> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-your-alibaba-account/set-up-your-alibaba-account.md).

# Set Up Your Alibaba Account

Configure your Alibaba account to enable Prisma Cloud to retrieve and analyze configuration logs for monitoring your cloud resources.

Prisma Cloud enables visibility and monitoring of your Alibaba Cloud infrastructure in Mainland China and International regions. The first step to monitoring your resources on Alibaba Cloud is to grant Prisma Cloud access to your account. To achieve this, you must create a role and attach policies that enable permissions to authorize access to the assets deployed within the account. You can choose to create a custom policy with granular permissions or use the Alibaba Cloud system policy to enable **ReadOnlyAccess**. After you create the role and the permissions are enabled, you can add the Alibaba Cloud Resource Name (ARN) on Prisma Cloud to assume the role to monitor your Alibaba Cloud account.

1. tt:\[(Required if you want to enable granular access permissions)] Create a custom policy.

   Creating a custom policy allows you to use the principle of least privilege and enable the bare-minimum permissions that Prisma Cloud requires to monitor your account. To avoid updating these permissions periodically, you can skip ahead to step 2 **Create a RAM role** and use the Alibaba Cloud system policy to enable **ReadOnlyAccess** permissions to all aliyun services.

   1. Download the [permissions for Alibaba China](https://redlock-public.s3.amazonaws.com/alibaba_cloud/alibaba-ram-policy-readonly-document).

      The JSON file includes the required permissions.
   2. Log in to the Alibaba Cloud Console for China region.
   3. Select **Resource Access Management > Permissions > Policies > Create Policy**.
   4. Select the **JSON** tab and paste the JSON file contents into the field.

      <figure><img src="/files/v6Ror1quWkdh85VOFqOb" alt="alibaba json permissions"><figcaption></figcaption></figure>
   5. Select **Next to edit policy information**.
   6. Enter a new **Policy Name**, **Description**, and select **OK**.

      <figure><img src="/files/1uPvTfVE2LZGxUEajeyU" alt="alibaba cloud account custom policy"><figcaption></figcaption></figure>
2. Create a RAM role.

   To authorize API access to Prisma Cloud, you must create a RAM role and attach policies. You can choose the **Custom Policy** with granular permissions or use the Alibaba Cloud **System Policy** to enable **ReadOnlyAccess** permissions.

   1. On the Alibaba Cloud console, select **Resource Access Management > Identities > Roles**.
   2. Select **Create Role**.

      <figure><img src="/files/hMPA6Q8aWt7xdDnx6i8o" alt="alibaba cloud account create ram role"><figcaption></figcaption></figure>
   3. Select Trusted entity type as **Alibaba Cloud Account** and **Next**.
   4. Enter a **RAM Role Name**.
   5. Enter the Prisma Cloud Account ID as a trusted Alibaba Cloud account.

      If your Prisma Cloud instance is on <https://app.prismacloud.cn>, the Prisma Cloud Account ID is **1306560418200997**. Otherwise, the Prisma Cloud Account ID is **5770382605230796**.

      Enter the appropriate account ID in **Select Trusted Alibaba Cloud Account > Other Alibaba Cloud Account** and select **OK**.

      <figure><img src="/files/c4uuVuEVRTlLhUhNtwt8" alt="alibaba cloud account ram account id"><figcaption></figcaption></figure>
   6. Select **Add Permissions to RAM Role**.

      Set the **Authorized Scope** to Alibaba cloud account and attach the permissions associated with the custom policy (if you created one), or use the system policy.

      * Custom Policy

        <figure><img src="/files/nMYb0SXi6k8EtrNeKZxZ" alt="alibaba cloud account add permissions custom"><figcaption></figcaption></figure>
      * System Policy

        <figure><img src="/files/tLttZkuo7wwYBG9DD3fg" alt="alibaba cloud account add permissions system"><figcaption></figcaption></figure>
   7. Select **OK** and then **Complete**.
3. Copy the Alibaba Cloud Resource Name (ARN).

   You need the ARN to add the Alibaba cloud account on Prisma Cloud.

   1. Select **Roles** and search for the name you entered earlier.

      <figure><img src="/files/ThXJBWqD4cjLhumLmuiY" alt="alibaba cloud account ram role"><figcaption></figcaption></figure>
   2. Note the ARN.

      <figure><img src="/files/yYQkaTaYSxDoo0e1BZzd" alt="alibaba cloud account ram role arn"><figcaption></figcaption></figure>
4. [Add an Alibaba Cloud Account on Prisma Cloud](/content-collections/connect/connect-cloud-accounts/onboard-your-alibaba-account/add-alibaba-cloud-account-to-prisma-cloud.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-your-alibaba-account/set-up-your-alibaba-account.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.