Alibaba Cloud architecture for APAC workloads

Provider-scoped consulting on this control plane is Alibaba Cloud architecture consulting. Region comparison with other providers is AWS vs Azure vs Google Cloud vs Alibaba Cloud for APAC.

Assumptions

• You have a Resource Directory, or the ability to create one, plus RAM and VPC access in the regions you will use.
• This page is Alibaba Cloud only. Do not map AWS account names onto Resource Directory members.
• China mainland and international regions are separate domains. Dual-run is two landing zones.
• Greenfield resource accounts are the default. Invited cloud accounts keep root users and are a higher-risk identity.

Resource Directory is the organization

Alibaba Cloud Resource Directory (RD) organizes multiple Alibaba Cloud accounts into a tree. Official help describes:

• Management account: the enterprise-verified account that enabled the directory. It is the administrator of folders and members. Alibaba documents that it is not subject to the directory’s access control policies. Keep it empty of production ECS, ApsaraDB and OSS.
• Root folder: the top of the tree. Create folders under it for platform, production and sandbox.
• Folder: a branch for a business line or environment. Folders hold members and subfolders.
• Member: a resource account created in the directory (root user disabled) or an invited cloud account (root user remains). Prefer resource accounts for new workloads.

Create RAM users in the management account with AliyunResourceDirectoryFullAccess for directory operations. Do not share the management account’s root password.

aliyun resourcemanager GetResourceDirectory
aliyun resourcemanager ListFolders --ParentFolderId rd-root-example
aliyun resourcemanager ListAccounts

GetResourceDirectory returns the directory ID and the management account. If the CLI errors with a message that the resource directory does not exist, you are still in a standalone account. ListAccounts shows members and their folder placement. Invited cloud accounts in that list keep root users. Treat them as a higher-risk identity than resource accounts.

Access control policies on folders are the guardrail analogue. Attach them to production folders before you vend the first member.

RAM is identity, not a rename of another cloud’s IAM

Resource Access Management (RAM) users, RAM roles and RAM policies live inside an Alibaba Cloud account. Cross-member access uses RAM roles and trust, or Resource Directory trusted services. SSO into RAM from a corporate IdP is a landing-zone task. Long-lived AccessKey pairs on RAM users used from CI are the usual leak.

RAM and Resource Directory together are the identity story. There is no IAM Identity Center product name here. There is no Entra tenant. If you need a multi-cloud map, keep Alibaba on its own row in Designing multi-cloud identity.

Regions: Singapore is not Hangzhou

International APAC regions you will see in tickets:

• ap-southeast-1 Singapore
• ap-southeast-3 Kuala Lumpur
• ap-southeast-5 Jakarta
• ap-northeast-1 Tokyo
• cn-hongkong Hong Kong

China mainland examples:

• cn-hangzhou Hangzhou
• cn-shanghai Shanghai
• cn-beijing Beijing

Mainland regions have different account, ICP and connectivity rules from the international partition. CEN documentation states that leased lines connecting the Chinese mainland with other regions are provided by China Unicom. That is a product and compliance fact, not a diagram footnote. Do not place a mainland OSS bucket as the origin for an international app and call it “one VPC.”

Pick ap-southeast-1 when users and data residency sit in Southeast Asia and you want the international control plane. Pick cn-hangzhou when the workload and the legal entity are in the mainland. Dual-run is two landing zones that share an IdP only if legal says they can.

VPC plus CEN, not a borrowed hub name

A Virtual Private Cloud (VPC) is regional. Isolate production and non-production CIDRs the way you would anywhere, then attach them deliberately.

Cloud Enterprise Network (CEN) is the private backbone. Alibaba’s product overview defines:

• A CEN instance as the container
• A transit router (TR) as the regional hub (one TR per region per CEN instance)
• Network instance connections for VPC, Virtual Border Router (VBR), VPN, Cloud Connect Network (CCN) and inter-region links
• TR route tables for isolation and inspection steering

aliyun vpc DescribeVpcs --RegionId ap-southeast-1
aliyun cbn DescribeCens
aliyun cbn DescribeCenAttachedChildInstances --CenId cen-example

DescribeVpcs in ap-southeast-1 lists Singapore VPCs only. A production VPC that exists only in cn-hangzhou will not appear. DescribeCens lists CEN instances. DescribeCenAttachedChildInstances shows which VPCs and VBRs are actually attached. A VPC with a route pointing at CEN that is missing from this list is a blackhole.

Enterprise Edition transit routers support custom route tables and service chaining (for example a security VPC). Intra-region VPC attachment is a different bill and design from inter-region bandwidth. Inter-region QoS and flow logs are documented CEN features. Use them when you need to prove which path left Singapore.

On-premises attachment is Express Connect plus a VBR on the CEN TR, not “Direct Connect” by another vendor’s name.

Logging, tags and cost

Ship ActionTrail and config data to a member that workload RAM users cannot empty. Tag members and resources with the same short dictionary you use elsewhere (cost-center, environment, application). Allocation still starts with the Resource Directory member. Tags do not replace folders.

CEN and inter-region bandwidth are first-class cost lines in APAC. Plan them the way you would any private backbone, using Alibaba’s CEN billing pages, not an AWS data-transfer table.

Risks and limitations

The management account is unconstrained by directory access control policies. That is documented. Do not run ECS there.

Invited cloud accounts retain root users. Resource accounts do not. Mixing both in a production folder without extra RAM controls is a finding.

CEN inter-region capacity is purchased or metered. “Attached” is not “unlimited.” Packet-loss operational goals in Alibaba’s CEN transmission notes assume sufficient bandwidth.

This page is Alibaba Cloud only. Copying Organizations OU names onto folders without reading Resource Directory help will miss members, RAM and CEN. Broader APAC consulting context: cloud architecture consulting in APAC. Terms: cloud glossary.