Alibaba Cloud ECS Basics for International Developers

ECS is the front door to Alibaba Cloud

Elastic Compute Service, universally shortened to ECS, is Alibaba Cloud's virtual machine product and the service most international developers meet first. Almost everything else on the platform, from Server Load Balancer to ApsaraDB, assumes you already understand how an ECS instance is put together.

The concepts will feel familiar if you have used any major cloud. An instance runs on a shape from an instance family, boots from an image, attaches cloud disks, sits in a vSwitch inside a Virtual Private Cloud, and is filtered by a security group. The vocabulary differs from AWS or Azure in places, but nothing here is conceptually exotic.

What does differ, and what this guide concentrates on, are the platform-specific details that are easy to get wrong from outside China: which site you signed up on, how instance type names are constructed, how internet bandwidth is billed, and which compliance step applies where.

Two Alibaba Clouds, and you must know which one you are on

Alibaba Cloud operates an international platform and a mainland China platform. They share engineering but are separate commercially: separate sign-in, separate consoles, separate region lists and separate account systems. Credentials from one do not work on the other.

Most readers outside China will be on the international platform, whose regions include Singapore, Kuala Lumpur, Jakarta, Tokyo, Sydney, Frankfurt, London, Dubai, Silicon Valley and Virginia. Mainland China regions such as Hangzhou, Beijing, Shanghai and Shenzhen are reached through the China platform.

There is a genuine compliance step attached to the mainland regions. Hosting a public website served from inside mainland China requires an ICP filing for the domain, obtained through the provider's filing process before the site is served. It is a regulatory requirement rather than a technical one, and the practical advice is simple: if you do not intend to complete a filing, choose an international region such as Singapore or Hong Kong for public web workloads.

This is also a data location decision, with all the implications discussed in data residency and sovereignty. Decide where the data must live first, then pick the platform, then pick the region.

Reading an instance type name

Alibaba Cloud instance types look like ecs.g7.large or ecs.c6.2xlarge, and the name is entirely systematic once you decode it. The prefix is always ecs. The middle segment names the family and its generation. The suffix gives the size.

Generation numbers matter more than they look. A newer generation usually brings a newer processor and better network performance for the same nominal size, and some families are offered in Intel and AMD variants distinguished by a trailing letter. Availability varies by region, so always confirm the shape exists where you intend to launch it.

Burstable t instances deserve one warning. They accrue and spend CPU credits, so a machine that looks fine in testing can throttle under a sustained load. Use them for genuinely bursty work, not for a steady production service.

Images and disks

An instance boots from an image. Public images cover the mainstream distributions plus Alibaba Cloud Linux, the provider's own distribution which is tuned for the platform and is a reasonable default if you have no distribution preference. Alongside those sit custom images you build yourself, marketplace images published by vendors, and shared images from other accounts.

Storage comes as cloud disks attached over the network. The ESSD family is the current line, offered at several performance levels so you can trade throughput and latency against capacity, with entry-level and automatically scaling variants for less demanding workloads. Older ultra disk and standard SSD types remain available for compatibility.

Two settings on the disk dialogue repay attention. The first is whether the disk is released together with the instance; leaving that enabled on a data disk is a classic way to lose data during a rebuild. The second is disk encryption, which must be chosen at creation.

Snapshots are the backup primitive. They can be taken manually or on an automatic policy, and a snapshot of a system disk can be turned into a custom image, which is the normal way to bake a golden image for repeatable launches. The wider strategy around this is covered in cloud backup strategies.

VPC, security groups and the bandwidth question

Every modern ECS instance lives in a Virtual Private Cloud. Inside the VPC you create vSwitches, which are subnets bound to a single zone, and instances take their private address from one of them. A security group then filters traffic, defaulting to denying inbound connections that no rule permits.

Security groups on Alibaba Cloud come in basic and advanced flavours, with the advanced type supporting larger numbers of instances and a simpler rule model. Either way, the discipline is the same as anywhere else: open only the ports a service needs, prefer references to other security groups over wide address ranges, and keep administrative access off the public internet. The general principles are in cloud firewalls and security groups explained.

Public connectivity is where Alibaba Cloud differs most visibly from western providers. You choose how internet bandwidth is billed at launch: pay by traffic, where you are charged for the data transferred, or pay by fixed bandwidth, where you buy a peak rate and use as much of it as you like. Instances can also sit without a public address and reach the internet through a NAT Gateway, or receive an Elastic IP Address that can be detached and reattached.

The choice between the two billing modes is a workload question. Bursty, low-average traffic usually suits pay by traffic. A steady stream, such as continuous media delivery, is often more predictable on fixed bandwidth. Getting this wrong is one of the more common cost surprises on the platform, and it relates directly to the patterns in the guide to egress costs.

Subscription, pay-as-you-go and preemptible

ECS instances are purchased in one of several modes. Subscription buys a fixed term in advance and is the cheaper option for anything long-lived. Pay-as-you-go bills for what runs and is the right choice while a workload's shape is unknown. Preemptible instances use spare capacity at a reduced rate and can be reclaimed, making them suitable for interruptible batch work.

Savings plans and reserved instances add commitment-based reductions on top for accounts with a predictable floor of usage. The reasoning mirrors the trade-offs in on-demand, reserved and spot pricing models: commit to the baseline, keep the variable portion flexible.

One platform-specific habit is worth adopting early. Subscription instances renew, and an unattended auto-renewal on a forgotten test environment is a needless charge. Review renewal settings whenever you decommission something.

Launching one from the command line

The Alibaba Cloud CLI is called aliyun and maps directly onto the API, which makes it a good way to learn the platform's object model. Configure a profile with a RAM user's credentials rather than the account root:

aliyun configure --profile dev

Explore what is available before launching anything:

aliyun ecs DescribeRegions

aliyun ecs DescribeZones --RegionId ap-southeast-1

aliyun ecs DescribeImages --RegionId ap-southeast-1 --ImageOwnerAlias system

Then create an instance, supplying the network and security group identifiers you created earlier:

aliyun ecs RunInstances --RegionId ap-southeast-1 --InstanceType ecs.g7.large --ImageId $IMAGE --VSwitchId $VSWITCH --SecurityGroupIds.1 $SG --InternetMaxBandwidthOut 5

Note that the bandwidth parameter is part of instance creation rather than a separate networking step. Alibaba Cloud documents every parameter in its ECS product documentation, which is the reference to keep open while scripting.

Questions from developers new to the platform