Unified Security Posture for Your Alibaba Cloud Workloads, Region by Region
Alibaba Cloud's rapid regional expansion introduces security blind spots that Western-centric CSPM tools routinely miss. Onam brings the same continuous, rule-driven coverage to AliCloud — RAM policies, OSS buckets, RDS instances, and VPC configurations — that your AWS and Azure environments already have.
Services we monitor on Alibaba Cloud
Every service below is scanned continuously — no agents, no network changes, read-only.
Plus: MaxCompute, DataWorks, MSE, API Gateway, Container Registry, Anti-DDoS, and more.
Compliance frameworks
Onam maps every Alibaba Cloud finding to the frameworks your auditors care about.
Connect in 3 steps
From consent to first finding in under five minutes.
Create a RAM role for Onam
Provision a read-only RAM role with the AliyunReadOnlyAccess and AliyunActionTrailReadOnlyAccess system policies. Trust policy pins Onam's account with a per-tenant external ID.
Paste the Role ARN into Onam
Multi-account Resource Directory customers connect once at the master account — every member account is discovered and onboarded automatically.
First findings in under 5 minutes
Onam assumes the RAM role across every enabled region — including China and international — and returns prioritized findings mapped to your frameworks.
Alibaba Cloud in the real console.
Not a mockup — the actual Onam console on a live demo account: connect, inventory and posture in one view.
What makes Onam different on Alibaba Cloud
China-region coverage without compromise
Onam operates in AliCloud's China regions with the same depth as international regions — including MLPS-relevant controls — while keeping your data plane inside your tenancy.
RAM effective-permission analysis
System policies, custom policies, and permission boundaries are combined into a single effective-access graph — so a user assumed to be scoped is proven, not trusted.
OSS + VPC exposure chain
OSS bucket ACLs, bucket policies, Block Public Access, and the CDN in front of them are evaluated together so any internet-reachable path is surfaced end to end.
Questions we get a lot
Ready to secure your Alibaba Cloud environment?
Connect a read-only role in three minutes. Your first findings surface in under five.