> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-security-model-and-authentication.md). # Alibaba Cloud security model and authentication Cortex Cloud implements a defense-in-depth security model built on the principle of least privilege. Every permission granted to Cortex Cloud is read-only and has a clear purpose. This section describes the security principles, authentication mechanisms, and operational safeguards that protect your Alibaba Cloud environment. ### **Security principles** * **No static credentials:** Cortex Cloud never stores or exchanges static access keys. Authentication relies entirely on OIDC-based Workload Identity Federation with short-lived temporary credentials. * **Minimal permissions by default:** Cortex Cloud operates with the minimum read-only permissions scoped to specific Alibaba Cloud services. No write permissions are provisioned. The permission set cannot be expanded through the onboarding process. * **Permission transparency:** Every permissions is mapped to a specific Alibaba Cloud API action. The complete permission set is visible in the Terraform authentication template before deployment, allowing security review prior to granting access. * **Cloud-native identity and trust:** Authentication uses Alibaba Cloud's native OIDC provider and STS service. All permissions and resources are provisioned through a customer-reviewed Terraform template to ensure transparency. ### **Authentication mechanisms** Cortex Cloud uses a single OIDC-based identity flow for all operations (discovery and permissions analysis). Alibaba Cloud onboarding uses one identity for all access. The authentication flow works as follows: 1. The Cortex Service Account in the Cortex-managed GCP project obtains a GCP ID token with the audience `alibaba-cortex-wif-`. 2. The token is presented to the OIDC Identity Provider in the customer's Alibaba Cloud account. 3. The OIDC provider validates the token and Cortex Cloud calls Alibaba Cloud STS `AssumeRoleWithOIDC` at `sts..aliyuncs.com`. 4. STS issues temporary credentials with a session name of `Cortex-WIF-Session` and a maximum session duration of 55 minutes (3300 seconds). 5. Cortex Cloud uses the temporary credentials to assume the CortexPlatformRole and perform read-only discovery and permissions analysis. ### **Security considerations** Cortex Cloud incorporates the following security considerations to protect your Alibaba Cloud environment: * **No persistent credentials:** OIDC tokens have a maximum expiry of 1 hour (3600 seconds) and STS sessions expire after 55 minutes (3300 seconds). Credentials are never stored. Instead, they are obtained on demand and discarded after use. * **Single identity, minimal blast radius:** A single RAM role with read-only permissions limits the blast radius. Compromising the role grants no write access to any Alibaba Cloud resource. * **Auditability:** All Cortex Cloud operations are logged in Alibaba Cloud ActionTrail under the session name Cortex-WIF-Session. SOC teams can monitor and audit all Cortex access patterns independently. * **Operational control:** The CortexPlatformRole can be disabled or deleted at any time in the Alibaba Cloud console to immediately revoke Cortex Cloud access. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-security-model-and-authentication.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.