Alibaba ACA Cloud Computing cheat sheet

Alibaba Cloud service models: IaaS (ECS, VPC), PaaS (ApsaraDB, Function Compute), SaaS (applications); the customer's management burden decreases from IaaS to SaaS.

Regions are geographic areas containing multiple isolated Zones; Zones within a region are connected by low-latency private networks, and cross-region traffic does not traverse private backbones by default.

Shared responsibility: Alibaba Cloud secures physical facilities, hypervisor, and managed-service infrastructure; the customer secures guest OS, applications, data, and identity configuration.

The Alibaba Cloud account (root) has full privileges and cannot be restricted by RAM policies; day-to-day operations should use RAM users or roles.

Billing models: Subscription (prepaid, lower unit price, suited to steady load), Pay-As-You-Go (per-second/hour, suited to spiky load), and Spot/Preemptible instances (deep discount, reclaimable).

The Management Console, OpenAPI (via SDKs/CLI), and Terraform/Resource Orchestration Service (ROS) are the three primary provisioning interfaces.

Resource hierarchy: Account > Resource Group > individual resources; resource groups enable cost and permission scoping across services.

Alibaba Cloud global infrastructure spans regions across Asia Pacific, EMEA, and the Americas; data residency is determined by the region chosen at resource creation.

ECS instance families: g-series (general purpose, balanced CPU/memory), c-series (compute optimized, high CPU/memory ratio), r-series (memory optimized), plus GPU and shared/burstable types.

Instance types are bound to a region and zone; changing instance family requires a Stop-and-Resize operation, and not all families are available in every zone.

Disk categories on ECS: ESSD (PL0-PL3 performance tiers), SSD, and Ultra disk; IOPS and throughput scale with capacity and PL tier.

Security groups are stateful virtual firewalls attached to ENIs; default deny inbound, allow outbound, and rules are allow-only (no explicit deny).

An ECS instance's public IP is NAT-mapped and not directly visible in the guest OS; use the metadata service (100.100.100.200) to retrieve instance attributes.

Auto Scaling (ESS) uses Scaling Groups with Min/Max/Desired capacity, Scaling Rules, and scheduled or metric-based (CloudMonitor) triggers.

User Data runs cloud-init style scripts at first boot for automated configuration; it executes once per instance unless re-injected.

ECS lifecycle states include Pending, Running, Stopping, Stopped, and Released; Stopped instances may still incur disk and EIP charges.

OSS storage classes: Standard, Infrequent Access (IA), Archive, and Cold Archive; retrieval latency and minimum storage duration increase as class cools.

OSS is strongly consistent for object PUT/DELETE and offers 99.9999999999% (12 nines) data durability via multi-replica or erasure coding.

Bucket names are globally unique across all Alibaba Cloud accounts and must be lowercase; a bucket is created in a specific region and cannot be moved.

OSS access control layers: Bucket ACL (private/public-read/public-read-write), Object ACL, RAM policies, and signed URLs for temporary access.

Multipart Upload splits large objects into parts uploaded in parallel, enabling resumable transfers; required above 5 GB and recommended above 100 MB.

OSS lifecycle rules transition objects between storage classes or delete them based on age; versioning protects against accidental overwrite and deletion.

CDN caches content at edge nodes; cache keys derive from URL and configurable ignore parameters, and purge/refresh operations invalidate cached objects.

CDN origin can be an OSS bucket, ECS, or external origin; OSS + CDN integration avoids OSS outbound traffic charges when using the internal origin path.

A VPC is a logically isolated network with a user-defined CIDR block (e.g., 10.0.0.0/8 to /28); each VSwitch maps to exactly one Availability Zone.

VPC connectivity options: VPC Peering (1:1, non-transitive), CEN (hub-and-spoke, transitive), VPN Gateway (IPsec over internet), and Express Connect (dedicated physical line).

Route tables contain system routes and custom routes; more specific prefixes win, and VPC peering requires routes on both sides plus security group allowances.

NAT Gateway provides SNAT for outbound internet access from private ECS and DNAT for inbound port forwarding; it requires an EIP.

SLB types: Classic (L4 TCP/UDP), Application (L7 HTTP/HTTPS, supports domain/path/header forwarding), and Network Load Balancer (high-performance L4).

SLB health checks probe backends and remove unhealthy servers; Server Groups decouple backend membership from the listener configuration.

EIP is a standalone public IP that can be detached and reattached to different ECS or NAT gateways without changing the address.

Security groups and network ACLs both filter traffic: security groups are stateful and instance-level; network ACLs are stateless and subnet-level.

Alibaba Cloud Security Center (Cloud Security Center) provides host intrusion detection, vulnerability scanning, baseline checks, and asset inventory.

Anti-DDoS Basic is included free with public IPs; Anti-DDoS Pro/Premium provides scrubbing centers and higher mitigation capacity for larger attacks.

WAF protects HTTP/HTTPS at layer 7 against SQL injection, XSS, and bot traffic; it sits in front of SLB, ECS, or CDN origins.

KMS manages encryption keys with envelope encryption; OSS and ECS disk encryption can use KMS-managed customer master keys (CMKs).

ActionTrail records API-level operations across the account for audit; it logs who did what, when, and from which source IP.

Security groups follow least privilege: open only required ports, avoid 0.0.0.0/0 on SSH/RDP, and use bastion hosts or Session Manager for admin access.

SSL/TLS certificates can be uploaded to or issued by Alibaba Cloud Certificate Management Service and bound to SLB, CDN, or WAF listeners.

RAM identities: users (long-term credentials), groups (permission bundling), and roles (assumed by trusted entities, no permanent secret).

RAM policies are JSON documents with Effect (Allow/Deny), Action, Resource, and Condition; explicit Deny overrides any Allow.

RAM roles enable STS temporary credentials with configurable expiration (typically 15 minutes to 12 hours), used for cross-account access and ECS instance roles.

Instance RAM roles let applications on ECS obtain STS tokens via the metadata service without embedding AccessKeys in code.

AccessKey pairs consist of an AccessKey ID and Secret; Secret is shown only at creation, and keys should be rotated and disabled when unused.

Policy attachment scope: account-level policies, resource-group-scoped policies, and service-specific policies; permission evaluation is the union of all attached allows minus any deny.

Multi-factor authentication (MFA) can be enforced for RAM users and required for sensitive API actions via policy conditions.

Qwen is Alibaba's family of large language models spanning text, vision-language, and code variants, offered in multiple parameter sizes and hosted on Model Studio (DashScope).

Model Studio (DashScope) exposes Qwen models via API with an API key; it supports inference, fine-tuning, and application orchestration without managing infrastructure.

PAI (Platform for AI) is the managed ML platform covering data preparation, training (PAI-DLC), model serving (PAI-EAS), and interactive development (DSW).

PAI-EAS deploys trained models as scalable HTTP/gRPC inference services with autoscaling and can host custom containers or built-in model formats.

RAG on Alibaba Cloud combines Qwen with a vector store (e.g., DashVector) to ground answers in private documents, reducing hallucination.

Model Studio supports serverless pay-as-you-go inference by token count, plus provisioned throughput for predictable high-volume workloads.

Fine-tuning adjusts a base Qwen model on domain data; it requires labeled examples and produces a custom model artifact deployed for inference.