Alibaba Cloud

Alibaba Cloud

Core Capabilities

Provides expert guidance across Alibaba Cloud ecosystem:

1. Compute Services - ECS instances, Auto Scaling, Container Service (ACK), Function Compute 2. Storage & Database - OSS object storage, ApsaraDB (RDS, Redis, MongoDB), NAS, Block Storage 3. Networking - VPC, SLB (Server Load Balancer), VPN Gateway, CEN, NAT Gateway 4. Security & Identity - RAM (Resource Access Management), Security Center, WAF, Anti-DDoS 5. Application Services - API Gateway, Message Service (MNS/MQ), DirectMail, SMS 6. DevOps & Monitoring - CloudMonitor, Log Service, ARMS, Container Registry 7. CDN & Edge - Alibaba Cloud CDN, DCDN, Global Accelerator 8. Data & Analytics - DataWorks, MaxCompute, AnalyticDB, E-MapReduce

Best Practices

Architecture

• Deploy across multiple zones for high availability
• Use SLB for load balancing with health checks
• Implement Auto Scaling for dynamic capacity
• Configure CloudMonitor with actionable alerts

Security

• Enable RAM with least privilege access control
• Use Security Groups and Network ACLs for filtering
• Enable encryption at rest and in transit
• Implement WAF and Anti-DDoS for protection
• Enable ActionTrail for audit logging

Cost Optimization

• Use Reserved Instances for predictable workloads (up to 70% savings)
• Leverage Preemptible Instances for batch jobs
• Configure Auto Scaling to match demand
• Use OSS lifecycle policies for cold data
• Monitor with Cost Management dashboards

Performance

• Choose appropriate instance families and sizes
• Implement Redis/Memcache for caching
• Use CDN for static content delivery
• Configure read replicas for databases
• Enable ESSD disks for high IOPS workloads

Infrastructure as Code

Terraform for Alibaba Cloud

terraform {
  required_providers {
    alicloud = {
      source  = "aliyun/alicloud"
      version = "~> 1.200"
    }
  }
}

provider "alicloud" {
  region = "cn-hangzhou"
}

# VPC with multi-zone deployment
resource "alicloud_vpc" "main" {
  vpc_name   = "production-vpc"
  cidr_block = "10.0.0.0/16"
}

resource "alicloud_vswitch" "app" {
  vpc_id     = alicloud_vpc.main.id
  cidr_block = "10.0.1.0/24"
  zone_id    = "cn-hangzhou-h"
}

resource "alicloud_security_group" "app" {
  vpc_id = alicloud_vpc.main.id
  name   = "application-sg"
}

resource "alicloud_instance" "app" {
  instance_name              = "app-server"
  instance_type              = "ecs.g6.large"
  image_id                   = "ubuntu_20_04_x64"
  vswitch_id                 = alicloud_vswitch.app.id
  security_groups            = [alicloud_security_group.app.id]
  internet_max_bandwidth_out = 10
}

ROS (Resource Orchestration Service)

ROSTemplateFormatVersion: '2015-09-01'
Description: High availability web application
Parameters:
  InstanceType:
    Type: String
    Default: ecs.g6.large
Resources:
  VPC:
    Type: ALIYUN::ECS::VPC
    Properties:
      VpcName: ha-vpc
      CidrBlock: 10.0.0.0/16
  VSwitch:
    Type: ALIYUN::ECS::VSwitch
    Properties:
      VpcId: {Ref: VPC}
      CidrBlock: 10.0.1.0/24
      ZoneId: cn-hangzhou-h
  SLB:
    Type: ALIYUN::SLB::LoadBalancer
    Properties:
      LoadBalancerName: web-lb
      AddressType: internet
      VpcId: {Ref: VPC}
      VSwitchId: {Ref: VSwitch}

China-Specific Considerations

ICP Filing

• Required for websites hosted in mainland China
• Obtain before pointing domain to Alibaba Cloud
• Allow 20-30 business days for approval
• Different requirements for personal vs corporate

Data Residency & Compliance

• Data localization laws require China region storage
• Use: cn-hangzhou, cn-shanghai, cn-beijing, cn-shenzhen
• Understand Cybersecurity Law and Data Security Law
• Cross-border transfer requires security assessment

Network & Performance

• Great Wall Firewall impacts international connectivity
• Use China CDN for domestic users
• Use Global Accelerator for cross-border access
• Test from within China for accurate results

Migration to Alibaba Cloud

Assessment

1. Inventory infrastructure, applications, and dependencies 2. Analyze regulatory requirements (ICP, data residency) 3. Map services to Alibaba Cloud equivalents 4. Estimate costs with pricing calculator 5. Plan connectivity (VPN Gateway, Express Connect)

Strategies

• Rehost - Lift and shift with minimal changes
• Replatform - Optimize with managed services (RDS, OSS, Redis)
• Refactor - Rebuild with cloud-native services (Function Compute, ACK)
• Hybrid - Partial migration with on-premises connectivity

Execution

1. Set up account and configure RAM 2. Establish network connectivity 3. Create VPC, VSwitches, security groups 4. Migrate data to OSS/RDS 5. Deploy applications to ECS/ACK 6. Configure SLB and DNS 7. Set up CloudMonitor and Log Service 8. Test and execute cutover

See cloud-migration.md for detailed procedures

Reference Files

Load detailed documentation when needed:

• Compute Services: See compute-services.md for ECS instance families, specifications, custom images, Auto Scaling configuration, and optimization techniques

• Storage Solutions: See storage-solutions.md for OSS bucket policies, encryption, lifecycle rules, NAS setup, and storage optimization strategies

• Database Services: See database-services.md for ApsaraDB RDS, PolarDB, Redis, MongoDB configuration, tuning, backup, and high availability setup

• Infrastructure as Code: See infrastructure-as-code.md for Terraform modules, ROS templates, multi-environment patterns, and deployment automation

• Cloud Migration: See cloud-migration.md for migration assessment, service mapping, data transfer tools, and cutover procedures

Cloud Migration to Alibaba Cloud

Migration Strategies

Assessment Phase

Inventory Discovery

1. Application Inventory
   - List all applications and services
   - Identify dependencies
   - Document data flows
   - Map integration points

2. Infrastructure Inventory
   - Compute resources (VMs, containers)
   - Storage (object, block, file)
   - Databases (relational, NoSQL)
   - Networking (VPCs, load balancers, DNS)
   
3. Data Inventory
   - Data volumes
   - Data types and classifications
   - Compliance requirements
   - Backup and retention policies

Migration Approach Selection

Rehost (Lift and Shift)
├── Pros: Fast, minimal changes, low risk
├── Cons: No cloud optimization, higher long-term cost
└── Use when: Time-constrained, minimal budget, legacy apps

Replatform (Lift, Tinker, and Shift)
├── Pros: Some optimization, moderate effort
├── Cons: Testing required, moderate risk
└── Use when: Minor optimizations desired, compatible services exist

Refactor (Re-architect)
├── Pros: Full cloud-native benefits, optimized performance
├── Cons: High effort, time-consuming, expensive
└── Use when: Legacy limitations, scalability needs, modernization goals

Replace (SaaS)
├── Pros: Minimal maintenance, quick deployment
├── Cons: Vendor lock-in, limited customization
└── Use when: Standard functionality, non-differentiating systems

Retire
├── Pros: Cost savings, reduced complexity
└── Use when: Unused or redundant systems

Retain
├── Pros: No migration risk
└── Use when: Recently upgraded, not ready for cloud, compliance

Service Mapping

AWS to Alibaba Cloud

Compute

AWS EC2                 → Alibaba Cloud ECS
AWS Lambda              → Function Compute
AWS Elastic Beanstalk   → Web App Service
AWS Batch               → BatchCompute
AWS Lightsail           → Simple Application Server

Storage

AWS S3                  → OSS (Object Storage Service)
AWS EBS                 → Cloud Disk
AWS EFS                 → NAS (Network Attached Storage)
AWS Glacier             → OSS Archive/Cold Archive
AWS Storage Gateway     → Cloud Storage Gateway

Database

AWS RDS MySQL           → ApsaraDB RDS for MySQL
AWS RDS PostgreSQL      → ApsaraDB RDS for PostgreSQL
AWS Aurora              → PolarDB
AWS DynamoDB            → Table Store
AWS ElastiCache Redis   → ApsaraDB for Redis
AWS ElastiCache Memcached → ApsaraDB for Memcache
AWS DocumentDB          → ApsaraDB for MongoDB

Networking

AWS VPC                 → VPC (Virtual Private Cloud)
AWS ELB                 → SLB (Server Load Balancer)
AWS Route 53            → Alibaba Cloud DNS
AWS CloudFront          → Alibaba Cloud CDN
AWS Direct Connect      → Express Connect
AWS VPN                 → VPN Gateway
AWS API Gateway         → API Gateway

Container & Kubernetes

AWS ECS                 → Container Service
AWS EKS                 → ACK (Container Service for Kubernetes)
AWS ECR                 → Container Registry
AWS Fargate             → Serverless Kubernetes (ASK)

Security & Identity

AWS IAM                 → RAM (Resource Access Management)
AWS KMS                 → KMS (Key Management Service)
AWS WAF                 → Web Application Firewall
AWS Shield              → Anti-DDoS
AWS Security Hub        → Security Center
AWS Secrets Manager     → Secrets Manager

Monitoring & Management

AWS CloudWatch          → CloudMonitor
AWS CloudTrail          → ActionTrail
AWS Config              → Config
AWS Systems Manager     → OOS (Operation Orchestration Service)

DevOps

AWS CodePipeline        → DevOps Pipeline
AWS CodeBuild           → Container Registry Build
AWS CodeDeploy          → CodePipeline
AWS CloudFormation      → ROS (Resource Orchestration Service)

GCP to Alibaba Cloud

Compute

Compute Engine          → ECS
Cloud Functions         → Function Compute
App Engine              → Web App Service
Cloud Run               → Serverless App Engine (SAE)

Storage

Cloud Storage           → OSS
Persistent Disk         → Cloud Disk
Filestore               → NAS

Database

Cloud SQL MySQL         → ApsaraDB RDS for MySQL
Cloud SQL PostgreSQL    → ApsaraDB RDS for PostgreSQL
Cloud Spanner           → PolarDB-X
Bigtable                → Table Store (Wide Column)
Firestore               → ApsaraDB for MongoDB
Memorystore Redis       → ApsaraDB for Redis

Networking

VPC                     → VPC
Cloud Load Balancing    → SLB
Cloud CDN               → Alibaba Cloud CDN
Cloud DNS               → Alibaba Cloud DNS
Cloud Interconnect      → Express Connect
Cloud VPN               → VPN Gateway

Container & Kubernetes

GKE                     → ACK
Artifact Registry       → Container Registry
Cloud Run               → Serverless Kubernetes (ASK)

Azure to Alibaba Cloud

Compute

Azure Virtual Machines  → ECS
Azure Functions         → Function Compute
Azure App Service       → Web App Service
Azure Batch             → BatchCompute

Storage

Azure Blob Storage      → OSS
Azure Disk Storage      → Cloud Disk
Azure Files             → NAS

Database

Azure Database for MySQL     → ApsaraDB RDS for MySQL
Azure Database for PostgreSQL → ApsaraDB RDS for PostgreSQL
Azure Cosmos DB              → PolarDB / Table Store
Azure Cache for Redis        → ApsaraDB for Redis

Networking

Azure Virtual Network   → VPC
Azure Load Balancer     → SLB
Azure CDN               → Alibaba Cloud CDN
Azure DNS               → Alibaba Cloud DNS
Azure ExpressRoute      → Express Connect
Azure VPN Gateway       → VPN Gateway

Container & Kubernetes

Azure Kubernetes Service → ACK
Azure Container Registry → Container Registry
Azure Container Instances → Serverless Kubernetes (ASK)

Migration Methods

Compute Migration

VM Migration

1. Using Alibaba Cloud Migration Tool (SMC)
   - Install SMC client on source VM
   - Configure Alibaba Cloud credentials
   - Run discovery and create migration task
   - Monitor migration progress
   - Validate migrated instance

2. Manual Image Migration
   - Export VM disk image
   - Upload to OSS
   - Import as custom image
   - Launch ECS from image
   - Configure and test

3. Application-Level Migration
   - Setup target ECS instances
   - Install application dependencies
   - Deploy application code
   - Migrate configuration
   - Cutover DNS

Container Migration

1. Container Registry Migration
   docker pull source-registry.com/image:tag
   docker tag source-registry.com/image:tag target-registry.aliyuncs.com/namespace/image:tag
   docker push target-registry.aliyuncs.com/namespace/image:tag

2. Kubernetes Migration
   - Export manifests from source cluster
   - Modify for ACK compatibility
   - Deploy to ACK cluster
   - Migrate persistent volumes
   - Update DNS/ingress

Database Migration

RDS Migration Methods

1. DTS (Data Transmission Service) - Recommended

Migration Type: Full + Incremental
Source: AWS RDS MySQL / Self-hosted MySQL
Target: Alibaba Cloud RDS MySQL

Steps:
1. Create DTS migration task
2. Configure source database connection
3. Configure target database connection
4. Select migration objects (databases/tables)
5. Pre-check (connectivity, permissions, conflicts)
6. Start migration (full data + incremental sync)
7. Monitor replication lag
8. Cutover when lag < 1 second
9. Verify data integrity

2. mysqldump (For smaller databases < 100GB)

# Export from source
mysqldump -h source-host -u user -p \
  --single-transaction \
  --quick \
  --lock-tables=false \
  --databases mydb > dump.sql

# Import to target
mysql -h rm-xxxxx.mysql.rds.aliyuncs.com -u user -p mydb < dump.sql

3. Physical Backup Restore (For large databases)

# AWS RDS Snapshot → S3 → OSS → RDS Restore
1. Create RDS snapshot in AWS
2. Export snapshot to S3
3. Copy from S3 to OSS using OssImport
4. Restore from OSS to Alibaba Cloud RDS

PostgreSQL Migration

# Using pg_dump/pg_restore
pg_dump -h source-host -U user -F c -d mydb > dump.dump
pg_restore -h target-host -U user -d mydb dump.dump

# Using DTS
- Create DTS migration task
- Select PostgreSQL source/target
- Configure incremental sync
- Monitor and cutover

MongoDB Migration

# Using mongodump/mongorestore
mongodump --host source-host --port 27017 \
  --username user --password pass \
  --db mydb --out /backup

mongorestore --host dds-xxxxx.mongodb.rds.aliyuncs.com \
  --port 3717 --username user --password pass \
  --db mydb /backup/mydb

# Using DTS
- Create DTS migration task for MongoDB
- Configure source/target connections
- Select collections to migrate
- Enable incremental sync
- Cutover when lag is minimal

Redis Migration

# Using redis-shake (Alibaba tool)
./redis-shake -type sync \
  -source_address source-redis:6379 \
  -source_password pass \
  -target_address r-xxxxx.redis.rds.aliyuncs.com:6379 \
  -target_password pass

# Using RDB file
redis-cli --rdb dump.rdb
# Upload to OSS
# Import from OSS to ApsaraDB Redis

Storage Migration

Object Storage Migration

Using OssImport

# Install OssImport
wget http://gosspublic.alicdn.com/ossimport/standalone/ossimport-x.x.x.zip
unzip ossimport-x.x.x.zip
cd ossimport-x.x.x

# Configure local_job.cfg
srcType=s3
srcAccessKey=AWS_ACCESS_KEY
srcSecretKey=AWS_SECRET_KEY
srcDomain=s3.amazonaws.com
srcBucket=source-bucket
srcPrefix=folder/

destAccessKey=ALIYUN_ACCESS_KEY
destSecretKey=ALIYUN_SECRET_KEY
destDomain=oss-cn-hangzhou.aliyuncs.com
destBucket=target-bucket
destPrefix=folder/

# Run migration
bash import.sh

# Monitor progress
bash console.sh stat

Using rclone

# Configure rclone
rclone config

# Sync from S3 to OSS
rclone sync s3:source-bucket oss:target-bucket \
  --progress \
  --checkers 20 \
  --transfers 10 \
  --stats 1m

# Copy with verification
rclone copy s3:source-bucket oss:target-bucket \
  --checksum \
  --verbose

Using ossutil

# Batch upload from local
ossutil cp -r /local/path oss://bucket/path \
  --jobs 5 \
  --parallel 10

# Sync directories
ossutil sync /local/path oss://bucket/path \
  --delete \
  --update \
  --snapshot-path /path/to/snapshot

File Storage Migration

# NAS Migration using rsync
rsync -avz --progress \
  /source/mount/ \
  /alibaba-nas/mount/

# With bandwidth limit
rsync -avz --progress --bwlimit=10240 \
  /source/mount/ \
  /alibaba-nas/mount/

# Incremental sync
rsync -avz --progress --delete \
  /source/mount/ \
  /alibaba-nas/mount/

Network Migration

VPN Setup for Hybrid Connectivity

1. Setup VPN Gateway in Alibaba Cloud
   - Create VPN Gateway in VPC
   - Create Customer Gateway (source site public IP)
   - Create IPsec connection
   - Configure routing

2. Configure Source Site
   - Setup IPsec VPN client/device
   - Configure phase 1/2 parameters
   - Establish tunnel
   - Test connectivity

3. Verify Connectivity
   ping <alibaba-vpc-ip>
   traceroute <alibaba-vpc-ip>

Express Connect for Dedicated Connection

1. Apply for Express Connect
2. Physical connection setup
3. Configure VBR (Virtual Border Router)
4. Setup routing
5. Test bandwidth and latency

Migration Best Practices

Pre-Migration Checklist

Technical Assessment

□ Document current architecture
□ Identify all dependencies
□ Map data flows
□ Assess bandwidth requirements
□ Plan downtime windows
□ Identify security requirements
□ Review compliance needs

Resource Planning

□ Size target infrastructure
□ Calculate costs
□ Plan network connectivity
□ Prepare migration tools
□ Setup monitoring
□ Create rollback plan

Team Preparation

□ Train team on Alibaba Cloud
□ Define roles and responsibilities
□ Establish communication channels
□ Schedule migration windows
□ Prepare runbooks

During Migration

Best Practices

1. Use incremental migration
   - Minimize downtime
   - Reduce risk
   - Enable validation

2. Monitor continuously
   - Track migration progress
   - Watch for errors
   - Monitor performance

3. Validate data integrity
   - Compare row counts
   - Verify checksums
   - Test application functionality

4. Maintain documentation
   - Log all changes
   - Document issues and resolutions
   - Update diagrams

Cutover Checklist

□ Verify data sync lag < threshold
□ Stop writes to source
□ Final data sync
□ Verify data integrity
□ Update DNS records
□ Test application functionality
□ Monitor for errors
□ Enable production traffic
□ Keep source as backup (hot standby)

Post-Migration

Validation

□ Verify all applications running
□ Check data consistency
□ Test all integrations
□ Monitor performance
□ Review logs for errors
□ Conduct user acceptance testing

Optimization

□ Right-size resources
□ Implement cost optimizations
□ Setup auto-scaling
□ Configure backups
□ Enable monitoring alerts
□ Document final architecture

Decommission

□ Keep source running for rollback period (1-4 weeks)
□ Cancel old subscriptions
□ Delete temporary resources
□ Archive migration documentation
□ Conduct post-mortem

Migration Timeline Example

Phase 1: Assessment (2-4 weeks)

• Infrastructure discovery
• Application mapping
• Dependency analysis
• Migration strategy selection
• Cost estimation
• Team training

Phase 2: Planning (2-3 weeks)

• Detailed migration plan
• Runbook creation
• Tool setup
• Pilot migration test
• Risk assessment
• Approval process

Phase 3: Pilot Migration (1-2 weeks)

• Migrate non-critical workload
• Test procedures
• Refine runbooks
• Validate tools and processes
• Document lessons learned

Phase 4: Production Migration (4-8 weeks)

• Wave-based migration
• Continuous monitoring
• Issue resolution
• User validation
• Performance tuning

Phase 5: Optimization (2-4 weeks)

• Right-sizing
• Cost optimization
• Security hardening
• Backup configuration
• Documentation finalization

Phase 6: Decommission (2-4 weeks)

• Source environment cleanup
• Final verification
• Knowledge transfer
• Post-mortem review

Compute Services

ECS (Elastic Compute Service)

Instance Families

General Purpose (g series)

• g8i: Latest generation, Intel Ice Lake, balanced compute/memory/network
• g7: Intel Xeon, high performance for web/app servers
• g6: Cost-effective, suitable for small-medium workloads
• Use cases: Web servers, application servers, development/test environments

Compute Optimized (c series)

• c8i: Latest Intel Ice Lake, highest CPU performance
• c7: High frequency processors, compute-intensive
• c6: Cost-effective compute performance
• Use cases: High-traffic web servers, batch processing, video encoding, gaming

Memory Optimized (r series)

• r8i: Latest generation, high memory to CPU ratio
• r7: Large memory capacity for in-memory databases
• r6: Cost-effective memory-intensive workloads
• Use cases: Relational databases, in-memory caching, big data analytics

GPU Instances (gn series)

• gn7i: NVIDIA A10 GPUs, AI inference and training
• gn6v: NVIDIA V100, deep learning training
• gn6i: NVIDIA T4, cost-effective inference
• Use cases: Deep learning, AI/ML training, video rendering, HPC

Instance Selection Guide

Workload Type           → Recommended Family
--------------------------------------------------
Web/App Server          → g7, g8i (2-4 vCPU, 4-8GB RAM)
Database                → r7, r8i (4-8+ vCPU, 16-64GB+ RAM)
Big Data Processing     → r7, d2s with local SSD
Batch Jobs              → c7, c8i with auto-scaling
AI/ML Training          → gn7i, gn6v with GPU
Video Processing        → c7, gn6i
Development/Test        → g6, t6 burstable instances

Storage Options

System Disk

• ESSD PL0: Entry-level SSD, 10K IOPS
• ESSD PL1: Standard SSD, up to 50K IOPS (recommended)
• ESSD PL2: High-performance SSD, up to 100K IOPS
• ESSD PL3: Ultra high-performance, up to 1M IOPS

Data Disk

• Attach multiple data disks up to 64 disks per instance
• Use LVM for multiple disk aggregation
• Enable encryption for sensitive data

Auto Scaling Configuration

Scaling Policies

# Target Tracking Policy
Metric: CPU Utilization
Target: 70%
Warm-up: 300 seconds
Cooldown: 300 seconds

# Scheduled Policy
Schedule: 0 8 * * * (8 AM daily)
Action: Add 5 instances
Min Instances: 2
Max Instances: 20

# Step Scaling Policy
When CPU > 80%: Add 3 instances
When CPU > 90%: Add 5 instances
When CPU < 30%: Remove 2 instances

Best Practices

• Set appropriate min/max instance counts
• Use target tracking for predictable workloads
• Combine scheduled and dynamic scaling
• Configure sufficient warm-up time
• Use custom metrics for application-specific scaling
• Test scaling policies in non-production first

Network Configuration

Network Types

• VPC: Recommended for production, isolated network
• Classic Network: Legacy, not recommended for new deployments

Security Groups

Inbound Rules:
- Allow HTTP (80) from 0.0.0.0/0
- Allow HTTPS (443) from 0.0.0.0/0
- Allow SSH (22) from specific IP ranges only
- Allow application ports from SLB security group only

Outbound Rules:
- Allow all traffic (default)
- Or restrict to specific destinations for security

ENI (Elastic Network Interface)

• Primary ENI automatically attached
• Attach secondary ENIs for multi-network scenarios
• Each ENI can have multiple private IPs
• Associate EIP for public internet access

Instance Initialization

Cloud-init Example

#cloud-config
packages:
  - docker
  - git
  - nginx

runcmd:
  - systemctl enable docker
  - systemctl start docker
  - docker pull myapp:latest
  - docker run -d -p 80:80 myapp:latest

write_files:
  - path: /etc/app/config.yaml
    content: |
      app:
        env: production
        port: 80

Monitoring and Management

CloudMonitor Metrics

• CPU utilization
• Memory usage (requires agent)
• Disk IOPS and throughput
• Network in/out traffic
• Disk usage (requires agent)

Alerting Rules

CPU > 80% for 5 minutes → Send notification
Disk usage > 85% → Send alert
Instance status check failed → Trigger auto-restart

Pricing Models

Pay-As-You-Go

• Billed per second
• No long-term commitment
• Most flexible, higher unit cost

Subscription (Reserved Instances)

• 1 month to 5 years
• Save up to 70% vs pay-as-you-go
• Best for stable workloads

Preemptible Instances

• Up to 90% discount
• May be reclaimed with 5-minute notice
• Best for fault-tolerant, stateless workloads

Function Compute

Function Types

Event Functions

• Triggered by events (OSS, Log Service, API Gateway)
• Async execution
• Use for: Image processing, log analysis, data ETL

HTTP Functions

• Triggered by HTTP requests
• Sync execution
• Use for: APIs, webhooks, microservices

Configuration Best Practices

Memory and Timeout

Light processing:   512 MB, 3 seconds
Data processing:    1024-2048 MB, 60 seconds
Video processing:   3072 MB, 600 seconds
Batch jobs:         4096 MB, 900 seconds

Environment Variables

• Store configuration in environment variables
• Use sensitive data store for secrets
• Avoid hardcoding credentials

VPC Access

• Enable VPC access to connect to RDS, Redis
• Configure NAT Gateway for internet access
• Use VPC security groups for network control

Trigger Configuration

OSS Trigger

Event: oss:ObjectCreated:PutObject
Prefix: uploads/
Suffix: .jpg
Use case: Image thumbnail generation

API Gateway Trigger

Method: POST
Path: /api/users
Auth: JWT token validation
Use case: RESTful API endpoints

Timer Trigger

Cron: 0 2 * * * (2 AM daily)
Use case: Data cleanup, report generation

Cold Start Optimization

Best Practices

• Keep deployment package small (< 50MB)
• Use layers for common dependencies
• Initialize connections outside handler
• Use provisioned instances for critical functions
• Implement connection pooling
• Cache frequently accessed data

Example Structure

import json
import redis

# Initialize outside handler (reused across invocations)
redis_client = redis.Redis(
    host='your-redis.redis.rds.aliyuncs.com',
    port=6379,
    decode_responses=True
)

def handler(event, context):
    # Handler code here
    data = redis_client.get('key')
    return {
        'statusCode': 200,
        'body': json.dumps(data)
    }

Monitoring and Logging

Built-in Metrics

• Invocations
• Errors
• Duration
• Throttles
• Memory usage

Custom Logging

import logging
logger = logging.getLogger()

def handler(event, context):
    logger.info(f'Processing event: {event}')
    # Function logic
    logger.error(f'Error occurred: {error}')

Cost Optimization

Best Practices

• Right-size memory allocation (charges based on GB-seconds)
• Optimize function duration
• Use async processing where possible
• Implement caching to reduce invocations
• Use scheduled functions during off-peak hours
• Monitor and eliminate unused functions

Database Services

RDS (Relational Database Service)

Supported Engines

MySQL

• Versions: 5.6, 5.7, 8.0
• Max connections: Up to 10,000
• Storage: 20GB - 64TB
• Use cases: Web applications, e-commerce, CMS

PostgreSQL

• Versions: 10, 11, 12, 13, 14, 15
• Advanced features: JSON, full-text search, PostGIS
• Use cases: Complex queries, geospatial data, data warehousing

SQL Server

• Versions: 2008 R2, 2012, 2016, 2017, 2019, 2022
• Editions: Web, Standard, Enterprise
• Use cases: .NET applications, Windows environments

MariaDB

• Compatible with MySQL
• Enhanced performance and features
• Use cases: MySQL migration, high-performance scenarios

Instance Specifications

Basic Edition

• Single node (no HA)
• Cost-effective for dev/test
• Not recommended for production

High-Availability Edition

• Primary-standby architecture
• Auto-failover within 30 seconds
• Recommended for production

Cluster Edition (MySQL/PostgreSQL)

• 1 primary + 1+ read replicas
• Higher read capacity
• Auto-failover and load balancing

Storage Types

ESSD (Enhanced SSD)

PL1: 50,000 IOPS, 150 MB/s (standard)
PL2: 100,000 IOPS, 350 MB/s (high performance)
PL3: 1,000,000 IOPS, 4,000 MB/s (ultra performance)

SSD

• Legacy option
• Lower performance than ESSD
• Consider ESSD PL1 for new deployments

Selection Guide

Workload              Storage Type    Size
---------------------------------------------
Dev/Test              ESSD PL1        20-100GB
Small Production      ESSD PL1        100-500GB
Medium Production     ESSD PL2        500GB-2TB
Large Production      ESSD PL3        2TB+
Analytics/DW          ESSD PL3        1TB+

Network Configuration

VPC Setup

1. Create RDS in VPC
2. Select VSwitch in availability zone
3. Configure security group/IP whitelist
4. Enable internal endpoint for ECS access
5. Optional: Enable public endpoint (with EIP)

Security Group Rules

Type: Custom TCP
Port: 3306 (MySQL), 5432 (PostgreSQL), 1433 (SQL Server)
Source: 
  - ECS security group (recommended)
  - VPC CIDR block
  - Specific IP addresses

IP Whitelist

# Internal access
192.168.0.0/16

# Specific ECS instances
172.16.1.10
172.16.1.11

# On-premises via VPN
10.0.0.0/8

Read-Only Instances

Configuration

Primary Instance
├── Read-Only Instance 1 (same zone)
├── Read-Only Instance 2 (different zone)
└── Read-Only Instance 3 (different zone)

Read-Only Routing

Read Endpoint: rr-xxxxxx.mysql.rds.aliyuncs.com
Delay Threshold: 30 seconds
Load Balancing: Least connections
Weight Distribution: Auto (based on specs)

Use Cases

• Offload read traffic from primary
• Analytics and reporting queries
• Read-heavy application scaling
• Cross-AZ disaster recovery

Best Practices

• Match specs with primary for consistent performance
• Monitor replication lag
• Route heavy analytics to read replicas
• Use multiple read replicas across AZs

Backup and Recovery

Automatic Backup

Backup Time: 02:00-03:00 (off-peak)
Retention: 7-730 days (7 days default)
Backup Method: 
  - Physical (faster restore)
  - Logical (smaller backup size)
Backup Frequency: Daily

Snapshot Backup

# Manual snapshot
Create before:
- Schema changes
- Application upgrades
- Data migrations

Retention: Permanent (until manually deleted)

Point-in-Time Recovery (PITR)

Recovery Window: Within backup retention period
Granularity: Any point in time (5-minute intervals)
Method: Restore to new instance
Use cases: 
  - Recover from accidental deletion
  - Rollback bad deployment
  - Create test environment from production

Recovery Procedures

1. Clone to New Instance
   - Creates new RDS from backup/snapshot
   - Original instance remains unchanged
   - Useful for testing recovery

2. Overwrite Current Instance
   - Restores data to existing instance
   - Causes downtime
   - Use for critical recovery only

Performance Optimization

Parameter Tuning (MySQL)

-- Connection pool
max_connections = 1000
wait_timeout = 300
interactive_timeout = 300

-- Buffer pool (70-80% of RAM)
innodb_buffer_pool_size = 8G
innodb_buffer_pool_instances = 8

-- Query cache (use with caution in 5.7, removed in 8.0)
query_cache_type = 0  # Disable for write-heavy workloads

-- Logging
slow_query_log = 1
long_query_time = 2
log_queries_not_using_indexes = 1

-- InnoDB settings
innodb_flush_log_at_trx_commit = 2  # Relaxed durability
innodb_log_file_size = 512M
innodb_io_capacity = 2000

Query Optimization

-- Use EXPLAIN to analyze queries
EXPLAIN SELECT * FROM users WHERE email = 'user@example.com';

-- Create appropriate indexes
CREATE INDEX idx_email ON users(email);
CREATE INDEX idx_status_created ON orders(status, created_at);

-- Avoid SELECT *
SELECT id, name, email FROM users WHERE status = 'active';

-- Use prepared statements
PREPARE stmt FROM 'SELECT * FROM users WHERE id = ?';

Monitoring Metrics

• CPU utilization (< 70% average)
• Memory usage (< 80%)
• IOPS (< 80% of provisioned)
• Connections (< 80% of max)
• Replication lag (< 10 seconds)
• Slow query count
• Lock waits

Security

SSL/TLS Connection

import pymysql

connection = pymysql.connect(
    host='rm-xxxxxx.mysql.rds.aliyuncs.com',
    user='username',
    password='password',
    database='mydb',
    ssl={'ca': '/path/to/ca-cert.pem'}
)

Transparent Data Encryption (TDE)

-- Enable TDE (MySQL 5.7+)
ALTER TABLE sensitive_data ENCRYPTION='Y';

-- PostgreSQL (enabled at instance level)
-- Automatic for all tables

SQL Audit

Enable SQL Audit for compliance:
- All SQL statements logged
- Retention: 30 days to 5 years
- Filter by: User, Database, SQL type
- Export to OSS or Log Service

RAM Access Control

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:DescribeDBInstances",
        "rds:DescribeBackups"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "rds:ModifySecurityIps",
        "rds:CreateBackup"
      ],
      "Resource": "acs:rds:*:*:dbinstance/rm-xxxxxx"
    }
  ]
}

PolarDB

Architecture

Compute-Storage Separation

Compute Nodes (1 Primary + N Read-Only)
         ↓
Shared Storage Pool (up to 100TB)
         ↓
3-way Replication (across AZs)

Key Features

• Storage scales independently
• Add read nodes without storage copy
• Faster failover (< 30 seconds)
• Parallel queries (PolarDB-X)

Use Cases

vs RDS MySQL

Choose PolarDB when:
- Need > 10TB storage
- Heavy read workloads (> 5 read replicas)
- Rapid scaling requirements
- Cost-sensitive large databases

Choose RDS MySQL when:
- < 10TB storage
- Simple deployment
- MySQL compatibility critical
- Budget constrained (smaller instances)

Cluster Configuration

Node Specifications

polar.mysql.x2.medium: 2 cores, 4GB RAM
polar.mysql.x4.large: 4 cores, 16GB RAM
polar.mysql.x4.xlarge: 8 cores, 32GB RAM
polar.mysql.x8.xlarge: 8 cores, 64GB RAM
polar.mysql.x8.4xlarge: 32 cores, 256GB RAM

Cluster Endpoint Types

• Primary Endpoint: All write operations
• Cluster Endpoint: Auto read/write splitting
• Custom Endpoint: Specific read node group

Multi-Zone Deployment

Configuration

Primary Node: Zone A
Read Node 1: Zone B
Read Node 2: Zone C

Storage Replication:
- Zone A: Primary copy
- Zone B: Replica 1
- Zone C: Replica 2

Benefits

• High availability across AZ failures
• Lower latency for distributed users
• Disaster recovery

Redis (ApsaraDB for Redis)

Editions

Community Edition

• Open source Redis compatibility
• Standard/Cluster architecture
• Cost-effective

Enhanced Edition (Tair)

• Alibaba-optimized
• Additional data structures
• Better performance

Architecture Types

Standard (Master-Replica)

Master Node
    ↓
Replica Node

• 256MB - 64GB
• Basic high availability
• Use for: Small apps, dev/test

Cluster (Sharded)

Shard 1: Master + Replica
Shard 2: Master + Replica
Shard 3: Master + Replica
...
Shard 256: Master + Replica (max)

• 4GB - 8TB
• Horizontal scaling
• Use for: Large datasets, high throughput

Read/Write Splitting

Master (writes)
    ↓
Replica 1 (reads) ─┐
Replica 2 (reads) ─┼→ Read Endpoint
Replica 3 (reads) ─┘

• Offload read traffic
• Up to 5 read replicas
• Use for: Read-heavy workloads

Configuration Best Practices

Memory Management

maxmemory-policy: allkeys-lru
maxmemory: 80% of instance memory

# For cache use case
maxmemory-policy: volatile-lru  # Expire keys with TTL first

# For persistent data
maxmemory-policy: noeviction  # Return error when full

Connection Pooling

import redis

pool = redis.ConnectionPool(
    host='r-xxxxxx.redis.rds.aliyuncs.com',
    port=6379,
    password='password',
    max_connections=50,
    socket_timeout=5,
    socket_connect_timeout=5
)

r = redis.Redis(connection_pool=pool)

Persistence

# RDB snapshot
save 900 1      # Save if 1 key changed in 900s
save 300 10     # Save if 10 keys changed in 300s
save 60 10000   # Save if 10000 keys changed in 60s

# AOF (append-only file)
appendonly yes
appendfsync everysec  # Balance between durability and performance

Performance Optimization

Key Design

# Good: Use namespaces
user:1000:profile
user:1000:sessions
order:2000:details

# Bad: No structure
user_1000_profile
u1000s
order2000

Data Structure Selection

Use Case                  Structure       Command
--------------------------------------------------
Counter                   String          INCR, DECR
Cache                     String          SET, GET with TTL
Queue                     List            LPUSH, RPOP
Leaderboard              Sorted Set       ZADD, ZRANGE
Session                   Hash            HSET, HGET
Unique visitors          Set/HyperLogLog  SADD, PFADD

Batch Operations

# Use pipeline for multiple operations
pipe = r.pipeline()
pipe.set('key1', 'value1')
pipe.set('key2', 'value2')
pipe.set('key3', 'value3')
pipe.execute()

# Use mget for multiple keys
values = r.mget(['key1', 'key2', 'key3'])

Avoid Large Keys

# Problem
HSET large_hash field1 value1  # Repeat millions of times

# Solution: Split into smaller keys
HSET user:1000:data:0 field1 value1
HSET user:1000:data:1 field1001 value1001

Monitoring and Alerts

Key Metrics

CPU Usage: < 70%
Memory Usage: < 80%
Connections: < max_connections
Hit Rate: > 90%
Network Traffic: Monitor bandwidth
Slow Queries: < 10ms threshold

CloudMonitor Alerts

Alert when:
- Memory usage > 85% for 5 minutes
- CPU usage > 80% for 5 minutes
- Connection count > 80% of max
- Hit rate < 80%

MongoDB (ApsaraDB for MongoDB)

Deployment Types

Standalone

• Single node
• Dev/test only
• Not for production

Replica Set

• 1 Primary + 1-5 Secondaries
• Auto-failover
• Production ready

Sharded Cluster

• Horizontal scaling
• Multiple shards with replica sets
• Handle large datasets (> 1TB)

Sharding Strategy

Choose Shard Key

// Good shard keys (high cardinality, even distribution)
{userId: 1}  // If users are evenly distributed
{tenantId: 1, timestamp: 1}  // Compound key
{customerId: "hashed"}  // Hashed shard key

// Bad shard keys
{status: 1}  // Low cardinality (few unique values)
{timestamp: 1}  // Monotonically increasing (hot shard)

Shard Configuration

Shard 1: 3-node replica set (Zones A, B, C)
Shard 2: 3-node replica set (Zones A, B, C)
Shard 3: 3-node replica set (Zones A, B, C)

Config Servers: 3-node replica set
Mongos Routers: 2+ nodes

Best Practices

Schema Design

// Embed related data (1:1, 1:few)
{
  _id: ObjectId("..."),
  name: "John Doe",
  address: {
    street: "123 Main St",
    city: "Beijing"
  },
  phones: ["123-456-7890", "098-765-4321"]
}

// Reference for 1:many, many:many
{
  _id: ObjectId("..."),
  userId: ObjectId("user_id"),
  products: [ObjectId("prod1"), ObjectId("prod2")]
}

Indexing

// Create indexes for queries
db.users.createIndex({email: 1}, {unique: true})
db.orders.createIndex({userId: 1, createdAt: -1})

// Compound index for multiple fields
db.products.createIndex({category: 1, price: -1})

// Text index for search
db.articles.createIndex({title: "text", content: "text"})

// Monitor index usage
db.users.aggregate([{$indexStats: {}}])

Read Preference

// Primary (default): All reads from primary
db.collection.find().readPref("primary")

// Secondary: Read from secondaries (eventual consistency)
db.collection.find().readPref("secondary")

// Nearest: Read from nearest node (lowest latency)
db.collection.find().readPref("nearest")

Write Concern

// Acknowledged (default)
db.collection.insertOne({...}, {writeConcern: {w: 1}})

// Majority: Wait for majority of nodes
db.collection.insertOne({...}, {writeConcern: {w: "majority"}})

// Custom: Wait for specific number
db.collection.insertOne({...}, {writeConcern: {w: 3}})

Monitoring

Key Metrics

• CPU and memory usage
• Disk IOPS and throughput
• Replication lag
• Connection count
• Query execution time
• Operation counters (insert/update/delete/query)

Slow Query Analysis

// Enable profiling
db.setProfilingLevel(1, {slowms: 100})  // Log queries > 100ms

// View slow queries
db.system.profile.find().sort({ts: -1}).limit(10)

// Analyze query performance
db.collection.find({...}).explain("executionStats")

Infrastructure as Code

Terraform for Alibaba Cloud

Provider Configuration

Basic Setup

terraform {
  required_providers {
    alicloud = {
      source  = "aliyun/alicloud"
      version = "~> 1.210"
    }
  }
  required_version = ">= 1.0"
}

provider "alicloud" {
  access_key = var.access_key
  secret_key = var.secret_key
  region     = var.region
}

# Better: Use assume role for security
provider "alicloud" {
  region = var.region
  assume_role {
    role_arn     = "acs:ram::123456789:role/TerraformRole"
    session_name = "terraform-session"
  }
}

Environment Variables

export ALICLOUD_ACCESS_KEY="your-access-key"
export ALICLOUD_SECRET_KEY="your-secret-key"
export ALICLOUD_REGION="cn-hangzhou"

State Management

Remote Backend (OSS)

terraform {
  backend "oss" {
    bucket              = "terraform-state-bucket"
    prefix              = "prod"
    key                 = "terraform.tfstate"
    region              = "cn-hangzhou"
    tablestore_endpoint = "https://tf-state-lock.cn-hangzhou.ots.aliyuncs.com"
    tablestore_table    = "terraform_state_lock"
  }
}

State Locking with TableStore

# Create TableStore for locking
resource "alicloud_ots_instance" "state_lock" {
  name        = "tf-state-lock"
  description = "Terraform state lock"
  accessed_by = "Any"
  tags = {
    Environment = "production"
    Purpose     = "terraform-lock"
  }
}

resource "alicloud_ots_table" "state_lock" {
  instance_name = alicloud_ots_instance.state_lock.name
  table_name    = "terraform_state_lock"
  primary_key {
    name = "LockID"
    type = "String"
  }
  time_to_live = -1
  max_version  = 1
}

VPC and Networking

VPC Module

module "vpc" {
  source = "./modules/vpc"

  vpc_name       = "production-vpc"
  vpc_cidr       = "10.0.0.0/16"
  
  availability_zones = ["cn-hangzhou-h", "cn-hangzhou-i", "cn-hangzhou-j"]
  
  public_subnets  = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  private_subnets = ["10.0.11.0/24", "10.0.12.0/24", "10.0.13.0/24"]
  
  enable_nat_gateway = true
  enable_vpn_gateway = false
  
  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

VPC Resource

resource "alicloud_vpc" "main" {
  vpc_name   = var.vpc_name
  cidr_block = var.vpc_cidr
  
  tags = merge(
    var.tags,
    {
      Name = var.vpc_name
    }
  )
}

resource "alicloud_vswitch" "public" {
  count             = length(var.public_subnets)
  vpc_id            = alicloud_vpc.main.id
  cidr_block        = var.public_subnets[count.index]
  zone_id           = var.availability_zones[count.index]
  vswitch_name      = "${var.vpc_name}-public-${count.index + 1}"
  
  tags = merge(
    var.tags,
    {
      Name = "${var.vpc_name}-public-${count.index + 1}"
      Type = "public"
    }
  )
}

resource "alicloud_vswitch" "private" {
  count             = length(var.private_subnets)
  vpc_id            = alicloud_vpc.main.id
  cidr_block        = var.private_subnets[count.index]
  zone_id           = var.availability_zones[count.index]
  vswitch_name      = "${var.vpc_name}-private-${count.index + 1}"
  
  tags = merge(
    var.tags,
    {
      Name = "${var.vpc_name}-private-${count.index + 1}"
      Type = "private"
    }
  )
}

resource "alicloud_nat_gateway" "main" {
  count              = var.enable_nat_gateway ? 1 : 0
  vpc_id             = alicloud_vpc.main.id
  nat_gateway_name   = "${var.vpc_name}-nat"
  nat_type           = "Enhanced"
  vswitch_id         = alicloud_vswitch.public[0].id
  payment_type       = "PayAsYouGo"
  
  tags = merge(
    var.tags,
    {
      Name = "${var.vpc_name}-nat"
    }
  )
}

resource "alicloud_eip_address" "nat" {
  count                = var.enable_nat_gateway ? 1 : 0
  address_name         = "${var.vpc_name}-nat-eip"
  internet_charge_type = "PayByTraffic"
  bandwidth            = "100"
}

resource "alicloud_eip_association" "nat" {
  count         = var.enable_nat_gateway ? 1 : 0
  allocation_id = alicloud_eip_address.nat[0].id
  instance_id   = alicloud_nat_gateway.main[0].id
}

resource "alicloud_snat_entry" "private" {
  count             = var.enable_nat_gateway ? length(var.private_subnets) : 0
  snat_table_id     = alicloud_nat_gateway.main[0].snat_table_ids
  source_vswitch_id = alicloud_vswitch.private[count.index].id
  snat_ip           = alicloud_eip_address.nat[0].ip_address
}

ECS Instance Module

Module Structure

# modules/ecs/main.tf
resource "alicloud_security_group" "main" {
  name        = "${var.name_prefix}-sg"
  vpc_id      = var.vpc_id
  description = "Security group for ${var.name_prefix}"
  
  tags = var.tags
}

resource "alicloud_security_group_rule" "allow_ssh" {
  type              = "ingress"
  ip_protocol       = "tcp"
  port_range        = "22/22"
  security_group_id = alicloud_security_group.main.id
  cidr_ip           = var.allowed_ssh_cidr
}

resource "alicloud_instance" "main" {
  count                = var.instance_count
  instance_name        = "${var.name_prefix}-${count.index + 1}"
  instance_type        = var.instance_type
  image_id             = var.image_id
  vswitch_id           = var.vswitch_ids[count.index % length(var.vswitch_ids)]
  security_groups      = [alicloud_security_group.main.id]
  internet_charge_type = var.allocate_public_ip ? "PayByTraffic" : null
  internet_max_bandwidth_out = var.allocate_public_ip ? var.internet_bandwidth : 0
  
  system_disk_category = var.system_disk_type
  system_disk_size     = var.system_disk_size
  
  dynamic "data_disks" {
    for_each = var.data_disks
    content {
      category = data_disks.value.type
      size     = data_disks.value.size
      name     = "${var.name_prefix}-data-${data_disks.key}"
    }
  }
  
  user_data = var.user_data
  
  tags = merge(
    var.tags,
    {
      Name  = "${var.name_prefix}-${count.index + 1}"
      Index = count.index + 1
    }
  )
}

# modules/ecs/variables.tf
variable "name_prefix" {
  type        = string
  description = "Prefix for resource names"
}

variable "vpc_id" {
  type        = string
  description = "VPC ID"
}

variable "vswitch_ids" {
  type        = list(string)
  description = "List of VSwitch IDs"
}

variable "instance_count" {
  type        = number
  default     = 1
  description = "Number of instances to create"
}

variable "instance_type" {
  type        = string
  description = "ECS instance type"
}

variable "image_id" {
  type        = string
  description = "Image ID"
}

variable "system_disk_type" {
  type        = string
  default     = "cloud_essd"
  description = "System disk type"
}

variable "system_disk_size" {
  type        = number
  default     = 40
  description = "System disk size in GB"
}

variable "data_disks" {
  type = list(object({
    type = string
    size = number
  }))
  default     = []
  description = "List of data disks"
}

variable "allocate_public_ip" {
  type        = bool
  default     = false
  description = "Allocate public IP"
}

variable "internet_bandwidth" {
  type        = number
  default     = 10
  description = "Internet bandwidth in Mbps"
}

variable "allowed_ssh_cidr" {
  type        = string
  default     = "0.0.0.0/0"
  description = "CIDR for SSH access"
}

variable "user_data" {
  type        = string
  default     = ""
  description = "User data script"
}

variable "tags" {
  type        = map(string)
  default     = {}
  description = "Tags to apply to resources"
}

# modules/ecs/outputs.tf
output "instance_ids" {
  value       = alicloud_instance.main[*].id
  description = "List of instance IDs"
}

output "private_ips" {
  value       = alicloud_instance.main[*].private_ip
  description = "List of private IPs"
}

output "public_ips" {
  value       = alicloud_instance.main[*].public_ip
  description = "List of public IPs"
}

output "security_group_id" {
  value       = alicloud_security_group.main.id
  description = "Security group ID"
}

Usage Example

module "web_servers" {
  source = "./modules/ecs"
  
  name_prefix         = "web"
  vpc_id              = module.vpc.vpc_id
  vswitch_ids         = module.vpc.public_vswitch_ids
  instance_count      = 3
  instance_type       = "ecs.g7.large"
  image_id            = "ubuntu_20_04_x64_20G_alibase_20230208.vhd"
  system_disk_size    = 40
  allocate_public_ip  = true
  internet_bandwidth  = 100
  
  data_disks = [
    {
      type = "cloud_essd"
      size = 100
    }
  ]
  
  user_data = templatefile("${path.module}/templates/web_init.sh", {
    app_version = var.app_version
    environment = "production"
  })
  
  tags = {
    Environment = "production"
    Application = "web"
    ManagedBy   = "terraform"
  }
}

RDS Module

RDS Instance

# modules/rds/main.tf
resource "alicloud_db_instance" "main" {
  engine               = var.engine
  engine_version       = var.engine_version
  instance_type        = var.instance_type
  instance_storage     = var.storage_size
  instance_storage_type = var.storage_type
  instance_name        = var.instance_name
  vswitch_id           = var.vswitch_id
  security_ips         = var.security_ips
  
  # High Availability
  zone_id              = var.primary_zone_id
  zone_id_slave_a      = var.secondary_zone_id
  instance_charge_type = var.charge_type
  
  # Backup configuration
  backup_period        = var.backup_period
  backup_time          = var.backup_time
  backup_retention_period = var.backup_retention_period
  
  # Maintenance window
  maintenance_window   = var.maintenance_window
  
  # Monitoring
  monitoring_period    = 60
  
  # Security
  ssl_action           = var.enable_ssl ? "Open" : "Close"
  
  tags = var.tags
}

resource "alicloud_db_database" "main" {
  for_each      = toset(var.databases)
  instance_id   = alicloud_db_instance.main.id
  name          = each.value
  character_set = var.character_set
}

resource "alicloud_db_account" "main" {
  for_each     = var.accounts
  db_instance_id = alicloud_db_instance.main.id
  account_name = each.key
  account_password = each.value.password
  account_type     = each.value.type
}

resource "alicloud_db_account_privilege" "main" {
  for_each = {
    for item in flatten([
      for account, config in var.accounts : [
        for db in config.databases : {
          account = account
          database = db
          privilege = config.privilege
        }
      ]
    ]) : "${item.account}-${item.database}" => item
  }
  
  instance_id  = alicloud_db_instance.main.id
  account_name = each.value.account
  db_names     = [each.value.database]
  privilege    = each.value.privilege
  
  depends_on = [
    alicloud_db_database.main,
    alicloud_db_account.main
  ]
}

resource "alicloud_db_readonly_instance" "replica" {
  count               = var.readonly_instance_count
  master_db_instance_id = alicloud_db_instance.main.id
  engine_version      = alicloud_db_instance.main.engine_version
  instance_type       = var.readonly_instance_type
  instance_storage    = var.storage_size
  instance_name       = "${var.instance_name}-ro-${count.index + 1}"
  vswitch_id          = var.vswitch_id
  zone_id             = var.readonly_zone_ids[count.index % length(var.readonly_zone_ids)]
  
  tags = merge(
    var.tags,
    {
      Type = "readonly"
    }
  )
}

# modules/rds/variables.tf
variable "instance_name" {
  type        = string
  description = "RDS instance name"
}

variable "engine" {
  type        = string
  description = "Database engine (MySQL, PostgreSQL, etc.)"
}

variable "engine_version" {
  type        = string
  description = "Engine version"
}

variable "instance_type" {
  type        = string
  description = "Instance type"
}

variable "storage_size" {
  type        = number
  description = "Storage size in GB"
}

variable "storage_type" {
  type        = string
  default     = "cloud_essd"
  description = "Storage type"
}

variable "vswitch_id" {
  type        = string
  description = "VSwitch ID"
}

variable "primary_zone_id" {
  type        = string
  description = "Primary zone ID"
}

variable "secondary_zone_id" {
  type        = string
  default     = ""
  description = "Secondary zone ID for HA"
}

variable "security_ips" {
  type        = list(string)
  description = "IP whitelist"
}

variable "charge_type" {
  type        = string
  default     = "Postpaid"
  description = "Charge type (Postpaid or Prepaid)"
}

variable "backup_period" {
  type        = list(string)
  default     = ["Monday", "Wednesday", "Friday"]
  description = "Backup days"
}

variable "backup_time" {
  type        = string
  default     = "02:00Z-03:00Z"
  description = "Backup time window"
}

variable "backup_retention_period" {
  type        = number
  default     = 7
  description = "Backup retention in days"
}

variable "maintenance_window" {
  type        = string
  default     = "Mon:03:00Z-Mon:04:00Z"
  description = "Maintenance window"
}

variable "enable_ssl" {
  type        = bool
  default     = true
  description = "Enable SSL connection"
}

variable "character_set" {
  type        = string
  default     = "utf8mb4"
  description = "Character set for databases"
}

variable "databases" {
  type        = list(string)
  default     = []
  description = "List of databases to create"
}

variable "accounts" {
  type = map(object({
    password  = string
    type      = string
    privilege = string
    databases = list(string)
  }))
  default     = {}
  description = "Database accounts"
}

variable "readonly_instance_count" {
  type        = number
  default     = 0
  description = "Number of read-only instances"
}

variable "readonly_instance_type" {
  type        = string
  default     = ""
  description = "Read-only instance type"
}

variable "readonly_zone_ids" {
  type        = list(string)
  default     = []
  description = "Zone IDs for read-only instances"
}

variable "tags" {
  type        = map(string)
  default     = {}
  description = "Tags"
}

Usage Example

module "database" {
  source = "./modules/rds"
  
  instance_name      = "production-mysql"
  engine             = "MySQL"
  engine_version     = "8.0"
  instance_type      = "mysql.n4.medium.1"
  storage_size       = 100
  storage_type       = "cloud_essd"
  vswitch_id         = module.vpc.private_vswitch_ids[0]
  primary_zone_id    = "cn-hangzhou-h"
  secondary_zone_id  = "cn-hangzhou-i"
  
  security_ips = [
    module.vpc.vpc_cidr,
    "172.16.0.0/16"
  ]
  
  databases = ["app_db", "analytics_db"]
  
  accounts = {
    app_user = {
      password  = var.db_app_password
      type      = "Normal"
      privilege = "ReadWrite"
      databases = ["app_db"]
    }
    analytics_user = {
      password  = var.db_analytics_password
      type      = "Normal"
      privilege = "ReadOnly"
      databases = ["analytics_db"]
    }
    admin = {
      password  = var.db_admin_password
      type      = "Super"
      privilege = "DBOwner"
      databases = ["app_db", "analytics_db"]
    }
  }
  
  readonly_instance_count = 2
  readonly_instance_type  = "mysql.n4.medium.1"
  readonly_zone_ids       = ["cn-hangzhou-i", "cn-hangzhou-j"]
  
  backup_period            = ["Monday", "Wednesday", "Friday", "Sunday"]
  backup_time              = "02:00Z-03:00Z"
  backup_retention_period  = 30
  
  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

Best Practices

Project Structure

terraform/
├── environments/
│   ├── dev/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── terraform.tfvars
│   │   └── backend.tf
│   ├── staging/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── terraform.tfvars
│   │   └── backend.tf
│   └── prod/
│       ├── main.tf
│       ├── variables.tf
│       ├── terraform.tfvars
│       └── backend.tf
├── modules/
│   ├── vpc/
│   ├── ecs/
│   ├── rds/
│   ├── slb/
│   └── oss/
└── shared/
    ├── variables.tf
    └── outputs.tf

Variable Management

# Use sensitive variables
variable "db_password" {
  type      = string
  sensitive = true
}

# Use validation
variable "environment" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

# Use descriptions
variable "instance_type" {
  type        = string
  description = "ECS instance type (e.g., ecs.g7.large)"
}

Resource Naming

locals {
  name_prefix = "${var.project}-${var.environment}"
  
  common_tags = {
    Project     = var.project
    Environment = var.environment
    ManagedBy   = "terraform"
    CreatedAt   = timestamp()
  }
}

resource "alicloud_vpc" "main" {
  vpc_name = "${local.name_prefix}-vpc"
  tags     = local.common_tags
}

State Management

• Use remote state with OSS
• Enable state locking
• Use workspaces for environments
• Never commit .tfstate files
• Regular state backups

Module Design

• Keep modules focused and reusable
• Use semantic versioning for modules
• Document inputs and outputs
• Include examples in module README
• Test modules independently

ROS (Resource Orchestration Service)

Template Structure

Basic Template

ROSTemplateFormatVersion: '2015-09-01'
Transform: 'Aliyun::Serverless-2018-04-03'
Description: 'Production infrastructure stack'

Parameters:
  VpcCidr:
    Type: String
    Default: '10.0.0.0/16'
    Description: 'VPC CIDR block'
  
  Environment:
    Type: String
    AllowedValues:
      - dev
      - staging
      - prod
    Default: prod
    Description: 'Environment name'

Resources:
  Vpc:
    Type: 'ALIYUN::ECS::VPC'
    Properties:
      CidrBlock: !Ref VpcCidr
      VpcName: !Sub '${Environment}-vpc'
      Tags:
        - Key: Environment
          Value: !Ref Environment
        - Key: ManagedBy
          Value: ROS

  VSwitch1:
    Type: 'ALIYUN::ECS::VSwitch'
    Properties:
      VpcId: !Ref Vpc
      ZoneId: !Select ['0', !GetAZs '']
      CidrBlock: '10.0.1.0/24'
      VSwitchName: !Sub '${Environment}-vswitch-1'

  VSwitch2:
    Type: 'ALIYUN::ECS::VSwitch'
    Properties:
      VpcId: !Ref Vpc
      ZoneId: !Select ['1', !GetAZs '']
      CidrBlock: '10.0.2.0/24'
      VSwitchName: !Sub '${Environment}-vswitch-2'

  SecurityGroup:
    Type: 'ALIYUN::ECS::SecurityGroup'
    Properties:
      VpcId: !Ref Vpc
      SecurityGroupName: !Sub '${Environment}-sg'
      SecurityGroupIngress:
        - PortRange: 22/22
          Priority: 1
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
        - PortRange: 80/80
          Priority: 1
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
        - PortRange: 443/443
          Priority: 1
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp

Outputs:
  VpcId:
    Description: 'VPC ID'
    Value: !Ref Vpc
  
  VSwitchIds:
    Description: 'VSwitch IDs'
    Value: !Join
      - ','
      - - !Ref VSwitch1
        - !Ref VSwitch2
  
  SecurityGroupId:
    Description: 'Security Group ID'
    Value: !Ref SecurityGroup

Nested Stacks

# Parent stack
Resources:
  NetworkStack:
    Type: 'ALIYUN::ROS::Stack'
    Properties:
      TemplateURL: 'oss://my-bucket/templates/network.yaml'
      Parameters:
        VpcCidr: !Ref VpcCidr
        Environment: !Ref Environment
  
  ComputeStack:
    Type: 'ALIYUN::ROS::Stack'
    Properties:
      TemplateURL: 'oss://my-bucket/templates/compute.yaml'
      Parameters:
        VpcId: !GetAtt NetworkStack.Outputs.VpcId
        VSwitchIds: !GetAtt NetworkStack.Outputs.VSwitchIds

Best Practices

Template Organization

• Break large templates into nested stacks
• Use parameters for flexibility
• Document all parameters and resources
• Version control templates in Git
• Store templates in OSS for reuse

Change Sets

• Preview changes before applying
• Review all modifications
• Test in non-production first
• Have rollback plan ready

Stack Policies

• Protect critical resources
• Prevent accidental deletion
• Use policies for production stacks

Storage Solutions

OSS (Object Storage Service)

Bucket Configuration

Storage Classes

• Standard: Frequent access, low latency, high throughput
• Infrequent Access (IA): Less frequent access, lower storage cost
• Archive: Long-term archival, lowest cost, retrieval time required
• Cold Archive: Ultra-low cost, longer retrieval time (hours)

Use Case Mapping

Hot data (daily access)      → Standard
Warm data (monthly access)   → IA
Cold data (yearly access)    → Archive
Compliance archives          → Cold Archive

Access Control

Bucket Policies

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetObject"
      ],
      "Resource": [
        "acs:oss:*:*:my-bucket/public/*"
      ],
      "Principal": ["*"]
    },
    {
      "Effect": "Deny",
      "Action": [
        "oss:PutObject"
      ],
      "Resource": [
        "acs:oss:*:*:my-bucket/protected/*"
      ],
      "Principal": ["*"]
    }
  ]
}

RAM Policy Example

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:ListBuckets",
        "oss:GetBucket*"
      ],
      "Resource": [
        "acs:oss:*:*:*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetObject",
        "oss:PutObject",
        "oss:DeleteObject"
      ],
      "Resource": [
        "acs:oss:*:*:my-bucket/user-${ram:user-name}/*"
      ]
    }
  ]
}

Signed URLs

import oss2

auth = oss2.Auth('AccessKeyId', 'AccessKeySecret')
bucket = oss2.Bucket(auth, 'https://oss-cn-hangzhou.aliyuncs.com', 'my-bucket')

# Generate signed URL (expires in 1 hour)
url = bucket.sign_url('GET', 'file.pdf', 3600)

# Upload with signed URL
upload_url = bucket.sign_url('PUT', 'upload.jpg', 3600)

Encryption

Server-Side Encryption (SSE)

• SSE-OSS: Managed by OSS using AES-256
• SSE-KMS: Managed by KMS with envelope encryption
• SSE-C: Customer-provided keys

Configuration

# Enable SSE-OSS at bucket level
bucket.put_bucket_encryption(
    oss2.models.ServerSideEncryptionRule(
        sse_algorithm='AES256'
    )
)

# Enable SSE-KMS
bucket.put_bucket_encryption(
    oss2.models.ServerSideEncryptionRule(
        sse_algorithm='KMS',
        kms_master_key_id='your-kms-key-id'
    )
)

Lifecycle Management

Example Rules

<LifecycleConfiguration>
  <Rule>
    <ID>Delete old logs</ID>
    <Prefix>logs/</Prefix>
    <Status>Enabled</Status>
    <Expiration>
      <Days>30</Days>
    </Expiration>
  </Rule>
  
  <Rule>
    <ID>Archive old backups</ID>
    <Prefix>backups/</Prefix>
    <Status>Enabled</Status>
    <Transition>
      <Days>90</Days>
      <StorageClass>Archive</StorageClass>
    </Transition>
  </Rule>
  
  <Rule>
    <ID>Transition to IA</ID>
    <Prefix>documents/</Prefix>
    <Status>Enabled</Status>
    <Transition>
      <Days>30</Days>
      <StorageClass>IA</StorageClass>
    </Transition>
  </Rule>
</LifecycleConfiguration>

Versioning

Enable Versioning

bucket.put_bucket_versioning(
    oss2.models.BucketVersioningConfig(oss2.BUCKET_VERSIONING_ENABLE)
)

# List object versions
for obj in oss2.ObjectVersionIterator(bucket, prefix='documents/'):
    print(f'{obj.key}, {obj.versionid}, {obj.is_latest}')

# Restore specific version
bucket.copy_object(
    source_bucket_name='my-bucket',
    source_key='file.txt',
    target_key='file.txt',
    params={'versionId': 'version-id'}
)

Cross-Region Replication

Configuration

<ReplicationConfiguration>
  <Rule>
    <ID>Replicate to backup region</ID>
    <Prefix>critical/</Prefix>
    <Status>Enabled</Status>
    <Destination>
      <Bucket>acs:oss:oss-cn-beijing::backup-bucket</Bucket>
      <Location>oss-cn-beijing</Location>
    </Destination>
    <HistoricalObjectReplication>enabled</HistoricalObjectReplication>
  </Rule>
</ReplicationConfiguration>

Use Cases

• Disaster recovery and backup
• Data sovereignty and compliance
• Latency optimization for global users
• Aggregate logs from multiple regions

CDN Integration

Enable CDN for OSS

1. Create CDN domain
2. Set origin as OSS bucket endpoint
3. Configure cache rules
4. Enable HTTPS with SSL certificate
5. Configure access control

Cache Rules

File Type       TTL     Priority
--------------------------------
.jpg, .png      1 day   1
.css, .js       7 days  2
.html           1 hour  3

Performance Optimization

Multipart Upload

# For files > 100MB
import oss2

bucket = oss2.Bucket(auth, endpoint, bucket_name)

# Initialize multipart upload
upload_id = bucket.init_multipart_upload('large-file.zip').upload_id

# Upload parts (can be parallel)
parts = []
part_size = 10 * 1024 * 1024  # 10MB per part
with open('large-file.zip', 'rb') as f:
    part_number = 1
    while True:
        data = f.read(part_size)
        if not data:
            break
        result = bucket.upload_part('large-file.zip', upload_id, part_number, data)
        parts.append(oss2.models.PartInfo(part_number, result.etag))
        part_number += 1

# Complete upload
bucket.complete_multipart_upload('large-file.zip', upload_id, parts)

Resumable Upload

# Automatically handles interruption and resume
oss2.resumable_upload(
    bucket,
    'large-file.zip',
    'local-file.zip',
    multipart_threshold=10 * 1024 * 1024,
    part_size=10 * 1024 * 1024,
    num_threads=4
)

Batch Operations

# Delete multiple objects
bucket.batch_delete_objects(['file1.txt', 'file2.txt', 'file3.txt'])

# List objects with pagination
for obj in oss2.ObjectIterator(bucket, prefix='documents/', max_keys=100):
    print(obj.key)

Image Processing

URL-based Processing

# Resize to 200x200
https://bucket.oss-cn-hangzhou.aliyuncs.com/image.jpg?x-oss-process=image/resize,w_200,h_200

# Add watermark
?x-oss-process=image/watermark,text_SGVsbG8,color_FF0000,size_30

# Multiple operations (pipeline)
?x-oss-process=image/resize,w_300|image/watermark,text_Logo

Supported Operations

• Resize, crop, rotate
• Watermark (text/image)
• Format conversion
• Quality adjustment
• Blur, sharpen, brightness

Monitoring and Logging

Access Logging

# Enable access logging
bucket.put_bucket_logging(
    oss2.models.BucketLogging(
        target_bucket='log-bucket',
        target_prefix='oss-access-logs/'
    )
)

Real-time Log Service

# Enable real-time logging to SLS
bucket.put_bucket_logging_config(
    oss2.models.PutBucketLoggingRequest(
        logging_enabled=oss2.models.LoggingEnabled(
            target_bucket='log-bucket',
            target_prefix='realtime-logs/'
        )
    )
)

Metrics to Monitor

• Request count
• Traffic (inbound/outbound)
• Error rates (4xx, 5xx)
• Average latency
• Storage capacity

NAS (Network Attached Storage)

NAS Types

Capacity NAS

• Cost-effective for large-scale storage
• 1PB+ capacity
• Use cases: Big data, backup, archiving

Performance NAS

• High throughput and IOPS
• < 1ms latency
• Use cases: Databases, high-performance computing

Extreme NAS

• Ultra-high performance
• Up to 100GB/s throughput
• Use cases: AI training, HPC, media processing

Mount Configuration

Linux (NFSv3/NFSv4)

# Install NFS client
yum install -y nfs-utils

# Create mount point
mkdir -p /mnt/nas

# Mount NAS
mount -t nfs -o vers=3,nolock,proto=tcp,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 \
  file-system-id.region.nas.aliyuncs.com:/ /mnt/nas

# Persistent mount (add to /etc/fstab)
echo "file-system-id.region.nas.aliyuncs.com:/ /mnt/nas nfs vers=3,nolock,proto=tcp,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 0 0" >> /etc/fstab

Windows (SMB)

# Map network drive
net use Z: \\file-system-id.region.nas.aliyuncs.com\myshare /persistent:yes

Performance Optimization

Best Practices

• Use appropriate mount options (rsize/wsize)
• Enable async writes for better performance
• Use multiple mount points for parallelism
• Monitor bandwidth and IOPS usage
• Configure appropriate file system quotas

Access Control

Permission Groups

Rule Type: IP Address
IP Address: 192.168.1.0/24
Permission: Read/Write
User Mapping: root -> nobody (squash)

VPC Configuration

• Create NAS file system in VPC
• Add mount targets in VSwitches
• Configure security groups to allow NFS/SMB ports

Table Store (NoSQL)

Data Model

Table Structure

Table
├── Primary Keys (1-4 columns)
│   ├── Partition Key (required)
│   └── Sort Keys (optional, 1-3)
└── Attribute Columns (unlimited)

Use Cases

Time Series Data

Table: metrics
PK: device_id, timestamp
Attributes: temperature, humidity, pressure
TTL: 30 days

User Profile

Table: users
PK: user_id
Attributes: name, email, preferences (JSON), last_login
Global Secondary Index: email

Shopping Cart

Table: carts
PK: user_id, item_id
Attributes: quantity, price, added_at

Index Types

Global Secondary Index (GSI)

• Different partition key from main table
• Supports different attributes
• Async replication

Local Secondary Index (LSI)

• Same partition key as main table
• Different sort key
• Strongly consistent reads

Best Practices

Schema Design

• Choose partition key with high cardinality
• Use sort key for range queries
• Limit attribute column size (< 2MB per row)
• Use sparse columns for optional data
• Implement TTL for time-bound data

Performance

• Pre-shard tables for high write throughput
• Use batch operations for bulk reads/writes
• Enable auto-scaling for capacity units
• Monitor throttling and adjust capacity
• Use indexes strategically (cost vs query needs)

Cost Optimization

• Use reserved capacity for predictable workloads
• Enable TTL to automatically delete old data
• Compress large attribute values
• Use on-demand capacity for unpredictable traffic