Overview

When connecting your Alibaba Cloud Object Storage Service (OSS) buckets to Cloney for data migration, it's essential to follow the principle of least privilege. This guide walks you through creating RAM (Resource Access Management) credentials with only the permissions necessary for Cloney to read from or write to your OSS buckets.

Security Best Practice

Never use your Alibaba Cloud root account credentials. Always create dedicated RAM users with minimal required permissions.

Prerequisites

  • An Alibaba Cloud account with administrative access to RAM
  • The name and region of the OSS bucket(s) you want to connect
  • Knowledge of whether you need read-only (source) or write (destination) access

Step 1: Access the RAM Console

  1. Sign in to the Alibaba Cloud RAM Console
  2. In the left navigation pane, click Users under Identities
  3. Click Create User
  4. Enter a username (e.g., cloney-migration-user)
  5. Select Programmatic Access to enable AccessKey creation
  6. Click OK

Step 2: Create a Source Bucket Policy (Read-Only)

If your OSS bucket will be used as a source for migration (data will be read from it), create this custom policy:

  1. In the RAM console, go to Permissions → Policies
  2. Click Create Policy
  3. Select Script mode and paste the following policy:
JSON - Source Bucket Policy
{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "oss:GetObject",
                "oss:GetObjectAcl",
                "oss:ListObjects",
                "oss:ListObjectVersions",
                "oss:GetBucketLocation",
                "oss:GetBucketInfo"
            ],
            "Resource": [
                "acs:oss:*:*:YOUR-BUCKET-NAME",
                "acs:oss:*:*:YOUR-BUCKET-NAME/*"
            ]
        }
    ]
}
Important

Replace YOUR-BUCKET-NAME with your actual OSS bucket name.

Step 3: Create a Destination Bucket Policy (Write Access)

If your OSS bucket will be used as a destination for migration (data will be written to it), use this policy:

JSON - Destination Bucket Policy
{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "oss:PutObject",
                "oss:PutObjectAcl",
                "oss:GetObject",
                "oss:ListObjects",
                "oss:GetBucketLocation",
                "oss:GetBucketInfo",
                "oss:AbortMultipartUpload",
                "oss:ListMultipartUploads",
                "oss:ListParts"
            ],
            "Resource": [
                "acs:oss:*:*:YOUR-BUCKET-NAME",
                "acs:oss:*:*:YOUR-BUCKET-NAME/*"
            ]
        }
    ]
}

Step 4: Attach Policy to User

  1. Name the policy (e.g., CloneySourcePolicy or CloneyDestinationPolicy)
  2. Click OK to create the policy
  3. Go back to Users and click on your newly created user
  4. Click the Permissions tab
  5. Click Grant Permission
  6. Select Custom Policy and find your policy
  7. Click OK to attach the policy

Step 5: Create AccessKey

  1. On the user details page, click the AccessKey tab
  2. Click Create AccessKey
  3. Complete any security verification required
  4. Download or copy the AccessKey ID and AccessKey Secret
Important

The AccessKey Secret is only displayed once. Make sure to save it securely.

Using Credentials in Cloney

When configuring Alibaba Cloud OSS in Cloney, you'll need:

  • Access Key ID: The AccessKey ID from your RAM user
  • Access Key Secret: The AccessKey Secret from your RAM user
  • Region: The region where your bucket is located (e.g., oss-cn-hangzhou)
  • Bucket Name: The name of your OSS bucket
Ready to Connect

You can now use these credentials in Cloney to connect your Alibaba Cloud OSS bucket securely.

OSS Regions Reference

Common Alibaba Cloud OSS regions:

Region IDLocation
oss-cn-hangzhouHangzhou, China
oss-cn-shanghaiShanghai, China
oss-cn-beijingBeijing, China
oss-cn-shenzhenShenzhen, China
oss-ap-southeast-1Singapore
oss-ap-northeast-1Tokyo, Japan
oss-us-west-1Silicon Valley, USA
oss-eu-central-1Frankfurt, Germany