Alibaba ACA Cloud Operator cheat sheet

Shared responsibility: Alibaba Cloud secures the physical infrastructure and hypervisor; the customer secures guest OS, applications, data, and identity configuration.

Regions are geographic areas containing multiple isolated Zones; a Zone is a distinct datacenter cluster with independent power and network, so multi-Zone deployment removes single points of failure.

Resource hierarchy: Account > Resource Group (logical grouping for permissions and cost) > individual resources; a resource belongs to exactly one resource group.

Alibaba Cloud API calls require an AccessKey ID plus AccessKey Secret signature; RAM users should use temporary STS tokens rather than long-lived AccessKeys.

Operations lifecycle order: provision, configure, monitor, scale, back up, then decommission; each stage has a matching Alibaba Cloud service (e.g., ROS, CloudMonitor, Auto Scaling, HBR).

Idempotency: ROS templates and API retries must produce the same end state; use stack rollback policies to revert partial failures.

Change control rule: any production change requires a documented rollback path; snapshot or image the ECS instance before OS-level patching.

Availability math: two independent Zones at 99.9% each yield roughly 99.9999% availability for a redundant pair, but only if the dependency chain is also redundant.

ECS instance families: g-series general purpose, c-series compute optimized, r-series memory optimized; choose by vCPU-to-memory ratio, not by price alone.

Instance type naming: ecs.g7.large - family letter, generation number, then size suffix; larger suffix means more vCPU and memory within the same family.

Billing modes: Subscription (prepaid, longest commitment, lowest unit price), Pay-As-You-Go (per-second/hourly, no commitment), and Spot/Preemptible (deep discount, reclaimable with short notice).

Auto Scaling uses Scaling Groups bound to a launch template; rules are triggered by CloudMonitor metrics (e.g., CPU > 70% for 5 minutes) or by scheduled policies.

A custom image captures the OS and data disks of an instance; images are Region-scoped and must be copied to other Regions before use there.

Security group rules are stateful and default-deny inbound; a rule allows or denies by protocol, port range, and source CIDR or source security group.

Elastic IP (EIP) is a public IP that can be detached and re-bound to another ECS instance or NAT Gateway within the same Region.

Stop vs. release: stopping a Pay-As-You-Go instance preserves disks and may still incur storage charges; releasing destroys the instance and its non-retained disks.

OSS storage classes: Standard, Infrequent Access, Archive, and Cold Archive - lower cost as access frequency drops, with higher retrieval latency and minimum storage durations.

OSS durability is designed for 99.9999999999% (12 nines); bucket names are globally unique across all Alibaba Cloud accounts.

ECS disk types: ESSD (highest IOPS, PL0-PL3 performance levels), SSD, and Ultra disk; ESSD AutoPL scales IOPS with capacity and burst.

Snapshot rule: snapshots are incremental and stored independently of the source disk, so deleting a disk does not delete its snapshots.

VPC is a logically isolated network with its own CIDR block; a VSwitch maps to a single Zone and instances in different VSwitches can communicate if routes and security groups allow.

Internet access from a VPC requires either an EIP on the instance or a NAT Gateway for outbound-only traffic from private instances.

SLB distributes traffic across backend servers using listeners (L4 TCP/UDP or L7 HTTP/HTTPS) and health checks; unhealthy backends are removed automatically.

Route table rule: each VSwitch is associated with one route table; the most specific matching route wins, and a custom route to a NAT Gateway or transit device overrides the default.

CloudMonitor collects metrics at 1-minute granularity for ECS (CPU, memory requires the CloudMonitor agent, disk, network) and stores them per namespace.

Alarm rule anatomy: metric, statistical method (Average, Maximum, Minimum), comparison operator, threshold, consecutive evaluation periods, and notification contact group.

Alarm states are OK, ALARM, and INSUFFICIENT_DATA; a metric with no datapoints reports INSUFFICIENT_DATA rather than OK.

Agent-dependent metrics: guest-OS memory and process monitoring require installing the CloudMonitor agent; hypervisor-level metrics such as CPU do not.

Log Service (SLS) ingests logs via Logtail or SDK; queries use a search statement plus an optional SQL analytics clause over a specified time range.

Event monitoring (CloudMonitor system events) tracks state changes such as instance restart, disk full, or OSS bucket policy change, distinct from metric alarms.

SLA-style evaluation: use the Average statistic for steady thresholds (CPU), Maximum for spikes (network burst), and Minimum for capacity floors (free disk).

Notification channels include SMS, email, DingTalk, and webhook; a contact group must be attached to the alarm rule or no one is notified.

RAM policy structure: Effect (Allow/Deny), Action (API operations), Resource (ARN), and Condition; explicit Deny always overrides any Allow.

Least privilege: grant RAM roles to ECS instances via instance RAM roles instead of embedding AccessKeys in application code.

Security Center provides baseline checks, vulnerability detection, and anomaly detection; its protection tiers (Basic, Anti-virus, Enterprise) determine which features are available.

ActionTrail records API-level operations (who, when, from which IP) and can deliver logs to OSS or SLS for audit retention.

Cost tools: Cost Management reports by resource group, tag, or account; budgets and alerts fire when forecast or actual spend crosses a threshold.

Tagging rule: consistent key-value tags (e.g., env:prod, owner:team) are the prerequisite for cost allocation and for tag-based automated operations.

Reserved Instance and Savings Plan commitments discount eligible Pay-As-You-Go compute; unused commitment is wasted, so size commitments to the steady-state baseline.

Idle-resource hygiene: unattached EIPs, unused disks, and stopped-but-not-released instances still bill; schedule audits to reclaim them.