The Alibaba Cloud source plugin for CloudQuery extracts configuration from the Alibaba Cloud API and loads it into any supported CloudQuery destination
Publisher
cloudquery
Latest version
v7.0.0
Type
Source
Platforms
Date Published
Loading plugin documentation
CloudQuery's use of cookies
We use tracking cookies to understand how you use the product and help us improve it. Your consent is required before we can enable these cookies. You can opt out via the link in the footer.
postgresql destination is not shown here. See our Quickstart if you need help setting up the destination.kind: source
spec:
name: "alicloud"
path: "cloudquery/alicloud"
registry: "cloudquery"
version: "v7.0.0"
tables: ["*"]
destinations: ["postgresql"]
# Learn more about the configuration options at https://cql.ink/alicloud_source
spec:
accounts:
- name: my_account
regions:
- cn-hangzhou
- cn-beijing
- eu-west-1
- us-west-1
# ...
# Optional: provide explicit credentials (if omitted, the default credential chain is used)
# access_key: ${ALICLOUD_ACCESS_KEY}
# secret_key: ${ALICLOUD_SECRET_KEY}
# Optional: assume a RAM role for cross-account access
# role_arn: "acs:ram::<account_id>:role/<role_name>"
# role_session_name: "cloudquery" # defaults to "cloudquery"
# Optional parameters
# concurrency: 5000
# max_retry_attempts: 10
# bill_history_months: 12
organization instead of accounts to automatically discover member accounts from an Alicloud Resource Directory:kind: source
spec:
name: "alicloud"
path: "cloudquery/alicloud"
registry: "cloudquery"
version: "v7.0.0"
tables: ["*"]
destinations: ["postgresql"]
spec:
organization:
admin_account:
regions:
- cn-hangzhou
- cn-beijing
# Optional: explicit credentials for the management account
# access_key: ${ALICLOUD_ACCESS_KEY}
# secret_key: ${ALICLOUD_SECRET_KEY}
# RAM role name that exists in each member account
member_role_name: "CloudQueryReadOnly"
# Optional: session name for AssumeRole (defaults to "cloudquery")
# member_role_session_name: "cloudquery"
# Optional: override regions for member accounts (defaults to admin_account.regions)
# member_regions:
# - cn-shanghai
# Optional: only discover accounts in these folders (recursive). Empty means all accounts.
# folder_ids:
# - fd-abc123
# Optional: skip these folder IDs during traversal
# skip_folder_ids:
# - fd-sandbox
# Optional: skip these account IDs
# skip_member_accounts:
# - "123456789012"
concurrency (integer, optional, default: 5000):max_retry_attempts (integer, optional, default: 10):scheduler (string, optional, default: dfs):dfs (depth-first search), round-robin, shuffle and shuffle-queue.accounts (array[object], optional, mutually exclusive with organization):accounts or organization must be specified.name (string, required): A unique name for the account.regions (array[string], required): A list of regions to sync. For example, ["cn-hangzhou", "cn-beijing"].access_key (string, optional): A valid access key for the account. Must be provided together with secret_key. When omitted, the default credential chain is used (see Authentication section below).secret_key (string, optional): A valid secret key for the account, corresponding to the access key. Must be provided together with access_key.role_arn (string, optional): The ARN of a RAM role to assume via STS AssumeRole. Format: acs:ram::<account_id>:role/<role_name>. When set, temporary credentials are automatically refreshed.role_session_name (string, optional, default: "cloudquery"): The session name to use when assuming the role.organization (object, optional, mutually exclusive with accounts):accounts or organization must be specified.admin_account (object, required): Credentials for the management (or delegated admin) account.regions (array[string], required): Regions for the admin account. Also used as default for member accounts when member_regions is not set.access_key (string, optional): Access key for the management account. When omitted, the default credential chain is used.secret_key (string, optional): Secret key for the management account. Must be provided together with access_key.role_arn (string, optional): Role ARN to assume before calling Resource Directory APIs. This role is only used for discovery; member accounts are accessed using the admin's static credentials (or default chain) as the base for AssumeRole.role_session_name (string, optional, default: "cloudquery"): Session name when assuming the admin role.member_role_name (string, required): RAM role name to assume in each member account. The plugin constructs the ARN as acs:ram::<account_id>:role/<member_role_name>.member_role_session_name (string, optional, default: "cloudquery"): Session name for member account role assumption.member_regions (array[string], optional): Regions to sync for discovered member accounts. Falls back to admin_account.regions if empty.folder_ids (array[string], optional): Discover only accounts under these folder IDs (recursive). When empty, all accounts in the directory are discovered.skip_folder_ids (array[string], optional): Folder IDs to skip during recursive traversal.skip_member_accounts (array[string], optional): Account IDs to exclude from discovery.initialization_concurrency (integer, optional, default: 4):bill_history_months (integer, optional, default: 12):alicloud_bss_bill and alicloud_bss_bill_overview tables.access_key and secret_key are omitted from the account configuration, the plugin uses the Alibaba Cloud default credential chain, which checks the following sources in order:ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRETALIBABA_CLOUD_OIDC_* env vars)access_key: ${ALICLOUD_ACCESS_KEY}
secret_key: ${ALICLOUD_SECRET_KEY}
role_arn field in the account configuration to enable assume role:accounts:
- name: account1
regions:
- cn-hangzhou
access_key: ${ALICLOUD_ACCESS_KEY}
secret_key: ${ALICLOUD_SECRET_KEY}
role_arn: "acs:ram::123456789012:role/cloudquery-role"
# role_session_name: "cloudquery" # optional, defaults to "cloudquery"
- name: account2
regions:
- cn-beijing
# No access_key/secret_key — uses default credential chain as base
role_arn: "acs:ram::987654321098:role/cloudquery-role"
access_key and secret_key are provided, they are used as the base credentials to call STS AssumeRole. If omitted, the default credential chain is used instead.organization mode automatically discovers member accounts and assumes a RAM role in each one to sync resources.CloudQueryReadOnly) in each member account with:AliyunResourceDirectoryReadOnlyAccess)select
instance_id,
os_name,
region_id,
start_time,
tags
from
alicloud_ecs_instances
where
region_id = 'eu-west-1';
+------------------------+--------------------------------------+-----------+-------------------+---------------+
| instance_id | os_name | region_id | start_time | tags |
|------------------------+--------------------------------------+-----------+-------------------+---------------|
| i-xxxxxxxxxxxxxxxxxxxx | Alibaba Cloud Linux 3.2104 LTS 64位 | eu-west-1 | 2023-01-17T14:40Z | {"Tag": null} |
+------------------------+--------------------------------------+-----------+-------------------+---------------+
select
product_name,
item,
pip_code,
currency,
adjust_amount
from
alicloud_bss_bill_overview;
+------------------------+----------------+----------+----------+---------------+
| product_name | item | pip_code | currency | adjust_amount |
|------------------------+----------------+----------+----------+---------------|
| Object Storage Service | PayAsYouGoBill | oss | USD | 0.0 |
+------------------------+----------------+----------+----------+---------------+
select
account_id,
bucket_name,
object_count,
storage
from
alicloud_oss_bucket_stats;
+------------+-------------+--------------+---------+
| account_id | bucket_name | object_count | storage |
|------------+-------------+--------------+---------|
| test | cq-test | 2 | 29665 |
+------------+-------------+--------------+---------+