sts:AssumeRoleWithOIDC.
No AccessKeyId/AccessKeySecret is stored. Nuphos keeps the role ARN and the
OIDC provider ARN, both of which the exchange requires.
Pick your partition when you connect: China (
ram.console.aliyun.com) or
International (ram.console.alibabacloud.com).Connect
The wizard in Connectors → Connect → Alibaba Cloud shows the issuer, client id, and subject for your team. Copy them from there.1. Add the identity provider
In the RAM console, create an OIDC identity provider using the issuer URL and client id from the wizard. Alibaba Cloud fetches the issuer’s JWKS itself, so there is no key to paste. Copy the provider’s ARN.2. Create the role
Create a role that trusts that provider, conditioned on the subject the wizard shows — that is what pins the role to your team, so no other Nuphos team can assume it. Attach a policy covering the work you want done (ACK, ECS, SWAS as needed) and copy the role’s ARN.3. Bind the role
Enter both ARNs in Nuphos.In the Nuphos app
- ECS instances and SWAS instances — the account’s compute.
- Clusters — ACK clusters land in the shared cluster browser alongside EKS, GKE, and the rest.
What the agent can do for you
The agent operates the account within whatever policy you attached to the role, correlating it with your other connected accounts and proposing changes as plans.Permissions & authorization
- The role’s policy is the outer limit — Alibaba Cloud enforces it.
- Hard boundary — who can use it. Only team Administrators can bind or remove the account, and they can restrict it to specific members with a member allow-list.
- Soft boundary — what the agent may do with it. Reads run freely; changes go through plan approvals and Auto-authorization.