Storage and Networking Operations
Storage services
Alibaba Cloud offers Object Storage Service (OSS) for unstructured objects in buckets, cloud disks (block storage) for ECS, Network Attached Storage (NAS) for shared file access, and archive/cold tiers within OSS. Key concepts: buckets are region-scoped and globally unique in name; objects have keys and storage classes (standard, infrequent access, archive, cold archive) with different retrieval behavior and minimum storage durations. Lifecycle rules transition or expire objects automatically-this is the standard answer for cost-tiering questions.
Networking services
Virtual Private Cloud (VPC) provides isolated networks with CIDR blocks, subnets, route tables, and security groups. A vSwitch is a subnet tied to a single zone. Elastic IP (EIP) is a public IP you can bind and unbind. NAT Gateway gives outbound internet access to private instances; an Internet Gateway or EIP gives inbound/outbound public connectivity. Server Load Balancer (SLB) distributes traffic across backends with health checks. Express Connect and VPN Gateway connect on-premises networks to VPCs.
Traps to watch
- Bucket naming and region: bucket names are globally unique; a name collision is not a permissions problem.
- Storage class retrieval: archive tiers incur retrieval time and cost; do not assume instant access.
- vSwitch zone binding: a vSwitch lives in one zone, so instances in different zones need different vSwitches.
- NAT vs. EIP: NAT is outbound-only for private instances; EIP is a public address you attach directly.
- Route table precedence: longest-prefix match wins; a more specific route overrides a default route.
Rule of thumb
For connectivity questions, ask "which direction and which endpoint?" Outbound-only private traffic → NAT Gateway. Inbound public service → EIP or SLB. Shared file access across instances → NAS. Object lifecycle cost control → OSS lifecycle rules.
Worked example
Private ECS instances must download OS updates but must not be reachable from the internet. Place them in a private vSwitch, route 0.0.0.0/0 to a NAT Gateway, and attach no EIP. That satisfies outbound-only access without exposing inbound ports.