> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Alibaba Cloud

> Connect an Alibaba Cloud account with RAM OIDC federation — no AccessKey to store.

Nuphos reaches Alibaba Cloud through **OIDC web-identity federation**. You create
a RAM identity provider that trusts the Nuphos issuer and a role that trusts that
provider; Nuphos mints a short-lived token per team and calls
`sts:AssumeRoleWithOIDC`.

**No AccessKeyId/AccessKeySecret is stored.** Nuphos keeps the role ARN and the
OIDC provider ARN, both of which the exchange requires.

<Note>
  Pick your partition when you connect: **China** (`ram.console.aliyun.com`) or
  **International** (`ram.console.alibabacloud.com`).
</Note>

## Connect

The wizard in **Connectors → Connect → Alibaba Cloud** shows the issuer, client
id, and subject for your team. Copy them from there.

### 1. Add the identity provider

In the RAM console, create an **OIDC** identity provider using the issuer URL and
client id from the wizard. Alibaba Cloud fetches the issuer's JWKS itself, so
there is no key to paste. Copy the provider's **ARN**.

### 2. Create the role

Create a role that trusts that provider, conditioned on the **subject** the
wizard shows — that is what pins the role to your team, so no other Nuphos team
can assume it. Attach a policy covering the work you want done (ACK, ECS, SWAS as
needed) and copy the role's **ARN**.

### 3. Bind the role

Enter both ARNs in Nuphos.

## In the Nuphos app

* **ECS instances** and **SWAS instances** — the account's compute.
* **Clusters** — ACK clusters land in the shared
  [cluster browser](/infrastructure/clusters) alongside EKS, GKE, and the rest.

## What the agent can do for you

The agent operates the account within whatever policy you attached to the role,
correlating it with your other [connected accounts](/connectors/overview) and
proposing changes as [plans](/agent/plans).

## Permissions & authorization

* **The role's policy** is the outer limit — Alibaba Cloud enforces it.
* **Hard boundary — who can use it.** Only team **Administrators** can bind or
  remove the account, and they can restrict it to specific members with a
  [member allow-list](/security/access-control).
* **Soft boundary — what the agent may do with it.** Reads run freely; changes go
  through [plan approvals](/security/approvals) and
  [Auto-authorization](/security/auto-mode).

See the [IAM trust model](/security/iam-trust) for how the token exchange works.