Set Up Your Alibaba Account
Configure your Alibaba account to enable Prisma Cloud to retrieve and analyze configuration logs for monitoring your cloud resources.
Prisma Cloud enables visibility and monitoring of your Alibaba Cloud infrastructure in Mainland China and International regions. The first step to monitoring your resources on Alibaba Cloud is to grant Prisma Cloud access to your account. To achieve this, you must create a role and attach policies that enable permissions to authorize access to the assets deployed within the account. You can choose to create a custom policy with granular permissions or use the Alibaba Cloud system policy to enable ReadOnlyAccess. After you create the role and the permissions are enabled, you can add the Alibaba Cloud Resource Name (ARN) on Prisma Cloud to assume the role to monitor your Alibaba Cloud account.
tt:[(Required if you want to enable granular access permissions)] Create a custom policy.
Creating a custom policy allows you to use the principle of least privilege and enable the bare-minimum permissions that Prisma Cloud requires to monitor your account. To avoid updating these permissions periodically, you can skip ahead to step 2 Create a RAM role and use the Alibaba Cloud system policy to enable ReadOnlyAccess permissions to all aliyun services.
Download the permissions for Alibaba China.
The JSON file includes the required permissions.
Log in to the Alibaba Cloud Console for China region.
Select Resource Access Management > Permissions > Policies > Create Policy.
Select the JSON tab and paste the JSON file contents into the field.
Select Next to edit policy information.
Enter a new Policy Name, Description, and select OK.
Create a RAM role.
To authorize API access to Prisma Cloud, you must create a RAM role and attach policies. You can choose the Custom Policy with granular permissions or use the Alibaba Cloud System Policy to enable ReadOnlyAccess permissions.
On the Alibaba Cloud console, select Resource Access Management > Identities > Roles.
Select Create Role.
Select Trusted entity type as Alibaba Cloud Account and Next.
Enter a RAM Role Name.
Enter the Prisma Cloud Account ID as a trusted Alibaba Cloud account.
If your Prisma Cloud instance is on https://app.prismacloud.cn, the Prisma Cloud Account ID is 1306560418200997. Otherwise, the Prisma Cloud Account ID is 5770382605230796.
Enter the appropriate account ID in Select Trusted Alibaba Cloud Account > Other Alibaba Cloud Account and select OK.
Select Add Permissions to RAM Role.
Set the Authorized Scope to Alibaba cloud account and attach the permissions associated with the custom policy (if you created one), or use the system policy.
Custom Policy
System Policy
Select OK and then Complete.
Copy the Alibaba Cloud Resource Name (ARN).
You need the ARN to add the Alibaba cloud account on Prisma Cloud.
Select Roles and search for the name you entered earlier.
Note the ARN.
Last updated
Was this helpful?