Configure Alibaba Cloud Access Credentials

NineData can use Alibaba Cloud access credentials to create PrivateLink endpoints, query Alibaba Cloud resources such as ECS, RDS, VPC, and NAT Gateway, and establish private connectivity between NineData and your database.

Alibaba Cloud can be connected to NineData by using either an AccessKey pair or a RAM role.

Permission Policy

Alibaba Cloud credentials must include the permissions in the policy below.

{
    "Version":"1",
    "Statement":[
        {
            "Effect":"Allow",
            "Action":[
                "ecs:DescribeInstanceAttribute",
                "ecs:DescribeInstances",
                "ecs:DescribeSecurityGroups",
                "ecs:CreateSecurityGroup",
                "ecs:JoinSecurityGroup",
                "ecs:CreateSecurityGroup",
                "ecs:AuthorizeSecurityGroup",
                "ecs:JoinSecurityGroup",
                "ecs:CreateVSwitchRequest",
                "ecs:DescribeSecurityGroupAttribute"
            ],
            "Resource":"*"
        },
        {
            "Effect":"Allow",
            "Action":[
                "rds:DescribeDBInstanceAttribute",
                "rds:DescribeDBInstanceIPArrayList",
                "rds:DescribeDBInstanceNetInfo",
                "rds:DescribeDBInstances",
                "rds:ModifySecurityIps"
            ],
            "Resource":"*"
        },
        {
            "Effect":"Allow",
            "Action":[
                "vpc:DescribeVSwitches",
                "vpc:CreateVSwitch",
                "vpc:DescribeVpcs",
                "vpc:ListVpcEndpointServicesByEndUser"
            ],
            "Resource":"*"
        },
        {
            "Effect":"Allow",
            "Action":[
                "Privatelink:ListVpcEndpointZones",
                "privatelink:ListVpcEndpointConnections",
                "privatelink:CreateVpcEndpoint",
                "privatelink:ListVpcEndpoints",
                "privatelink:ListVpcEndpointServicesByEndUser"
            ],
            "Resource":"*"
        },
        {
            "Effect":"Allow",
            "Action":"vpc:DescribeVpcs",
            "Resource":"*"
        },
        {
            "Effect":"Allow",
            "Action":[
                "polardb:DescribeDBClusters",
                "polardb:DescribeDBClusterEndpoints"
            ],
            "Resource":"*"
        }
    ]
}

tip

If you use a RAM user, ask an Alibaba Cloud administrator to grant the required policy to the RAM user or to create a role that NineData can assume.

Step 1: Create a Permission Policy

Log in to the Alibaba Cloud RAM Console.
On the Create Policy page, select the JSON tab.
Copy the policy in Permission Policy, paste it into the RAM policy editor, and click Next to edit policy information.
In Basic Information, enter the policy Name, and click OK.
tip
The policy name supports 1 to 128 characters and can contain English letters, numbers, and hyphens (-).

Step 2: Add an AccessKey Credential

Use this option when NineData will access Alibaba Cloud resources directly with an AccessKey ID and AccessKey Secret.

Log in to the Alibaba Cloud RAM Console.
In the Actions column for the target RAM user, select Add Permissions.
tip
Use the RAM user whose AccessKey will be added to NineData.
On the Add Permissions page, select Custom Policy, select the policy created in Step 1, click OK, and then click Complete.
Open AccessKey Management from the account menu, or go directly to the AccessKey Pair page.
Click Create AccessKey, then record the AccessKey ID and AccessKey Secret from the View Secret window. As an alternative, download the CSV file or copy the key information to the clipboard.
tip
Each user can create up to two AccessKeys. To delete an AccessKey, disable it first, then delete it. Alibaba Cloud requires the AccessKey ID for deletion confirmation.
Warning: Deleting an AccessKey can interrupt dependent services. Confirm that the key is no longer used before deleting it.
Log in to the NineData Console.
Go to **Datasource** > **Access Credentials**, and click **Create Credential**.

Configure the credential, and click Create Credential.

Parameter	Description
Name	Enter a credential name that is easy to identify later.
Cloud Vendor	Select Alibaba Cloud.
Type	Select AccessKey.
Access Key	Enter the AccessKey ID recorded in Step 5.
Access Key Secret	Enter the AccessKey Secret recorded in Step 5.

Step 3: Add a RAM Role Credential

Use this option when NineData will access Alibaba Cloud resources by assuming a RAM role.

Log in to the Alibaba Cloud RAM Console.
Click Create Role. In the panel that opens, select Alibaba Cloud Account, and click Next.
Enter the RAM Role Name.
tip
The role name supports 1 to 64 characters and can contain English letters, numbers, and hyphens (-).
Under Select Trusted Alibaba Cloud Account, select Other Alibaba Cloud Account, enter the NineData service account 1062166699324909, and click OK.
tip
This trust configuration allows NineData to access the required resources in your Alibaba Cloud account through the role.
Click Add Permissions to RAM Role. In Select Policy, choose Custom Policy, select the policy created in Step 1, click OK, and then click Complete.
On the Roles page, open the new role, go to Basic Information, and record the role ARN.
Log in to the NineData Console.
Go to **Datasource** > **Access Credentials**, and click **Create Credentials**.

Configure the credential, and click Create Credential.

Parameter	Description
Name	Enter a credential name that is easy to identify later.
Cloud Vendor	Select Alibaba Cloud.
Type	Select Role.
Role Name	Enter the RAM role name created in Step 3.
ARN	Enter the ARN recorded in Step 6.

Result

The Alibaba Cloud credential is available in NineData and can be selected when you configure cloud access, private connectivity, or Alibaba Cloud data sources.

Next Step

Create a data source

Configure Alibaba Cloud Access Credentials

Permission Policy ​

Step 1: Create a Permission Policy ​

Step 2: Add an AccessKey Credential​

Step 3: Add a RAM Role Credential​

Result​

Next Step​