Series
Inside Alibaba Cloud
Ten months testing what Alibaba Cloud's security, AI, and infrastructure services actually do under pressure, not what the documentation says they do.
- 01
RAM Policies Look Like RBAC. They Don't Behave Like It.
RAM and RBAC both use roles and policies. That surface similarity hides a structural difference that changes how a permission mistake actually plays out.
12 Nov 2025 · 9 min read
- 02
What ActionTrail Actually Records When Something Goes Wrong
Turning on ActionTrail feels like turning on visibility. It's closer to turning on one particular kind of visibility, with real gaps that only show up when you go looking for them.
10 Dec 2025 · 9 min read
- 03
A Security Group Is Not a Firewall, Even Though Alibaba Cloud Lets You Pretend It Is
It's tempting to treat an ECS security group as 'the firewall' for a workload. That framing quietly drops the parts of the traffic path a security group was never designed to see.
14 Jan 2026 · 10 min read
- 04
The Model You Deployed on PAI Is Not the Model You Trained
It's comforting to think of deployment as a copy operation. Testing that assumption on Alibaba Cloud's PAI platform turned up a measurable gap between training-time and serving-time behavior.
11 Feb 2026 · 10 min read
- 05
ACK Removes the Cluster You Manage. Not the One You're Responsible For.
Moving to Alibaba Cloud's managed Kubernetes service removed a real category of operational burden. It removed none of the security decisions that actually determine whether a cluster is safe.
10 Mar 2026 · 9 min read
- 06
An OSS Bucket Set to 'Private' Isn't Always Private
Public bucket exposure is one of the oldest cloud misconfiguration classes there is. Testing it directly on OSS showed exactly how a bucket set to private can still leak individual objects.
8 Apr 2026 · 10 min read
- 07
Anti-DDoS Basic Is a Default, Not a Defense
Free, built-in DDoS protection sounds like a solved problem until you find the specific number where it stops being free protection and starts being a decision you need to make.
6 May 2026 · 9 min read
- 08
I Gave an AI Agent Real Alibaba Cloud Credentials. Here's What It Did.
Agentic AI tools are increasingly given direct cloud access to get things done. The interesting risk isn't that they'll refuse the task. It's what they'll do in service of completing it.
9 Jun 2026 · 9 min read
- 09
Elastic GPU Service Is Elastic Until You Actually Need It to Be
Elasticity is a claim about behavior under contention, not behavior under normal conditions. Most of us only ever test the second one.
14 Jul 2026 · 10 min read
- 10
Cloud Firewall Logs Everything, Except What It Drops
Closing out ten months of testing Alibaba Cloud with the same question the series opened on: a control that stops something is not automatically a control that tells you about it.
11 Aug 2026 · 10 min read