Basic Platform
Software Usage Recommendations
| Metric Name | Default Value | Value Range |
|---|---|---|
| Session timeout time on the tenant side | 30 minutes | 30 to 1440 minutes |
| Session timeout time on the operation side | 30 minutes | 30 to 1440 minutes |
| Tenant-side account temporary locking time | 60 minutes | 10 to 1440 minutes |
| Operation-side account temporary locking time | 60 minutes | 10 to 1440 minutes |
| Maximum incorrect password attempts during tenant-side login | 10 | 3 to 10 |
| Maximum incorrect password attempts during operation-side login | 10 | 3 to 10 |
| Multi-end login switch on the tenant side | Disabled | Disabled or enabled |
| Multi-end login switch on the operation side | Disabled | Disabled or enabled |
| Graphic verification code for operation-side login | Disabled | Disabled or enabled |
| Graphic verification code for tenant-side login | Disabled | Disabled or enabled |
| Tenant-side watermark | Disabled | Disabled or enabled |
| Operation-side watermark | Disabled | Disabled or enabled |
Users and Permissions
Software Usage Recommendations
| Metric Name | Default Value | Value Range |
|---|---|---|
| Number of accounts per tenant | 10,000 | Non-adjustable |
| Number of user groups per tenant | 1,000 | Non-adjustable |
| Number of user groups a sub-account can join | 300 | Non-adjustable |
| Number of users in a user group | 1,000 | Non-adjustable |
| Number of custom policies per tenant | 1,000 | Non-adjustable |
| Number of policies that can be associated with a user, user group, or role | 5,000 | Non-adjustable |
| Maximum number of characters in a policy syntax | 4,096 characters | Non-adjustable |
| SSO protocol | - | OAuth 2.0, SAML, CAS, and LDAP protocols |
| Password composition | Lowercase letters and digits | At least two types of uppercase and lowercase letters, digits, and special characters |
| Minimum password length | 10 characters | 10–32 characters |
| Password validity period | 90 days | 0 (no limit)–365 days |
| Reuse limit | 1 time (cannot be the same as the previous password by default) | 1–24 times |
- It is recommended to perform a quarterly scan and cleanup of tenant root accounts and sub-accounts that have been inactive for an extended period (≥ 90 days). The cleanup follows a three-step process: "disable first, observe for 30 days, and delete". Before cleanup, confirm that the account has no active AK/SK and no associated resources.
- It is not recommended to use the root account for resource operations. Instead, create sub-accounts and assign policies based on the principle of least privilege, and use sub-accounts with limited permissions to manage your cloud resources.
Cloud API Management
Software Usage Recommendations
| Metric Name | Default Value | Value Range |
|---|---|---|
| Multi-language SDKs provided by Cloud API | - | Cloud API provides SDKs in the following languages: Java, Python, PHP, Golang, and Node.js |
| API timeout | 5000 ms | 10 - 30000 ms |
| API call frequency per tenant | 20 calls per second | Non-adjustable |
| Number of parameters per API | - | 0 - 20 |
| Number of parameters per complex object | - | 0 - 20 |
| Request size | 1024 KB | 1024 - 10240 KB |
- Product APIs provided by the cloud platform can only be called to query resources. Editing and deleting resources are not supported.
- APIs of user-defined products can be called to add, edit, and delete resources.
- Cloud API keys should be rotated regularly, and deprecated keys should be promptly disabled to prevent security risks caused by key leakage.
- The SDK version must match the Cloud API version to avoid SDK call failures.
Resource Management
Software Usage Recommendations
The scope of products integrated into project management is as follows.
| Cloud Product | Resource Type |
|---|---|
| CVM | Cloud virtual machine |
| CFS | File system |
| CBS | Cloud disk |
| Snapshot | |
| Cloud Storage Private (CSP) | Bucket |
| Cloud Object Storage (COS) | Bucket |
| Redis® | Instance |
| TDSQL for MySQL | Instance |
| TDSQL for PostgreSQL | Instance |
| Cloud Load Balancer (CLB) | LB instance |
| Distributed Transaction Framework (DTF) | Transaction |
| TDMQ for CKafka (CKafka) | Instance |
| Cloud Task (TCT) | Deployment group |
| Big Data Suite (TBDS) | Instance |
Metering Management
Software Usage Recommendations
The metering and billing module supports the following products. If Billing Management is deployed for your project, you can bill products on a pay-as-you-go basis.
| Category | Product |
|---|---|
| Compute | - CVM - BMS |
| Network | - Cloud Load Balancer (CLB) - Elastic IP (EIP) - NAT Gateway (NATGW) - NAT64 Gateway - VPN Gateway - Direct Connect (DC) - Peering Connection (PC) - IDC Bandwidth |
| Storage | - CBS - CBS Snapshot - Cloud Object Storage (COS) - Cloud Storage Private (CSP) - CFS - TurboFS - BRC - Cloud Log Service (CLS) |
| Database | - TDSQL for MySQL - TDSQL for PostgreSQL - Redis® |
| Middleware | - TDMQ for Apache Pulsar (TDMQ Pulsar) - TDMQ for CKafka (CKafka) - TDMQ for Apache RocketMQ (TDMQ RocketMQ) |
| Security | - Cloud Workload Protection Platform (CWP) - Web Application Firewall (WAF) - Security Operation Center (SOC) - Cloud Bastion Host (CBH) - Data Security Audit (DSAuditSaaS) - Key Management Service (KMS) - Secrets Manager (SSM) - Cloud Hardware Security Module (CloudHSM) - Cloud Firewall (CFW) |
Quotas for products supported by metering and billing:
| Cloud Product | Quota |
|---|---|
| CVM | Number of instances |
| Number of CPU cores | |
| Memory size | |
| BMS | Number of servers |
| CBS | Number of instances |
| Amount of storage space | |
| CBS Snapshot | Number of snapshots |
| CFS | Number of instances |
| TurboFS | Number of instances |
| Amount of storage space | |
| BRC | Number of backup points |
| TDSQL for MySQL | Number of instances |
| Number of CPU cores | |
| Amount of storage space | |
| TDSQL for PostgreSQL | Number of instances |
| Number of CPU cores | |
| Amount of storage space | |
| Redis® | Number of instances |
| Memory |
CloudAudit
Software Usage Recommendations
- Calls to all cloud APIs can be recorded.
- API call records within up to one year can be queried.
- For financial and cybersecurity classified protection scenarios requiring longer-term retention of audit logs, you should deliver the logs to COS or equivalent storage via CloudAudit to achieve long-term retention, rather than relying solely on CloudAudit for storage. On the operation side, logs can be delivered to Kafka. On the tenant side, logs can be delivered to COS/CSP.
Approval Management
Software Usage Recommendations
Range of the products that have been accessed by Approval Management:
| Side | Product |
|---|---|
| Tenant side | CVM |
| Cloud Load Balancer (CLB) | |
| CBS | |
| Virtual Private Cloud (VPC) | |
| Kubernetes Engine (TKE) | |
| BMS | |
| MariaDB | |
| TDSQL for MySQL | |
| TDMQ for CKafka (CKafka) | |
| TDMQ for Apache Pulsar (TDMQ Pulsar) | |
| Direct Connect (DC) | |
| CFS | |
| Resource Management | |
| Operation side | Tcenter |
| BMS | |
| Data Center Operating System (DCOS) | |
| Cloud Load Balancer (CLB) | |
| Virtual Private Cloud (VPC) | |
| Direct Connect (DC) | |
| CVM | |
| Job Tools | |
| Cloud Workload Protection Platform (CWP) | |
| CBS | |
| CFS | |
| Redis® | |
| Product Ops Center | |
| Cloud Object Storage (COS) | |
| Network Management System (NMS) | |
| Password Bank | |
| Agent Management | |
| Web Application Firewall (WAF) |
Tags
Tags can be applied to cloud product resource instances to enable categorized resource management.