:topic_type: task
[.task]
[#idee726cec-b150-4834-b1f3-1c41e7ade8a8]
== Set Up Your Alibaba Account

Configure your Alibaba account to enable Prisma Cloud to retrieve and analyze configuration logs for monitoring your cloud resources.

Prisma Cloud enables visibility and monitoring of your Alibaba Cloud infrastructure in Mainland China and International regions. The first step to monitoring your resources on Alibaba Cloud is to grant Prisma Cloud access to your account. To achieve this, you must create a role and attach policies that enable permissions to authorize access to the assets deployed within the account. You can choose to create a custom policy with granular permissions or use the Alibaba Cloud system policy to enable *ReadOnlyAccess*. After you create the role and the permissions are enabled, you can add the Alibaba Cloud Resource Name (ARN) on Prisma Cloud to assume the role to monitor your Alibaba Cloud account.


[.procedure]
. tt:[(Required if you want to enable granular access permissions)] Create a custom policy.
+
Creating a custom policy allows you to use the principle of least privilege and enable the bare-minimum permissions that Prisma Cloud requires to monitor your account. To avoid updating these permissions periodically, you can skip ahead to step 2 *Create a RAM role* and use the Alibaba Cloud system policy to enable *ReadOnlyAccess* permissions to all aliyun services.
+
.. Download the https://redlock-public.s3.amazonaws.com/alibaba_cloud/alibaba-ram-policy-readonly-document[permissions for Alibaba China].
+
The JSON file includes the required permissions.

.. Log in to the Alibaba Cloud Console for China region.

.. Select *Resource Access Management > Permissions > Policies > Create Policy*.

.. Select the *JSON* tab and paste the JSON file contents into the field.
+
image::connect/alibaba-json-permissions.png[]

.. Select *Next to edit policy information*.

.. Enter a new *Policy Name*, *Description*, and select *OK*.
+
image::connect/alibaba-cloud-account-custom-policy.png[]

. Create a RAM role.
+
To authorize API access to Prisma Cloud, you must create a RAM role and attach policies. You can choose the *Custom Policy* with granular permissions or use the Alibaba Cloud *System Policy* to enable *ReadOnlyAccess* permissions.
+
.. On the Alibaba Cloud console, select *Resource Access Management > Identities > Roles*.

.. Select *Create Role*.
+
image::connect/alibaba-cloud-account-create-ram-role.png[]

.. Select Trusted entity type as *Alibaba Cloud Account* and *Next*.

.. Enter a *RAM Role Name*.

.. Enter the Prisma Cloud Account ID as a trusted Alibaba Cloud account.
+
If your Prisma Cloud instance is on https://app.prismacloud.cn, the Prisma Cloud Account ID is *1306560418200997*. Otherwise, the Prisma Cloud Account ID is *5770382605230796*.
+
Enter the appropriate account ID in *Select Trusted Alibaba Cloud Account > Other Alibaba Cloud Account* and select *OK*.
+
image::connect/alibaba-cloud-account-ram-account-id.png[]

.. Select *Add Permissions to RAM Role*.
+
//Changes based on RLP-83602
Set the *Authorized Scope* to Alibaba cloud account and attach the permissions associated with the custom policy (if you created one), or use the system policy.
+
*** Custom Policy
+
image::connect/alibaba-cloud-account-add-permissions-custom.png[]

*** System Policy
+
image::connect/alibaba-cloud-account-add-permissions-system.png[]

.. Select *OK* and then *Complete*.

. Copy the Alibaba Cloud Resource Name (ARN).
+
You need the ARN to add the Alibaba cloud account on Prisma Cloud.
+
.. Select *Roles* and search for the name you entered earlier.
+
image::connect/alibaba-cloud-account-ram-role.png[]

.. Note the ARN.
+
image::connect/alibaba-cloud-account-ram-role-arn.png[]

. xref:add-alibaba-cloud-account-to-prisma-cloud.adoc[Add an Alibaba Cloud Account on Prisma Cloud].