Alibaba Cloud RAM, KMS and secrets migration to STACKIT

The migration in order

The order follows the waves of the run: the key and the RAM objects come first, the secrets that depend on the key come second.

1. 01

   1. Inventory identities and secrets

   List every RAM user, role, policy and attachment, every KMS key and every KMS secret in Terraform. Resource types that StackToIT does not catalogue, such as a role policy attachment, come back as MANUAL_REVIEW with nothing assessed.

2. 02

   2. Supply the variables that feed secrets

   A secret whose secret_data reads a sensitive variable cannot be assessed until a run knows the variable. Give the run a variable file (--var-file) in a private run; the run itself never asks for a value.

3. 03

   3. Check key types against what STACKIT KMS generates

   STACKIT KMS lists AES-256 and RSA 2048, 3072 and 4096. The alicloud provider also allows Aliyun_AES_128, Aliyun_AES_192, Aliyun_SM4 and the elliptic-curve specs EC_P256, EC_P256K and EC_SM2. A source key with one of those needs a decision.

4. 04

   4. Create the STACKIT KMS key ring and keys

   Create the target keys first. The run places the key in wave 1 and every secret that names it in wave 2.

5. 05

   5. Re-encrypt data, do not move key material

   The run says key material of the source does not move, so data encrypted with it is re-encrypted. STACKIT KMS also supports importing your own key material when you create a key or key version.

6. 06

   6. Load the secrets into Secrets Manager

   An operator carries the values, and applications change how they read them. Secrets Manager versions each secret and logs changes per secret. The STACKIT page we read describes no counterpart to the ACSCurrent and ACSPrevious stage labels, so applications that read by label change.

7. 07

   7. Replace RAM with service accounts and roles

   Workloads get STACKIT service accounts with roles in a project; people get roles through your identity design. The run does not map them for you.

8. 08

   8. Remove Alibaba Cloud access last

   Delete RAM users and AccessKeys only after the last application has read its secrets from STACKIT.

What maps to what

Classes and targets are from the run below. The right column is general practice drawn from the Alibaba Cloud and STACKIT documentation we read.

The unknown attachment type also caps the linked role and policy at LOW: the run records a cap on every unit linked to a type it does not know.

A KMS key and a rotating secret, assessed

A small Alibaba Cloud estate written for this page and assessed by StackToIT on 4 November 2026. Left: the input. Right: the result StackToIT recorded for it, an excerpt of assessment.json with the values exactly as the run wrote them. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged. The input blocks are shown in separate panes because they are not next to each other in main.tf.

resource "alicloud_kms_key" "data" {
  description            = "data-at-rest"
  key_spec               = "Aliyun_AES_256"
  key_usage              = "ENCRYPT/DECRYPT"
  automatic_rotation     = "Enabled"
  rotation_interval      = "365d"
  pending_window_in_days = 30
}

resource "alicloud_kms_secret" "api_token" {
  secret_name                    = "partner-api-token"
  secret_data                    = var.api_token
  version_id                     = "v1"
  encryption_key_id              = alicloud_kms_key.data.id
  enable_automatic_rotation      = true
  rotation_interval              = "30d"
}

[
  {
    "id": "alicloud_kms_key.data",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT KMS"
      },
      "reason": "A KMS key becomes a STACKIT KMS key. Key material of the source does not move, so data encrypted with it is re-encrypted."
    }
  },
  {
    "id": "alicloud_kms_secret.api_token",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT Secrets Manager"
      },
      "reason": "A KMS secret becomes a secret in STACKIT Secrets Manager. Values are moved by an operator, and applications change how they read them."
    }
  }
]

• Re-encrypt, not copy

  The reason for the key is explicit: the key material of the source does not move. Plan the re-encryption of the data that depends on the key.

• Rotation is a design point

  The secret sets enable_automatic_rotation and a 30-day rotation_interval. In Alibaba Cloud, rotation of generic secrets runs through Function Compute. The STACKIT page we read does not describe scheduled rotation, so decide how rotation happens on the target.

• Values are not read

  The two secret_data values come from sensitive variables with no value in the run. The run says it could not assess their migration and that no value is ever asked for.

• AppRole is new

  STACKIT Secrets Manager returns a Vault-compatible token after AppRole authentication. STACKIT announced AppRole on 31 August 2026 in an early release stage, so it may still change; check its state before pipelines depend on it.

A role, its attachment and a pipeline user

From the same run. The RAM role is trusted by the ECS service. StackToIT does not catalogue the attachment type, and the run says so instead of guessing. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged. The input blocks are shown in separate panes because they are not next to each other in main.tf.

resource "alicloud_ram_role" "app" {
  role_name                   = "orders-app"
  assume_role_policy_document = jsonencode({
    Statement = [{ Action = "sts:AssumeRole", Effect = "Allow", Principal = { Service = ["ecs.aliyuncs.com"] } }]
    Version   = "1"
  })
}

resource "alicloud_ram_role_policy_attachment" "app_read" {
  role_name   = alicloud_ram_role.app.role_name
  policy_name = alicloud_ram_policy.read_secrets.policy_name
  policy_type = "Custom"
}

resource "alicloud_ram_user" "deploy" {
  name         = "ci-deploy"
  display_name = "CI deploy user"
}

[
  {
    "id": "alicloud_ram_role.app",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "RAM policies have no document-level counterpart on STACKIT. Map people and workloads to STACKIT roles and service accounts in a reviewed design."
    }
  },
  {
    "id": "alicloud_ram_role_policy_attachment.app_read",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "alicloud_ram_role_policy_attachment is not in the knowledge base catalogue; an architect has to decide the target. Nothing of this resource is assessed or drafted (unknown source type)."
    }
  }
]

• No document-level counterpart

  The run states that RAM policies have no counterpart in document form. The reviewed design maps people and workloads to roles and service accounts.

• Nothing is assessed for the attachment

  The run records the unknown type as MANUAL_REVIEW with LOW confidence and says nothing of it is assessed or drafted.

• Workloads

  STACKIT service accounts have no access by default; you assign roles in a project. The Service Account User role assigns a service account to a workload such as a virtual machine.

• Pipelines

  A CI user with long-lived keys can become a service account that authenticates through Workload Identity Federation with short-lived tokens, or one with a service account key. Never embed keys in source code.

Decisions the architect owns

• Key lifecycle

  Who creates keys, who rotates them and who may delete them. Service accounts have no soft delete, so be careful with deletion rights.

• Secret rotation

  Alibaba Cloud distinguishes generic, RAM, database and ECS secrets. Decide per secret how its replacement is rotated on STACKIT.

• Secret naming and access

  Secret names with prefixes like orders- carried an access pattern in the RAM policy resource. Rebuild that scoping in STACKIT roles.

• Owner of the security work

  For KMS and secret steps the execution plan can show Owner assignment required. Name a role before the work starts.

• Break-glass access

  The run does not assess privilege delta or break-glass access. Design both yourself.

• Audit

  Secrets Manager audit logs cover creation, deletion and version changes. Decide where they are kept.

RAM, KMS and secrets: common questions

Sources

• Alibaba Cloud: What is Resource Access Management
• Alibaba Cloud: Secrets management overview (KMS)
• Terraform Registry: alicloud_kms_key (provider 2.1.0)
• STACKIT: Key Management Service (KMS)
• STACKIT: Secrets Manager
• STACKIT: Service accounts