Cloud Operations Fundamentals
The operating model
Alibaba Cloud operations rest on a shared responsibility split: the platform secures the physical data centers, hypervisor, and managed service control planes, while the customer secures guest OS configuration, identity and access, data, and network policy inside their VPCs. Questions frequently test where that line falls for a given service type. A managed database shifts patching of the engine to Alibaba Cloud, but account and permission design stays with you.
Core building blocks
Know the resource hierarchy: an Alibaba Cloud account is the billing and ownership root; Resource Access Management (RAM) users, groups, and roles grant identity; Resource Groups and tags organize resources for cost and operations. Regions are geographic, zones are isolated fault domains within a region. Alibaba Cloud APIs and the console are the two management surfaces, and Alibaba Cloud CLI/SDK automation is preferred for repeatable operations.
Traps to watch
- Quota vs. limit confusion: many services have per-region quotas you must request increases for; a failed create is often a quota, not a permission, issue.
- Region vs. zone scope: most resources are regional; a few (like some global services) are not. Read the scope carefully.
- RAM role vs. user: roles are for trusted entities (ECS instances, cross-account), users are for people or applications with long-term credentials.
- Tag semantics: tags are key-value; cost allocation depends on consistent tagging, not on resource groups alone.
Rule of thumb
When a question asks "who is responsible" or "where does this live," answer in two steps: first decide managed vs. self-managed, then decide region vs. zone vs. account scope. That ordering resolves most fundamentals items.
Worked example
A team cannot launch a new ECS instance in Zone B but can in Zone A. The likely causes in order: zone capacity/quota, then instance-type availability in that zone, then RAM permission scoped to a resource group. Check quota and zone availability before blaming IAM.