Alibaba Cloud
Connect Alibaba Cloud to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Alibaba Cloud to collect cloud infrastructure evidence with automated compliance tests, switched on per workspace.
| Category | Cloud Infrastructure |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Alibaba Cloud's guide | alibabacloud.com |
Connect with an API token
-
In Alibaba Cloud:
- Log on to the RAM console and choose Identities › Users in the left-side navigation pane.
- Find the RAM user Safeguard will use and click its username.
- On the Credential tab, in the AccessKey section, click Create AccessKey.
- In the dialog, review the use cases, select one, check I confirm that it is necessary to create an AccessKey and click Continue.
- Complete security verification, save the AccessKey ID and AccessKey secret from the dialog (the secret is displayed only once and cannot be retrieved), then click OK.
- In Identities › Users, find the same RAM user and click Attach Policy in the Actions column.
- In the Grant Permission panel, set Resource scope to Account level and, under Permission policy, select the read-only system policy Safeguard needs.
- Click Confirm, then Close.
Where to find the other values:
- Access key ID: Shown with the secret in the Create AccessKey dialog, and listed in the RAM user's Credential tab under AccessKey.
Alibaba Cloud shows the secret only once, so copy it before you leave the page.
Alibaba Cloud's public documentation does not cover every step.
Source: alibabacloud.com, alibabacloud.com, checked 2026-10-07.
The permissions Safeguard needs:
ReadOnlyAccess. -
On Compliance › Connectors, open Alibaba Cloud, click Connect, choose API token and fill in:
Field What to enter Access key ID Required. Access key secret Required. Stored encrypted and never shown again. Region (optional) — Regions (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read Alibaba Cloud and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | A1.2, CC6.1, CC6.3, CC6.6, CC6.7, CC7.2 | 20 |
| ISO/IEC 27001 | Automated tests | A.5.17, A.8.2, A.8.5, A.8.13, A.8.15, A.8.20, A.8.24 | 20 |
| HIPAA Security Rule | Automated tests | 164.308(a)(4), 164.308(a)(5), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1) | 19 |
| PCI DSS | Automated tests | 1.3.1, 3.5.1, 3.7.4, 4.2.1, 7.2.2, 8.3.6, 8.4.2, 8.6.3, 10.2.1 | 19 |
| NIST CSF 2.0 | Automated tests | DE.CM-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-11, PR.IR-01 | 20 |
These tests are switched on per workspace by the Safeguard team.
Related
- Cloud Infrastructure connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks