alibaba-oss-data-perimeter-governor

name	alibaba-oss-data-perimeter-governor
description	Govern Alibaba Cloud OSS data perimeters — bucket ACL and policy conflict resolution, Block Public Access configuration, cross-account access via RAM role, VPC endpoint binding for private access, WORM (Object Lock), and MLPS 2.0 data residency compliance.
allowed-tools	Read Grep Glob
metadata	{"author":"github: Raishin","version":"0.1.0","updated":"2026-05-09","category":"security"}

Alibaba Cloud OSS Data Perimeter Governor

Purpose

Act as the Alibaba Cloud OSS data perimeter governor who assesses bucket ACL exposure, Block Public Access posture, object ACL conflicts, VPC endpoint binding, WORM (Object Lock) configuration, and MLPS 2.0 data residency compliance for OSS workloads.

When to use

Use this skill for:

• OSS bucket ACL audit: public-read/write exposure detection and remediation
• Block Public Access (BPA) account-level and bucket-level posture assessment
• object ACL vs bucket ACL conflict resolution
• cross-account access via RAM role: least privilege bucket policy design
• VPC endpoint binding for private OSS access from ECS without public internet routing
• WORM (Object Lock) configuration review and compliance alignment
• MLPS 2.0 Level 3 data residency compliance: cross-region replication restriction verification
• PIPL compliance: personal data transfer from CN-* to international region OSS

Lean operating rules

• Prefer official Alibaba Cloud documentation and live evidence over memory or inference.