Alibaba Cloud CSPM, region by region, alongside your other clouds
Alibaba Cloud often runs alongside AWS and Azure, in China and international regions alike. Onam brings the same rule-driven posture coverage to it — RAM policies, OSS buckets, RDS instances and VPC configurations — evaluated by the same engine as your other clouds.
One platform on Alibaba Cloud
Connect Alibaba Cloud once. Onam Security is covered in detail below; the rest of the platform works from the same discovery.
Every Alibaba Cloud resource Onam discovers lands in one inventory, with provider, region, account, state and last-seen time, through the same read-only access. Every discovery run is recorded with its trigger and status. The per-account architecture view draws AWS accounts today, not Alibaba Cloud.
Posture, identity, attack paths, workloads and compliance for Alibaba Cloud. The detail is on the rest of this page.
Onam FinOps works on reconciled billing data: billed and effective cost, ownership, forecast, budgets, anomalies and savings. It holds read-only billing access and changes nothing in your accounts. Ask us which Alibaba Cloud billing data applies to your accounts.
Onam DRM works from the same inventory: it proposes applications from your tags, reads backup, snapshot and replication from cloud configuration, and predicts RTO and RPO against your targets. It plans and records — it does not run a failover or a DR test. Ask us about DRM coverage for Alibaba Cloud.
Onam AIOps
Early accessAI agents investigate your Onam Security inventory and findings and propose changes a person approves. Executing a change in a customer cloud is on the roadmap, with AWS first; nothing is executed in Alibaba Cloud today.
Services we monitor on Alibaba Cloud
Every service below is scanned continuously — no agents, no network changes, read-only.
Plus: MaxCompute, DataWorks, MSE, API Gateway, Container Registry, Anti-DDoS, and more.
Compliance frameworks
Onam maps every Alibaba Cloud finding to the frameworks your auditors care about.
Connect in 3 steps
From consent to your first findings, with no agents to install for posture scanning.
Create a read-only RAM user for Onam
Create a dedicated RAM user with Alibaba's AliyunReadOnlyAccess system policy plus a custom policy of Describe, Get and List calls, and an AccessKey pair for it. The user cannot create or change identities or policies.
Enter the AccessKey in Onam
Paste the AccessKey ID and secret into the onboarding wizard. Onam validates them, stores them encrypted, and uses them only for read calls.
Findings from the first scan
Onam scans China and international regions — Hangzhou, Shanghai, Beijing, Shenzhen, Hong Kong, Singapore, Sydney, Kuala Lumpur, Tokyo, Frankfurt and the US — and returns prioritized findings mapped to your frameworks.
Alibaba Cloud in the Onam Security console.
A recreation of the Onam console with sample data: connect, inventory and posture in one view.
What makes Onam different on Alibaba Cloud
China and international regions, one engine
China regions are scanned with the same rules as international ones, through the same read-only RAM user. Posture scanning reads configuration through Alibaba Cloud APIs; it does not read the data in your stores.
RAM identity findings
RAM users, roles, groups, policies and access keys are inventoried, with findings for wildcard or admin policies, RAM roles with wildcard trust or assumable without MFA, broad OSS and KMS grants, access-key rotation and console MFA.
OSS and VPC exposure
OSS bucket ACLs and policies, security groups and VPC settings are checked by posture rules, and the findings join the same graph that attack-path analysis walks.
Questions we get a lot
Alibaba Cloud security — related reading
How the engines behind Alibaba Cloud coverage work, and what the categories actually mean.
ACK cluster hardening against CIS Alibaba Cloud ACK.
Cloud security posture management explained — what it catches, and what it cannot.
Why a list of findings is not a priority, and how chains reach crown jewels.
Attack paths and choke points computed across your whole estate.
Effective permissions after role chains, SCPs and permission boundaries.
CIS, NIST, ISO 27001, PCI-DSS and more, scored continuously.
Snapshot-based workload scanning that runs inside your own account.
See Onam on your Alibaba Cloud environment
Connect once with read-only access. Every Onam product you use works from the same discovery, so your accounts are connected once.