewall for a Cloud Enterprise Network
VPC Firewall for Express Connect	Supports protection for: Traffic between multiple VPCs of the same account in the same region in Express Connect VPC mode Traffic between multiple VPCs in the same region (including same-account and cross-account) in VPC peering mode Does not support protection for: Cross-account and cross-region traffic between multiple VPCs in Express Connect VPC mode VPC and Virtual Border Router (VBR) (VBR) (Virtual Border Router) mutual access traffic Note If you need to protect cross-region, cross-account VPC traffic, or traffic between VPCs and VBRs, we recommend using Cloud Enterprise Network. For more information, submit a .	Configure the VPC firewall for a peering connection

Configure access control policies

For more information, see Configure an access control policy for an Internet firewall, Configure an access control policy for a VPC firewall, and Configure security groups.
Configure intrusion prevention policies

For more information, see Intrusion prevention.

Step 6: Verify service stability

Check the hit count of your access control policies and review traffic logs to ensure they align with your expected traffic patterns. If policy hits and log data align with your expectations and show no anomalies, this confirms that your configuration is correct and your services are stable. You can view this information on the Access Control Policy page and the log audit page.