Alibaba Cloud promo credits Alibaba Cloud global sub account creation guide
Alibaba Cloud Global Sub Account Creation Guide (Without the “Why Is This So Confusing?” Feeling)
If you’re here, you probably want to create an Alibaba Cloud global sub account and you’d like the process to be less like assembling IKEA furniture using only interpretive dance. Great news: this guide is designed to be practical, readable, and (as much as possible) painless.
We’ll cover what a sub account is, the planning steps before you start, the actual creation flow, how to set up identity and security, how permissions work, what to watch out for in billing, and how to solve common problems. Along the way, we’ll keep the jokes light and the instructions clear—because nothing says “cloud computing” like accidentally locking yourself out.
What Is an Alibaba Cloud Global Sub Account?
An Alibaba Cloud “sub account” is essentially a separate account under your parent (main/master) Alibaba Cloud account. Think of it like this: your main account is the captain of the ship, and sub accounts are the crew members. Each crew member can have different responsibilities, permissions, and access to resources.
In real-world terms, companies create sub accounts to:
- Delegate access to different teams (DevOps, security, finance, customer support, etc.).
- Separate responsibilities and limit damage from mistakes (including the classic “Oops, I deleted the wrong thing”).
- Manage permissions using a centralized system rather than sharing credentials across people.
- Keep a clearer audit trail for who did what and when.
- Handle multi-region, multi-project setups with less chaos.
Alibaba Cloud promo credits The “global” part usually refers to using Alibaba Cloud’s global account features and console experience. The creation approach is broadly similar, but your choices around identity, regions, and permissions matter a lot.
Before You Create: Quick Planning Checklist
Before you click anything, take five minutes to plan. This is the part where you prevent future-you from screaming into the void.
1) Decide who the sub account is for
Is the sub account for a person, a team, or an automated system? If it’s for a person, you’ll want human-friendly access and strong authentication. If it’s for an application or integration, you might use role-based access and API credentials appropriately.
2) Decide what the sub account should be allowed to do
Not everything needs to be accessible. A sub account used for monitoring shouldn’t randomly get permission to manage networking changes at 2 a.m.
Typical permission categories include:
- Read-only access for auditors or analysts
- Resource management permissions for engineers
- Billing and payment visibility for finance
- Security operations and compliance actions
3) Confirm your main account setup
Make sure your main account is healthy: verification completed, security features enabled, and you have stable access to the console. If your main account is locked or incomplete, the sub account journey will get weird.
4) Gather identity details
Depending on your region and verification requirements, you may need:
- Name and contact information
5) Think about naming conventions
Use names that you’ll thank yourself for later. Example patterns:
- team-devops-prod
- team-security-staging
- finance-billing-eu
“SubAccount1” is not a naming strategy. It’s a cry for help.
Step-by-Step: Create an Alibaba Cloud Global Sub Account
The UI and labels can vary slightly depending on account type and console updates. But the flow is generally consistent: you go to the account management area, choose to create a sub account, fill details, verify identity (if required), and then set permissions.
Step 1: Log into your main Alibaba Cloud account
Sign in to the Alibaba Cloud console using your main account credentials. If you have multiple regions or global portals, make sure you’re in the global management context you intend to use.
Tip: If you use SSO or a corporate login method, double-check that you’re logged in as the main/master account.
Step 2: Open Account Management
In the console, locate a section such as “Account Management,” “RAM,” “Sub Accounts,” or “User and Permissions.” The exact wording changes, but you’re looking for a place where you can manage users/sub accounts.
Some accounts use RAM-like access control features. In many setups, creating sub accounts involves creating an entity under a centralized identity and authorization system.
Step 3: Choose “Create Sub Account”
Click the option to create a new sub account. You’ll usually be asked to choose the sign-in method and provide identity details.
If you see different account types or options, select the one that matches your intended use (human user vs. integration/automation). If you’re unsure, choose the human account option and later restrict permissions via roles/policies.
Step 4: Enter the sub account name and contact details
Fill out the sub account name, email, and/or phone number. The system may require:
- A unique identifier (email/phone typically must not be reused)
Common pitfall: using a phone number or email that already belongs to another Alibaba Cloud account. Yes, the system will notice. No, it will not do you the favor of explaining everything nicely.
Step 5: Set initial authentication details
Depending on your configuration, you might:
- Set a password for the sub account
- Use SMS or email verification
- Trigger a verification code workflow
Try not to treat verification codes like collectible stamps. Enter them promptly, and store them securely if your process requires manual handling.
Step 6: Complete verification (if prompted)
Some creations require identity verification. If you see a step for verification, follow it exactly. Verification can be instant or may take time depending on the method and your account profile.
If verification fails, check:
- That your entered details match your information precisely
- That you used the correct region/country code
- That the verification code wasn’t expired
- That the main account’s security posture meets requirements
Step 7: Review the sub account settings summary
Before finalizing, take a moment to scan the summary. Confirm:
- Sub account name
- Contact method (email/phone)
- Any default access or baseline permissions
- Whether billing responsibilities are inherited or specified
After you create, you’ll typically be redirected to a permissions or access control page.
Step 8: Log in to the sub account (recommended right away)
Once created, try signing in to the sub account using its login method. This is not because you enjoy pain—it’s because it quickly reveals issues such as:
- Wrong email/phone used
- Forgot password requirements
- Alibaba Cloud promo credits Verification not fully completed
- Security or MFA settings not aligned
If the sub account can’t sign in, fix it early instead of after it’s needed for a project deadline.
Security Setup: Make It Strong, Not “Hope-Based”
Cloud resources are powerful. That power should come with guardrails. Here’s how to make sure your sub account isn’t operating on vibes.
Enable MFA/2FA for sub accounts
Whenever possible, enable multi-factor authentication (MFA/2FA). The methods vary (email codes, SMS, authenticator apps), but the goal is the same: make credential compromise harder.
If your workflow allows, prefer authenticator apps over SMS for better reliability. If you can’t, SMS is still better than nothing.
Review password policies
Ensure the sub account password is strong and not shared. If you have a password manager, use it. If you don’t, now is a great time to pretend you’re a serious person.
Lock down API access
If the sub account will use APIs, create access credentials carefully. Avoid long-lived credentials where possible and prefer scoped permissions.
Also: rotate credentials periodically and immediately if you suspect exposure.
Use least privilege
Grant only what’s necessary. If the sub account needs to manage a specific project, scope permissions to that project/resource set. If it’s for reporting, give read-only permissions.
This is the difference between “guarded access” and “I accidentally deleted the entire staging environment.”
Permissions: The Part Everyone Forgets Until It Hurts
After creation, the sub account might have minimal access by default. You typically need to set up permissions using policies/roles and possibly RAM-style access control.
Understand parent vs. sub account permissions
Your main account controls the overall authorization structure. Sub accounts can be granted permissions through:
- Alibaba Cloud promo credits Role assignments
- Permission policies
- Resource scoping (projects/instances/regions)
In many cloud systems, permissions are evaluated based on the combination of policy statements and identity/role assignments. In other words: don’t assume “I gave access to one thing so everything is fine.” Permissions are literal. They do not read your mind.
Create a permission template (optional but smart)
If you plan to create multiple sub accounts, build a reusable permission approach:
- DevOps base template (manage compute/storage in a project)
- Security template (read logs, limited security actions)
- Finance template (billing visibility)
- Support template (limited operational tasks)
This reduces repetitive configuration and makes audits easier.
Alibaba Cloud promo credits Assign permissions to the sub account
In the permissions/access control section, add the sub account to a role or attach policies. You may be asked to choose:
- Service scope (which Alibaba Cloud products)
- Action scope (what operations are allowed)
- Resource scope (which instances/projects/regions)
- Time scope (if supported)
Tip: Start with minimal access, confirm the sub account can do its job, then expand carefully if needed.
Test access immediately
Have the sub account user (or your test automation) attempt typical actions:
- Read resources
- List instances
- Perform a controlled operation (start/stop, create a small resource, etc.)
If something fails, review permissions rather than assuming the cloud is “buggy.” Permissions are usually the culprit.
Alibaba Cloud promo credits Billing Considerations: Who Pays, and Why That Matters
Billing can be a source of stress, especially when teams are separated by sub accounts. Sub accounts may be:
- Under the main account for unified billing
- Able to view billing information
- In some setups, assigned billing responsibility
To avoid surprise invoices (or surprise silence when someone asks “why is the bill huge?”), confirm the following:
- Which account is responsible for payments
- Whether the sub account can view costs and invoices
- Whether there are budget alerts or quota limits
- Whether resource quotas differ by sub account
Set budget and alerts (highly recommended)
If your organization supports budgets/alerts, configure them early. This gives you a “heads-up” before your cloud bill becomes a horror story.
Use resource tagging and naming
Tags and standardized naming make cost allocation way easier. For example:
- Environment: dev/staging/prod
- Team: security/devops/finance
- Project: project-code
Even if you can’t fully enforce cost allocation, tags help you interpret the bill like a detective who actually enjoys paperwork.
Common Problems and How to Fix Them
Alibaba Cloud promo credits Let’s cover the usual suspects: the things that go wrong during sub account creation and first login.
Problem: Sub account creation succeeds, but login fails
Possible causes:
- Verification not completed fully
- Incorrect contact method (wrong email/phone)
- Password not set or not accepted
Fix approach:
- Double-check email/phone details used at creation
- Verify your sub account status in the account management console
- Re-initiate password reset or verification if available
Problem: Permissions are “granted” but actions are denied
This is extremely common because permissions are sometimes layered (roles, policies, and resource scope). Even one missing condition can block an action.
Fix approach:
- Check the policy attached to the sub account (and any roles).
- Confirm the resource scope matches what you’re trying to access (project/region/instance).
- Look for explicit deny statements if your system supports them.
- Verify you’re using the correct sub account credentials.
Problem: Verification code expires or never arrives
Possible causes:
- Entering the code after it expires
- Email/SMS delays
- Spam/junk filtering
- Wrong country/phone code
Fix approach:
- Check spam folder for emails
- Confirm phone country code
- Request a new code and try quickly
Problem: Sub account can see stuff it shouldn’t
If your sub account has broader access than intended, review:
- Assigned roles/policies
- Resource scope filters
- Whether default permissions were applied
Fix approach:
- Remove unnecessary policies/roles
- Reassign with least privilege
- Test again with an action that previously revealed extra access
Alibaba Cloud promo credits Problem: Sub account can’t create resources due to quota limits
Sometimes you have permissions but hit quotas or limits tied to the main account or project.
Fix approach:
- Check quotas/billing limits for the sub account or relevant region
- Confirm the sub account has access to the project where quotas are applied
- Request quota increases if allowed
Best Practices: How to Keep Your Setup Clean
If you want fewer headaches now and later, follow these best practices.
Document everything
Create a simple internal spreadsheet or document that lists:
- Sub account name
- Purpose/team
- Permissions template used
- Owner contact
- Creation date
Future onboarding will be less painful, and audits will be less dramatic.
Alibaba Cloud promo credits Use role-based access patterns
Instead of giving broad direct permissions, rely on roles and policies. It’s like giving your cat a key to the whole house versus assigning it to one room with a suspiciously specific carpet.
Alibaba Cloud promo credits Rotate credentials and review access periodically
Every quarter (or sooner if your team changes a lot), review who has access and whether it’s still needed.
Set up a “break glass” emergency process
In real organizations, you sometimes need an emergency admin account. If you do, keep it separate, secured, and monitored.
Do not store recovery info in a place that can be accessed by “anyone who has access to the sticky notes.”
Example Setup: A Realistic Team Scenario
Here’s a sample configuration that shows how sub accounts are often used.
Team DevOps – prod access with guardrails
They need to manage compute and deployment-related services in the production environment.
- Sub account: team-devops-prod
- Permissions: manage deployment resources, start/stop instances, read logs
- Billing: visible to team lead, payment handled by main
- Quotas: restricted to production project limits
Team Security – read logs and perform audits
They need visibility without operational chaos.
- Sub account: team-security-prod
- Permissions: read-only logs, security configuration review
- Limited write access for specific security actions only
Finance – cost visibility
They need billing transparency.
- Sub account: finance-billing
- Permissions: billing reports, invoice access, cost breakdown
- No permissions to create or modify resources
This structure reduces risk and makes “who changed what” less of a mystery novel.
Checklist: You’re Done When…
After you create and configure your sub account(s), verify the following:
- The sub account can sign in successfully.
- MFA is enabled (if available) and working.
- Permissions match the intended responsibilities (least privilege).
- Resource scope is correct (project/region alignment).
- Billing visibility and responsibilities are confirmed.
- Budget/alerts (if supported) are configured.
- Team members know which sub account they should use.
Final Thoughts (And a Friendly Reminder)
Creating Alibaba Cloud global sub accounts doesn’t have to be a weekend-long mystery. If you follow a structured approach—plan first, create carefully, verify security, then set least-privilege permissions—you’ll end up with a clean, scalable setup.
One last piece of advice: treat your permissions like you treat your passwords. Don’t share them, don’t over-grant them, and don’t act surprised when they cause problems later. The cloud won’t laugh with you. It will just politely let you know you don’t have permission. In its own quiet, judgmental way.
If you want, tell me what your sub accounts are for (teams and intended services), and I can suggest a permission structure and naming scheme tailored to your use case.
