Alibaba Cloud Explained: ECS, Regions, and the Console
How Alibaba Cloud is organised: the international site and console, RAM users and roles, regions and zones including ICP rules, ECS instance families, images, disks, VPC networking, billing modes and quotas.
Alibaba Cloud is the largest cloud provider in mainland China and one of the biggest in Asia Pacific, with a global footprint that also reaches Europe, the Middle East and North America. Its flagship compute product is Elastic Compute Service (ECS). This guide explains how an Alibaba Cloud account is organised, how the console and RAM identity system work, how regions and zones are laid out, what ECS instances are made of, which other core services matter, and what to watch on billing and compliance.
Accounts, the international site and the console
Alibaba Cloud runs two largely separate services: the international site at alibabacloud.com, which serves customers outside mainland China, and the China site at aliyun.com. Accounts, billing and some product catalogues differ between them, and an account on one does not log in to the other. Most readers of this guide will be on the international site.
The account you register is the Alibaba Cloud account, sometimes called the root account. It owns every resource and every bill. The console at the top shows a region selector, a product menu that spans compute, storage, networking, databases, security and AI, and an account menu for billing and identity. The console layout is similar to other hyperscalers, but the naming is Alibaba’s own: for example, load balancing is SLB and object storage is OSS.
Verification requirements differ by site and by product. The international site asks for a payment method and may ask for identity verification before some services or higher quotas are enabled; those requirements are set by Alibaba Cloud and should be followed as written.
RAM: users, roles and policies
Identity and access is handled by Resource Access Management (RAM). The pattern will be familiar to anyone who has used AWS IAM. You keep the root account for billing and emergencies, then create RAM users for people and applications. Each RAM user can have a console password, an AccessKey pair for API and CLI use, or both. RAM roles are identities that a trusted entity (a RAM user, an Alibaba Cloud service, or an external identity provider) assumes for a period, which is the right way to give an ECS instance permission to call other services without storing a key on it.
Permissions come from policies, either system policies such as AliyunECSFullAccess or custom JSON policies you write. Policies attach to users, groups or roles. Resource groups let you segment resources within one account by project and apply policies at that level, and Resource Directory organises multiple accounts into folders with a shared management account for large organisations.
Turn on multi-factor authentication for the root account and for every RAM user with console access. Alibaba Cloud also offers ActionTrail, which records management API calls across the account; enable it and deliver the logs to an OSS bucket or Log Service project from day one.
Regions and zones
Alibaba Cloud groups infrastructure into regions, each containing one or more zones with independent power and networking. Regions in mainland China include Hangzhou, Shanghai, Beijing, Shenzhen and others; regions outside the mainland include Hong Kong, Singapore, Jakarta, Kuala Lumpur, Manila, Bangkok, Tokyo, Seoul, Sydney, Dubai, Riyadh, Frankfurt, London, Silicon Valley and Virginia. The current list is published on the global locations page.
Two points matter for planning. First, resources are regional: an ECS instance, its disks, its VPC and its snapshots live in one region, and moving between regions means copying images or snapshots. Second, hosting a public website on servers in mainland China regions requires an ICP filing with Chinese authorities. If you do not have one, use Hong Kong, Singapore or another region outside the mainland, which is what most international customers do.
Elastic Compute Service: instances, images, disks and networks
An ECS instance is a virtual machine defined by an instance type from a family: general purpose (g), compute optimised (c), memory optimised (r), burstable (t), plus GPU, big data and local-disk families. Generations are numbered, so ecs.g7 and ecs.g8 are successive general-purpose generations. Burstable instances accumulate CPU credits and suit light, spiky workloads.
Instances boot from an image: public images for Alibaba Cloud Linux, Ubuntu, Debian, CentOS successors, Windows Server and others; custom images you build from an instance; shared images from other accounts; or Marketplace images with software preinstalled. Storage comes from cloud disks, with ESSD as the mainstream tier in several performance levels, plus lower-cost tiers for less demanding data. Disks can be resized, snapshotted and attached to other instances in the same zone.
Networking is built on VPC with vSwitches as the zone-level subnets. A security group is the stateful firewall attached to each instance. Public access comes from an Elastic IP (EIP) or a public address assigned at creation, and bandwidth is billed either by traffic or by fixed bandwidth, which is a distinctive part of Alibaba Cloud pricing worth reading closely. ECS is described in full on the ECS product page.
| ECS concept | Meaning |
|---|---|
| Instance type | vCPU, memory and generation, e.g. ecs.g7.large |
| Image | Public, custom, shared or Marketplace operating system template |
| Cloud disk | Block storage; ESSD performance levels are the common choice |
| Security group | Stateful instance-level firewall |
| vSwitch | Subnet inside a VPC, bound to one zone |
| EIP | Public IPv4 address you can reassign |
Other core services, billing modes and quotas
Around ECS sit the services a typical stack needs: OSS for object storage, ApsaraDB RDS for managed MySQL, PostgreSQL and SQL Server, PolarDB as the cloud-native relational database, SLB for load balancing, Alibaba Cloud CDN, Container Service for Kubernetes (ACK), Function Compute for serverless, and Simple Application Server as a lightweight VPS-style alternative to full ECS. On the AI side, Platform for AI (PAI) and Model Studio expose Alibaba’s Qwen model family. Anti-DDoS Basic protection is included with public IPs.
Billing has two main modes. Subscription is prepaid for a term of months or years and is cheaper per month for steady workloads. Pay-as-you-go is metered per second or hour and suits variable use. Preemptible (spot) instances, reserved instances and savings plans layer discounts on top. Subscription resources must be renewed or they are released after a grace period, so track renewal dates carefully.
Quotas are managed in Quota Center, which shows limits on instance counts, vCPUs per region, EIPs and more, and lets you apply for increases with a stated reason. Trial and promotional terms are set by Alibaba Cloud and change frequently; the listing on the CloudAccountHub product page is labelled Alibaba Cloud Free Trial, which restates the account type as listed. Every account is bound by Alibaba Cloud’s terms of service and acceptable use policy, including its rules on outbound email and content hosted in each jurisdiction.
Where to go next
- See the listed variant on the Alibaba Cloud account product page.
- Read Cloud audit logs explained for why ActionTrail belongs in your first-day setup.
- See where an Asia Pacific provider fits in Multi-cloud for small teams.
- Learn how to pick a location in Cloud regions and availability zones.
- Browse every guide in the Cloud Library.