Connect Alibaba Cloud

Connect Alibaba Cloud through Bill Subscription files in OSS and a read-only RAM role created by a ROS template.

Connect Alibaba Cloud

Let CostGlass read the bill files Alibaba Cloud delivers to your own storage bucket, through a read-only role that only CostGlass can use.

Where in CostGlassSettings → Cloud Accounts → Alibaba Cloud

PlanDepends on your plan's connection limit

Who can do thisAn Alibaba Cloud administrator, and an owner or admin in CostGlass

Time neededAbout 20 minutes, then up to a day for the first bill files

In short

CostGlass reads the monthly bill files that Alibaba Bill Subscription writes into a private OSS bucket in your account. It never writes to the bucket.
A ROS template (Alibaba's infrastructure-as-code service) creates a read-only RAM role that trusts only CostGlass and only when a per-connection External ID matches.
You must activate OSS, create (or let the template create) a private bucket, and turn on Bill Subscription yourself. CostGlass cannot do those steps for you.
Accounts registered on the international site cannot create resources in Chinese mainland (cn-) regions until real-name verification is done. Use an international region.
Alibaba bills mainly in CNY. CostGlass keeps the original amount and converts to USD at a fixed rate for reporting.
If the tab says "Not available yet", the connection is not yet switched on for the platform. That is a message from CostGlass, not a problem with your account.

Is it available to you yet?

Alibaba Cloud needs an identity of its own on the CostGlass side to assume your role. If that has not been set up on the platform you are using, the Alibaba Cloud tab shows a yellow box starting Not available yet and the Start Alibaba Cloud Connection → button returns the same message instead of starting a connection. Nothing is wrong with your account and nothing is created. Contact CostGlass support to ask when it will be enabled.

Note

CostGlass shows this honestly instead of generating a template that trusts nobody. If you see the connect button without the yellow box, the platform side is ready.

How it works

OSS (Object Storage Service): Alibaba Cloud's file storage, like Amazon S3. Files live in buckets.
Bill Subscription: An Alibaba Billing Console feature that writes your bill files into an OSS bucket every day.
RAM role: An identity with permissions that another account is allowed to take on temporarily.
ROS (Resource Orchestration Service): Alibaba's service for creating resources from a template file. It is the equivalent of AWS CloudFormation.
External ID: A value unique to your connection. The role only trusts CostGlass when it presents this value, which stops anyone else tricking CostGlass into using your role.
Region ID: The short code of a region, for example ap-southeast-1 or cn-hangzhou, with no oss- prefix.

The template creates a role called CostGlassReadOnly and a policy attached to it. The policy allows reading your billing bucket (oss:GetObject, oss:ListObjects, oss:GetBucketInfo), and read-only listing of compute inventory (ecs:DescribeRegions, DescribeInstances, DescribeDisks, DescribePrice and vpc:DescribeEipAddresses) so CostGlass can find idle resources. Nothing can be changed.

Before you begin

An Alibaba Cloud account with permission to use OSS, the Billing Console (Bill Subscription) and ROS.
OSS activated on the account. Until it is, every OSS call is refused.
A decision about the bucket region. International-site accounts should pick an international region such as Singapore (ap-southeast-1) or Frankfurt (eu-central-1).
An owner or admin account in CostGlass with room in your plan for another connection.

International accounts and Chinese mainland regions

If your account was registered on alibabacloud.com (the international site), Alibaba refuses to create anything in a Chinese mainland region (cn-hangzhou, cn-shanghai, cn-beijing and so on) until real-name verification is complete. The ROS stack then fails with InternationalUserIDNotRegisteredByRealName. Either choose an international region for the bucket and the stack, or finish real-name verification first.

Step by step

Activate OSS

In the Alibaba Cloud console open Object Storage Service and activate it if you have not already.

Choose how to get the bucket

You need a private OSS bucket to receive your bills. Either create one yourself (OSS Console → Create Bucket, access private), or let the ROS template create it for you in step 4. Note its exact name and its region ID. Bucket names are unique across all of Alibaba Cloud.

Start the connection in CostGlass

Open Settings → Cloud Accounts → Alibaba Cloud and click Start Alibaba Cloud Connection →. CostGlass generates an External ID for this connection and shows it on the page.

Cloud Accounts → Alibaba Cloud. If it says "Not available yet", the connection is not yet enabled on the platform.

Deploy the ROS template

Under Step 2 — Download & deploy the ROS stack click Download ROS Template (a file called costglass-alibaba-readonly.json). Click Open ROS Console, then go to Stacks → Create Stack → Upload Template, upload the file and fill in the parameters (next section). Create the stack and wait for CREATE_COMPLETE.

Turn on Bill Subscription

In the Billing Console go to Bill Subscription → Create Bill Subscription → OSS Subscription. The first time, click Authorize and agree. This creates the AliyunConsumeDump2OSSRole role that lets the billing service write into your bucket. Choose an Instance Details export, a start billing month, your bucket and a path, then create it. Bill Subscription can only deliver to a bucket that already exists, so if the stack is creating your bucket, finish step 4 first.

Paste the details into CostGlass and verify

Under Step 3 — Paste the stack output and bucket details fill in Alibaba RAM Role ARN (the stack's RoleArn output), Billing OSS Bucket Name and OSS Region (the bucket's region ID). Click Verify & Activate.

ROS template parameters and outputs

Name	Kind	What to enter
`BillingBucketName`	Parameter	The exact name of the OSS bucket your Bill Subscription delivers to. The role is allowed to read only this bucket.
`CreateBillingBucket`	Parameter, no by default	Set to yes to have the stack create that private bucket for you in the region where you create the stack. The bucket is kept if you later delete the stack. Leave as no if you already have one.
`RoleArn`	Output	Paste into CostGlass as the Alibaba RAM Role ARN. It looks like acs:ram::<account id>:role/CostGlassReadOnly.
`StackRegion`	Output	The region the stack ran in. If the stack created the bucket, paste this as the OSS region.

Tip

Using CreateBillingBucket = yes? Deploy the stack before you create the Bill Subscription, because Bill Subscription can only point at a bucket that exists.

What verification checks

CostGlass assumes your role with the External ID and then lists the bucket. Verification only needs the bucket to exist and the role to be able to read it. You do not need to wait for bill files first; cost data appears after Alibaba's first delivery. The error messages say what is wrong:

Message	Meaning	Fix
No OSS bucket named … in region …	The role worked, but the bucket name or region is wrong, or the bucket does not exist yet.	Create the bucket, or correct the name and use the bucket's region ID (for example cn-hangzhou, no oss- prefix).
The role was assumed, but it is not allowed to read bucket …	The stack was created with a different bucket name.	Update the stack so BillingBucketName is exactly this bucket's name.
Could not read the billing OSS bucket …	Something earlier failed: stack not applied, wrong role ARN or OSS not activated.	Check the stack reached CREATE_COMPLETE, the ARN was pasted whole and OSS is activated.
This Alibaba Cloud account (role or billing bucket) is already connected.	That role or bucket is already on another connection.	Use the existing connection.

What data you will see and when

Alibaba delivers a day's files by 18:00 China Standard Time (UTC+8) and finalises a month by 18:00 on the 3rd of the next month. The first files can take up to a day to arrive.
CostGlass checks every six hours (and when you click Sync Now on the card). It reads both plain CSV and zipped CSV bill files from the bucket and ignores PDFs.
Granularity is monthly. Alibaba's Instance Details export does not give CostGlass daily rows, so daily views and daily anomaly detection do not cover Alibaba.
Bills are mainly in CNY. CostGlass stores the original amount and currency and converts to USD at a fixed rate for reporting, so figures may differ slightly from your Alibaba invoice at a live exchange rate.
Budgets for Alibaba apply to the whole connection. CostGlass cannot split Alibaba cost by member account today.

Note

The export's column names (for example BillingDate, ProductName, PretaxAmount, Currency) were taken from Alibaba's documentation. If the first real delivery from your account uses different headers, CostGlass will show a sync error; contact support.

Several accounts and disconnecting

You can connect more than one Alibaba account. Each shows as its own card with its own sync status, and a failure on one does not stop the others. A new connection that you start but never finish is replaced the next time you start one. Disconnect asks you to confirm and stops reading the bucket; cost already collected is kept. Your RAM role, stack and bucket remain in Alibaba until you delete them.

Questions people ask

Can CostGlass create the Bill Subscription for me?

No. That step is only available in your own Billing Console, so you have to do it.

Does CostGlass change my bucket?

No. It can only read objects and list the bucket.

Why can I not use a Hangzhou or Shanghai bucket?

On an international-site account, Alibaba blocks creating resources in mainland regions until real-name verification. Use an international region or complete verification.

I connected and nothing shows.

Bill Subscription has probably not delivered a file yet. Check the bucket for files, and remember a new subscription can take up to a day.

The stack failed with InternationalUserIDNotRegisteredByRealName.

See the warning above: choose an international region for the stack, or finish real-name verification.

All Documentation Guides

Welcome to CostGlass — What CostGlass does, who it is for, how your data gets in, the plans and regions, and a plain-English glossary.
Quickstart: your first hour — Sign up, connect a first cloud, invite your team, set a budget and turn on anomaly alerts, with a first-week checklist.
Finding your way around — A tour of the sidebar, top bar and page controls: what every page answers, plan gating, currency, language, links and caching.
Dashboards — The Overview dashboard widget by widget, plus building custom dashboards you can share with your organisation.
Cloud Resources — The multi-cloud inventory: filters, search, categories, estimated cost, terminated resources and CSV or Excel export.
Uptime, incidents & support requests — Monitor public endpoints, route alerts, see incidents and raise requests to CostGlass engineers.
How CostGlass accesses your data — Security and data ingestion architecture: how CostGlass reads multi-cloud billing and telemetry through read-only roles and least-privilege permissions.
Dashboard & Platform Screenshot Tour — Visual walkthrough of the CostGlass interface with screenshots covering multi-cloud spend, Cost Explorer, anomalies, Kubernetes allocation, and savings.
Connecting your clouds: overview — Every cloud and service you can connect, how each one connects, what access it needs, how long data takes and your plan limits.
Connect AWS (CloudFormation) — Deploy the generated CloudFormation template, choose organization or single account and optional features, then verify.
Connect AWS with Terraform instead of CloudFormation — A Terraform equivalent of the generated AWS template, with an Organization variant and a way to compare it to the wizard.
Connect Azure — Admin consent for the CostGlass application, Reader and Cost Management Reader roles, management group or subscription scope, and a Terraform version.
Connect Google Cloud — Enable the FOCUS BigQuery export, run the IAM grants CostGlass prints, verify, and a Terraform version.
Managing connected accounts — The Cloud Accounts page: statuses, syncing, errors, naming, disconnecting, and the FOCUS 1.0 and CUR Export pages.
Connect Oracle Cloud (OCI) — Give CostGlass read-only access to Oracle Cost and Usage Reports with a Resource Manager stack or your own Terraform.
Connect Alibaba Cloud — Connect Alibaba Cloud through Bill Subscription files in OSS and a read-only RAM role created by a ROS template.
Connect DigitalOcean — Connect DigitalOcean accounts with a read-only personal access token and see invoices by month.
Connect Akamai / Linode — Connect Linode (Akamai Connected Cloud) accounts with an account read-only token.
Connect Cloudflare — Connect Cloudflare usage-based charges with a Billing Read account token and see credits and unpaid debt.
Connect OpenAI, Anthropic, Datadog and Snowflake — Connect AI and software vendors with admin keys or a Snowflake key pair so their spend sits beside your cloud costs.
Cost Explorer — Slice, compare and drill into spend across every connected cloud: group by, filters, charts, overlays, details, AI, links and export.
Saved views, saved filters & scheduled emails — Keep, share and email the Cost Explorer views you use often, and reuse include/exclude filters across views and reports.
Reports — Build, compare, export, save and schedule spend reports, with presets, Excel, CSV and PDF exports.
SaaS & AI Spend — Spend and token analytics for OpenAI, Anthropic, DeepSeek, Datadog, Snowflake and cloud AI services.
Unit Economics — Cost per business unit: define metrics, send volumes, set targets and alerts.
Connect a Kubernetes cluster — Install OpenCost and the CostGlass exporter in your cluster so cost data is pushed to CostGlass every 15 minutes.
Kubernetes Costs page — Understand cluster, namespace, workload and pod costs, idle capacity, rightsizing, carbon and health.
Tagging strategy: getting the most from tags — How to tag cloud resources, enforce tagging, and when to use cloud tags or virtual tags in CostGlass.
Tag Explorer — Group billed spend by the value of a tag, see tag coverage per cloud and drill into resources.
Tag Compliance — Define required AWS tags, measure compliance, and fix missing tags with Quick Tag, batch apply or a CLI script.
Virtual tagging — Allocate spend by team, product or environment with rules, no cloud changes, with a rule builder and CostGlass AI.
Forecasting — Forecast month-end spend, the next months and a yearly run-rate, and simulate the cost of changes.
Budgets — Create spending limits for a cloud, account, service or team, and see how CostGlass budgets differ from native AWS, Azure and Google budgets.
Anomaly detection — How CostGlass finds unusual daily cost, how to tune it, explain it and be notified.
Cost alerts — Alert when spend rises versus the previous day, week, month or quarter.
All alert and notification types — A comparison of every alert and notification in CostGlass, with channel setup and testing.
Issues & annotations — Dated notes on spend, and a lightweight issue tracker for cost work with Jira push.
Savings playbook — A prioritised, step-by-step programme for reducing your cloud bill, with a 30/60/90-day plan.
Savings recommendations — How the Savings page finds, prices and tracks savings for every connected cloud and platform.
Rightsizing — Find servers and databases that are too big, or too small, using real CPU and memory measurements.
Commitments: Savings Plans & Reserved Instances — Track coverage, utilisation, expiry and purchase recommendations for Savings Plans, Reservations and committed use discounts.
Instance Scheduler — Start and stop non-production servers on a weekly schedule to stop paying for idle hours.
Giving your team access — Invite people, choose Owner, Admin or Member roles, remove users and limit what they see.
Setting up your organisation hierarchy — Build a tree of nodes, place cloud accounts by hand, rule or CSV, and scope people to a branch.
Designing your hierarchy (with enterprise examples) — Principles and worked patterns for AWS Organizations, single accounts, multi-cloud groups, MSPs and regulated regions.
Single sign-on (SAML & OIDC) — Connect Okta, Entra ID, Google Workspace or another provider, verify your domain, test and require SSO.
API keys & AI assistants (MCP) — Create API keys and connect Claude Desktop, Cursor or Claude Code to your cost data.
Audit log — See who changed what and when, with before and after values, kept for 24 months.
Data residency & retention — Your fixed region, how long cost history is kept, purge now and the data handling summary.
Notification settings, Jira & chat — Weekly spend summary, Slack and Teams webhooks, and connecting Jira Cloud.
Troubleshooting & Common Setup Fixes — Solutions for common cloud connection and ingestion issues across AWS, Azure, Google Cloud, OCI, Alibaba Cloud, Kubernetes, and SSO.

Connect Alibaba Cloud