Alibaba ACP Cloud Computing cheat sheet

Alibaba Cloud regions are geographic areas; zones within a region are isolated fault domains connected by low-latency networks, and multi-zone deployment is the standard HA pattern.

Shared responsibility split: Alibaba Cloud secures the physical infrastructure and hypervisor; the customer secures guest OS, applications, data, and identity configuration.

IaaS (ECS), PaaS (ApsaraDB, Function Compute), and SaaS map to increasing provider-managed scope and decreasing customer operational load.

A region/zone choice is driven by latency to end users, data residency/compliance, and cross-zone disaster recovery requirements.

Resource hierarchy: account > resource groups (billing/authorization grouping) > individual resources tagged with key/value pairs.

Elasticity vs scalability: vertical scaling resizes one instance; horizontal scaling adds instances, which is the elastic pattern behind SLB + Auto Scaling.

A VPC is region-scoped; subnets (vSwitches) are zone-scoped, so an HA design places vSwitches in at least two zones of the same region.

Alibaba Cloud APIs are OpenAPI-based (RPC/REST style) and authenticated with AccessKey IDs; console, CLI (aliyun), and SDKs call the same APIs.

Instance families: g (general purpose), c (compute optimized), r (memory optimized), plus storage, GPU, and shared/burstable types, chosen by CPU:memory ratio and workload profile.

Billing modes: Subscription (prepaid, lower unit price, 1 month-3 years), Pay-As-You-Go (per-second/hourly, no commitment), and Spot/Preemptible instances for fault-tolerant batch work.

Disk categories: ESSD (PL0-PL3, highest IOPS), ESSD AutoPL, SSD cloud disk, and ultra cloud disk; IOPS and throughput scale with disk size and PL level.

Security groups are stateful instance-level virtual firewalls; rules are allow-only and evaluated by priority, with separate inbound and outbound directions.

An ECS instance's public IP is released when the instance is released; an EIP is a separate, retainable resource that can be re-bound to another instance.

User data (cloud-init) runs at first boot for automated provisioning; custom images capture OS plus installed software for repeatable deployment.

Snapshot policies automate periodic disk snapshots; a snapshot can roll back a disk or create a new disk/image, and is the base for ECS backup.

Instance metadata service (100.100.100.200) exposes instance ID, region, and role credentials to code running on the instance.

A VPC defines an IPv4 CIDR block (e.g., /16) that is subdivided into vSwitches; each vSwitch maps to exactly one zone and one CIDR range.

Route tables control traffic: a route entry of 0.0.0.0/0 to an Internet NAT Gateway enables outbound internet for private instances without public IPs.

Security groups filter instance traffic; network ACLs are stateless, subnet-level filters applied in addition to security groups.

SLB types: CLB (classic, layer 4/7), ALB (application load balancer, HTTP/HTTPS/gRPC, advanced routing), and NLB (network load balancer, layer 4, high performance).

SLB health checks remove unhealthy backend servers from rotation; server weight influences traffic distribution, and session persistence can be enabled for stateful apps.

EIP is a standalone public IP that can be bound/unbound and moved between ECS, NAT Gateway, and SLB; bandwidth and peak billing are configured on the EIP or shared bandwidth package.

Alibaba Cloud DNS (Alidns) hosts public zones with A, CNAME, MX, and TXT records; PrivateZone resolves internal names inside VPCs.

VPC peering connects two VPCs; Cloud Enterprise Network (CEN) connects many VPCs and on-premises networks with a central routing hub.

OSS storage classes: Standard, Infrequent Access (IA), Archive, Cold Archive, and Deep Cold Archive; lower-cost classes trade retrieval time and minimum storage duration.

OSS data is organized as buckets > objects with keys; buckets are region-scoped and have globally unique names.

OSS lifecycle rules transition objects between classes or delete them after a defined age, matching retention to access patterns.

OSS redundancy: Local Redundant Storage (LRS) keeps copies in one zone; Zone-Redundant Storage (ZRS) spreads copies across zones in a region.

NAS provides shared file storage (NFS/SMB) mountable by many ECS instances; performance scales with capacity for General-purpose NAS, and Extreme NAS offers fixed high performance.

Block storage (cloud disks) attach to a single ECS instance (or share a multi-attach ESSD for clustered apps); it is the lowest-latency option for databases.

Hybrid Backup Recovery (HBR) backs up ECS files/disks, NAS, OSS, and on-premises data to a backup vault, with policies for schedule and retention.

OSS supports versioning, cross-region replication, and bucket policies/ACLs; object lock provides WORM retention for compliance.

RDS engines: MySQL, SQL Server, PostgreSQL, MariaDB, and PPAS; managed features include automated backup, failover, and read-only instances.

RDS high-availability editions use primary/standby with automatic failover; read-only instances offload read traffic and are created from the primary's data.

PolarDB is a cloud-native database with compute-storage separation, up to 15 read-only nodes sharing one storage layer, and fast clone/backup via shared storage.

ApsaraDB for Redis (Tair) is an in-memory KV store; cluster edition shards data across nodes, and standard edition uses primary/standby for HA.

ApsaraDB for MongoDB is a document store with replica set (three nodes) or sharded cluster architectures for horizontal scale.

RDS backup types: full and incremental (binlog) backups plus log backups enable point-in-time recovery within the retention window.

Database whitelists (IP allowlists) and VPC-only endpoints are the primary network access controls; SSL/TLS encrypts client connections.

Read/write splitting sends writes to the primary and reads to read-only instances; connection pooling and proxy endpoints hide failover from applications.

RAM users are identities within an Alibaba Cloud account; RAM roles are assumed by trusted entities (ECS instances, other accounts) via STS temporary credentials.

RAM policies are JSON documents with Effect, Action, Resource, and Condition; attaching a policy to a user, group, or role grants permissions.

Least privilege: grant scoped policies to RAM users/groups instead of sharing the root account AccessKey; enable MFA on privileged identities.

Security Center provides host-based threat detection, vulnerability scanning, baseline checks, and asset inventory across ECS, containers, and cloud services.

WAF inspects HTTP/HTTPS traffic for SQL injection, XSS, and OWASP threats; it is deployed in front of ALB/CLB or via CNAME to protect web apps.

Anti-DDoS Basic is included per ECS public IP; Anti-DDoS Pro/Premium provides scrubbing capacity, and the traffic scrubbing center diverts attack traffic away from origin.

Cloud Firewall (Cloud Firewall/CFW) provides north-south and east-west traffic control at the VPC boundary and between VPCs.

ActionTrail records API calls for audit; combined with RAM and Security Center it forms the identity, detection, and audit triad.

Auto Scaling components: scaling group (defines min/max/desired capacity and vSwitch/zone scope), scaling configuration (instance template), and scaling rules/triggers.

Scaling modes: fixed quantity, scheduled tasks, dynamic scaling by metric alarms (e.g., CPU > 70% for N periods), and predictive/target-tracking policies.

Cooldown period prevents rapid repeated scaling events; it applies after a scaling activity completes.

Scale-out adds instances to the group and can auto-register them behind an SLB; scale-in removes instances and deregisters them.

Scaling group health check replaces unhealthy ECS instances automatically when the group is attached to an SLB health check.

Lifecycle hooks pause instance add/remove to run custom scripts before the instance joins or leaves the group.

Elasticity is cost-effective only when scale-in is enabled; min capacity guards availability, max capacity caps spend and blast radius.

Combining SLB + Auto Scaling + RDS read replicas is the standard stateless web-tier elastic architecture.

CloudMonitor collects ECS, RDS, SLB, and OSS metrics; alarm rules trigger notifications (SMS, email, webhook) or actions such as Auto Scaling.

Agent-based monitoring (CloudMonitor agent) adds OS-level metrics like memory and disk usage that are not available from the hypervisor alone.

Log Service (SLS) ingests and queries logs; logtail collects ECS file logs, and alerts can be defined on query results.

ARMS provides application performance monitoring (traces, metrics, topology) for distributed applications.

Troubleshooting order for unreachable ECS: security group rules, route table/NAT, EIP binding, OS firewall, then service process and listening port.

SLB 502/504 typically indicates backend health check failure, backend timeout, or an application error; verify health status and backend port.

RDS slow-query logs and performance insight identify missing indexes and lock contention; connection count alarms catch pool exhaustion.

ActionTrail plus CloudMonitor event alarms surface configuration changes and resource state transitions for operations audits.

Billing methods: Subscription (prepaid), Pay-As-You-Go (postpaid), and Spot/Preemptible; commitment and duration drive unit-price discounts.

Savings plans and reserved instances offer discounts for steady-state compute in exchange for a 1- or 3-year commitment.

Cost allocation uses resource groups and tags; bills can be split by tag, resource group, or account for chargeback.

Alibaba Cloud Cost Manager (BSS) provides budgets, cost forecasts, and anomaly alerts to detect unexpected spend.

Right-sizing: match instance family to workload (compute/memory/storage optimized) and downsize or release idle, unattached resources (EIPs, disks, snapshots).

Storage cost levers: lifecycle transitions to IA/Archive, delete orphaned snapshots, and use ZRS/LRS per durability need.

Auto Scaling scale-in and scheduled shutdown of non-production instances reduce Pay-As-You-Go spend.

Total cost of ownership includes data transfer (inter-region and internet egress), snapshot storage, and backup vault usage, not just compute.