Identity and Access Management
Core concepts
Resource Access Management (RAM) is Alibaba Cloud's IAM. The root Alibaba Cloud account should be locked down; day-to-day work uses RAM users, RAM user groups, and RAM roles.
A policy is a JSON document with Effect (Allow/Deny), Action, Resource, and Condition. Policies attach to users, groups, or roles. Explicit Deny always wins over Allow. STS (Security Token Service) issues temporary credentials for roles - used for federated access, cross-account access, and ECS instance roles so applications never store long-term keys.
Know RAM roles vs RAM users: users have permanent credentials (password, AccessKey); roles are assumed and yield temporary tokens. Instance RAM roles let ECS applications call APIs without embedded AccessKeys.
Traps
- An explicit Deny overrides any Allow - a classic exam trap.
- AccessKey pairs are long-lived secrets; the recommended pattern is STS temporary credentials via a role.
- Cross-account access is granted through a role with a trust policy, not by sharing passwords.
Worked example
An application on ECS must read from an OSS bucket. Correct answer: create a RAM role with an OSS read policy, attach it to the ECS instance, and let the SDK obtain STS credentials. Incorrect: embed an AccessKey in code or config.
AI and Cloud Solutions (Qwen, Model Studio, PAI)
Core concepts
Alibaba Cloud's AI stack has three layers a candidate should distinguish. Qwen is the family of large language and multimodal models (text, vision, audio, code). Model Studio (also called Bailian) is the managed platform for building generative-AI applications: model access, prompt engineering, RAG, agents, and API endpoints. PAI (Platform for AI) is the broader machine-learning platform for training, notebooks, and deploying custom models, with managed compute such as PAI-DLC (deep learning containers) and PAI-EAS (elastic inference service).
Understand RAG (retrieval-augmented generation): embed documents, store vectors, retrieve relevant chunks, and inject them into the prompt to ground answers. Fine-tuning adapts a base model to a domain with labeled data; RAG is preferred when knowledge changes frequently.
Traps
- Model Studio is for managed generative-AI apps; PAI is for custom model training and deployment. Do not swap them.
- RAG does not retrain the model; it retrieves context at inference time.
- Qwen models are accessed via API endpoints; you do not run them locally unless you deploy weights on your own compute.
Rule of thumb
If the need is "call a foundation model via API and build a chatbot with your documents," answer Model Studio + Qwen + RAG. If the need is "train a custom model on our labeled dataset with GPU clusters," answer PAI.