diff --git a/jobs/cc_deployment_updater/templates/storage_cli_config_buildpacks.json.erb b/jobs/cc_deployment_updater/templates/storage_cli_config_buildpacks.json.erb
index 36ba5f755a..5539ab779c 100644
--- a/jobs/cc_deployment_updater/templates/storage_cli_config_buildpacks.json.erb
+++ b/jobs/cc_deployment_updater/templates/storage_cli_config_buildpacks.json.erb
@@ -12,39 +12,59 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+
+  custom.each do |k, v|
+    add(options, k.to_s, v)
+  end
+end
+
+def apply_custom_from_link!(options, link, scope)
+  begin
+    custom = link.p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 l = link("cloud_controller_internal")
 
 scope = "cc.buildpacks.connection_config"
 provider = l.p("cc.buildpacks.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = l.p("#{scope}.azure_storage_account_name")
   options["container_name"] = l.p("#{scope}.container_name")
-  add(options, "account_key",        l.p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = l.p("#{scope}.azure_storage_access_key")
   add(options, "environment",        l.p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", l.p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = l.p("#{scope}.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_link!(options, l, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = l.p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = l.p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = l.p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = l.p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            l.p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_link!(options, l, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cc_deployment_updater/templates/storage_cli_config_droplets.json.erb b/jobs/cc_deployment_updater/templates/storage_cli_config_droplets.json.erb
index 363a7011f6..bbff337c84 100644
--- a/jobs/cc_deployment_updater/templates/storage_cli_config_droplets.json.erb
+++ b/jobs/cc_deployment_updater/templates/storage_cli_config_droplets.json.erb
@@ -12,39 +12,59 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+
+  custom.each do |k, v|
+    add(options, k.to_s, v)
+  end
+end
+
+def apply_custom_from_link!(options, link, scope)
+  begin
+    custom = link.p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 l = link("cloud_controller_internal")
 
 scope = "cc.droplets.connection_config"
 provider = l.p("cc.droplets.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = l.p("#{scope}.azure_storage_account_name")
   options["container_name"] = l.p("#{scope}.container_name")
-  add(options, "account_key",        l.p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = l.p("#{scope}.azure_storage_access_key")
   add(options, "environment",        l.p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", l.p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = l.p("cc.droplets.connection_config.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_link!(options, l, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = l.p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = l.p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = l.p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = l.p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            l.p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_link!(options, l, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cc_deployment_updater/templates/storage_cli_config_packages.json.erb b/jobs/cc_deployment_updater/templates/storage_cli_config_packages.json.erb
index 4de210731c..d1e2f6a372 100644
--- a/jobs/cc_deployment_updater/templates/storage_cli_config_packages.json.erb
+++ b/jobs/cc_deployment_updater/templates/storage_cli_config_packages.json.erb
@@ -12,39 +12,59 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+
+  custom.each do |k, v|
+    add(options, k.to_s, v)
+  end
+end
+
+def apply_custom_from_link!(options, link, scope)
+  begin
+    custom = link.p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 l = link("cloud_controller_internal")
 
 scope = "cc.packages.connection_config"
 provider = l.p("cc.packages.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = l.p("#{scope}.azure_storage_account_name")
   options["container_name"] = l.p("#{scope}.container_name")
-  add(options, "account_key",        l.p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = l.p("#{scope}.azure_storage_access_key")
   add(options, "environment",        l.p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", l.p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = l.p("#{scope}.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_link!(options, l, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = l.p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = l.p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = l.p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = l.p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            l.p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_link!(options, l, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cc_deployment_updater/templates/storage_cli_config_resource_pool.json.erb b/jobs/cc_deployment_updater/templates/storage_cli_config_resource_pool.json.erb
index bbf336fcfb..b6ef873213 100644
--- a/jobs/cc_deployment_updater/templates/storage_cli_config_resource_pool.json.erb
+++ b/jobs/cc_deployment_updater/templates/storage_cli_config_resource_pool.json.erb
@@ -12,39 +12,59 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+
+  custom.each do |k, v|
+    add(options, k.to_s, v)
+  end
+end
+
+def apply_custom_from_link!(options, link, scope)
+  begin
+    custom = link.p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 l = link("cloud_controller_internal")
 
 scope = "cc.resource_pool.connection_config"
 provider = l.p("cc.resource_pool.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = l.p("#{scope}.azure_storage_account_name")
   options["container_name"] = l.p("#{scope}.container_name")
-  add(options, "account_key",        l.p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = l.p("#{scope}.azure_storage_access_key")
   add(options, "environment",        l.p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", l.p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = l.p("#{scope}.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_link!(options, l, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = l.p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = l.p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = l.p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = l.p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            l.p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_link!(options, l, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cloud_controller_clock/spec b/jobs/cloud_controller_clock/spec
index 5b8a7d3134..1d6cbf83d6 100644
--- a/jobs/cloud_controller_clock/spec
+++ b/jobs/cloud_controller_clock/spec
@@ -31,6 +31,7 @@ templates:
   storage_cli_config_resource_pool.json.erb: config/storage_cli_config_resource_pool.json
 
 packages:
+  - ali-storage-cli
   - azure-storage-cli
   - capi_utils
   - cloud_controller_ng
diff --git a/jobs/cloud_controller_clock/templates/storage_cli_config_buildpacks.json.erb b/jobs/cloud_controller_clock/templates/storage_cli_config_buildpacks.json.erb
index 400ccf3d01..479f4bb8a7 100644
--- a/jobs/cloud_controller_clock/templates/storage_cli_config_buildpacks.json.erb
+++ b/jobs/cloud_controller_clock/templates/storage_cli_config_buildpacks.json.erb
@@ -12,37 +12,54 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+  custom.each { |k, v| add(options, k.to_s, v) }
+end
+
+def apply_custom_from_props!(options, scope)
+  begin
+    custom = p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 scope = "cc.buildpacks.connection_config"
 provider = p("cc.buildpacks.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = p("#{scope}.azure_storage_account_name")
   options["container_name"] = p("#{scope}.container_name")
-  add(options, "account_key",        p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = p("#{scope}.azure_storage_access_key")
   add(options, "environment",        p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = p("#{scope}.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_props!(options, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_props!(options, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cloud_controller_clock/templates/storage_cli_config_droplets.json.erb b/jobs/cloud_controller_clock/templates/storage_cli_config_droplets.json.erb
index 60e46c9f30..9cd8f94d10 100644
--- a/jobs/cloud_controller_clock/templates/storage_cli_config_droplets.json.erb
+++ b/jobs/cloud_controller_clock/templates/storage_cli_config_droplets.json.erb
@@ -12,37 +12,54 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+  custom.each { |k, v| add(options, k.to_s, v) }
+end
+
+def apply_custom_from_props!(options, scope)
+  begin
+    custom = p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 scope = "cc.droplets.connection_config"
 provider = p("cc.droplets.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = p("#{scope}.azure_storage_account_name")
   options["container_name"] = p("#{scope}.container_name")
-  add(options, "account_key",        p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = p("#{scope}.azure_storage_access_key")
   add(options, "environment",        p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = p("cc.droplets.connection_config.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_props!(options, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_props!(options, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cloud_controller_clock/templates/storage_cli_config_packages.json.erb b/jobs/cloud_controller_clock/templates/storage_cli_config_packages.json.erb
index f11ec11221..363bde44e6 100644
--- a/jobs/cloud_controller_clock/templates/storage_cli_config_packages.json.erb
+++ b/jobs/cloud_controller_clock/templates/storage_cli_config_packages.json.erb
@@ -12,37 +12,54 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+  custom.each { |k, v| add(options, k.to_s, v) }
+end
+
+def apply_custom_from_props!(options, scope)
+  begin
+    custom = p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 scope = "cc.packages.connection_config"
 provider = p("cc.packages.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = p("#{scope}.azure_storage_account_name")
   options["container_name"] = p("#{scope}.container_name")
-  add(options, "account_key",        p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = p("#{scope}.azure_storage_access_key")
   add(options, "environment",        p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = p("#{scope}.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_props!(options, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_props!(options, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cloud_controller_clock/templates/storage_cli_config_resource_pool.json.erb b/jobs/cloud_controller_clock/templates/storage_cli_config_resource_pool.json.erb
index 9b3f7f40d9..5895ced893 100644
--- a/jobs/cloud_controller_clock/templates/storage_cli_config_resource_pool.json.erb
+++ b/jobs/cloud_controller_clock/templates/storage_cli_config_resource_pool.json.erb
@@ -12,37 +12,54 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+  custom.each { |k, v| add(options, k.to_s, v) }
+end
+
+def apply_custom_from_props!(options, scope)
+  begin
+    custom = p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 scope = "cc.resource_pool.connection_config"
 provider = p("cc.resource_pool.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = p("#{scope}.azure_storage_account_name")
   options["container_name"] = p("#{scope}.container_name")
-  add(options, "account_key",        p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = p("#{scope}.azure_storage_access_key")
   add(options, "environment",        p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = p("#{scope}.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_props!(options, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_props!(options, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cloud_controller_ng/spec b/jobs/cloud_controller_ng/spec
index 5139762f95..bf9ac40672 100644
--- a/jobs/cloud_controller_ng/spec
+++ b/jobs/cloud_controller_ng/spec
@@ -70,6 +70,7 @@ templates:
   cloud_controller_local_worker_override.yml.erb: config/cloud_controller_local_worker_override.yml
 
 packages:
+  - ali-storage-cli
   - azure-storage-cli
   - capi_utils
   - cloud_controller_ng
diff --git a/jobs/cloud_controller_ng/templates/storage_cli_config_buildpacks.json.erb b/jobs/cloud_controller_ng/templates/storage_cli_config_buildpacks.json.erb
index 400ccf3d01..479f4bb8a7 100644
--- a/jobs/cloud_controller_ng/templates/storage_cli_config_buildpacks.json.erb
+++ b/jobs/cloud_controller_ng/templates/storage_cli_config_buildpacks.json.erb
@@ -12,37 +12,54 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+  custom.each { |k, v| add(options, k.to_s, v) }
+end
+
+def apply_custom_from_props!(options, scope)
+  begin
+    custom = p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 scope = "cc.buildpacks.connection_config"
 provider = p("cc.buildpacks.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = p("#{scope}.azure_storage_account_name")
   options["container_name"] = p("#{scope}.container_name")
-  add(options, "account_key",        p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = p("#{scope}.azure_storage_access_key")
   add(options, "environment",        p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = p("#{scope}.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_props!(options, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_props!(options, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cloud_controller_ng/templates/storage_cli_config_droplets.json.erb b/jobs/cloud_controller_ng/templates/storage_cli_config_droplets.json.erb
index 60e46c9f30..f797aca703 100644
--- a/jobs/cloud_controller_ng/templates/storage_cli_config_droplets.json.erb
+++ b/jobs/cloud_controller_ng/templates/storage_cli_config_droplets.json.erb
@@ -12,37 +12,53 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+  custom.each { |k, v| add(options, k.to_s, v) }
+end
+
+def apply_custom_from_props!(options, scope)
+  begin
+    custom = p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
 scope = "cc.droplets.connection_config"
 provider = p("cc.droplets.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = p("#{scope}.azure_storage_account_name")
   options["container_name"] = p("#{scope}.container_name")
-  add(options, "account_key",        p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = p("#{scope}.azure_storage_access_key")
   add(options, "environment",        p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = p("cc.droplets.connection_config.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_props!(options, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_props!(options, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cloud_controller_ng/templates/storage_cli_config_packages.json.erb b/jobs/cloud_controller_ng/templates/storage_cli_config_packages.json.erb
index f11ec11221..363bde44e6 100644
--- a/jobs/cloud_controller_ng/templates/storage_cli_config_packages.json.erb
+++ b/jobs/cloud_controller_ng/templates/storage_cli_config_packages.json.erb
@@ -12,37 +12,54 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+  custom.each { |k, v| add(options, k.to_s, v) }
+end
+
+def apply_custom_from_props!(options, scope)
+  begin
+    custom = p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 scope = "cc.packages.connection_config"
 provider = p("cc.packages.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = p("#{scope}.azure_storage_account_name")
   options["container_name"] = p("#{scope}.container_name")
-  add(options, "account_key",        p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = p("#{scope}.azure_storage_access_key")
   add(options, "environment",        p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = p("#{scope}.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_props!(options, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_props!(options, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cloud_controller_ng/templates/storage_cli_config_resource_pool.json.erb b/jobs/cloud_controller_ng/templates/storage_cli_config_resource_pool.json.erb
index 9b3f7f40d9..5895ced893 100644
--- a/jobs/cloud_controller_ng/templates/storage_cli_config_resource_pool.json.erb
+++ b/jobs/cloud_controller_ng/templates/storage_cli_config_resource_pool.json.erb
@@ -12,37 +12,54 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+  custom.each { |k, v| add(options, k.to_s, v) }
+end
+
+def apply_custom_from_props!(options, scope)
+  begin
+    custom = p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 scope = "cc.resource_pool.connection_config"
 provider = p("cc.resource_pool.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = p("#{scope}.azure_storage_account_name")
   options["container_name"] = p("#{scope}.container_name")
-  add(options, "account_key",        p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = p("#{scope}.azure_storage_access_key")
   add(options, "environment",        p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = p("#{scope}.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_props!(options, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_props!(options, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cloud_controller_worker/spec b/jobs/cloud_controller_worker/spec
index 21f5c555f0..af7dc5f8e0 100644
--- a/jobs/cloud_controller_worker/spec
+++ b/jobs/cloud_controller_worker/spec
@@ -41,6 +41,7 @@ templates:
   storage_cli_config_resource_pool.json.erb: config/storage_cli_config_resource_pool.json
 
 packages:
+  - ali-storage-cli
   - azure-storage-cli
   - capi_utils
   - cloud_controller_ng
diff --git a/jobs/cloud_controller_worker/templates/storage_cli_config_buildpacks.json.erb b/jobs/cloud_controller_worker/templates/storage_cli_config_buildpacks.json.erb
index 400ccf3d01..479f4bb8a7 100644
--- a/jobs/cloud_controller_worker/templates/storage_cli_config_buildpacks.json.erb
+++ b/jobs/cloud_controller_worker/templates/storage_cli_config_buildpacks.json.erb
@@ -12,37 +12,54 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+  custom.each { |k, v| add(options, k.to_s, v) }
+end
+
+def apply_custom_from_props!(options, scope)
+  begin
+    custom = p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 scope = "cc.buildpacks.connection_config"
 provider = p("cc.buildpacks.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = p("#{scope}.azure_storage_account_name")
   options["container_name"] = p("#{scope}.container_name")
-  add(options, "account_key",        p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = p("#{scope}.azure_storage_access_key")
   add(options, "environment",        p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = p("#{scope}.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_props!(options, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_props!(options, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cloud_controller_worker/templates/storage_cli_config_droplets.json.erb b/jobs/cloud_controller_worker/templates/storage_cli_config_droplets.json.erb
index 60e46c9f30..9cd8f94d10 100644
--- a/jobs/cloud_controller_worker/templates/storage_cli_config_droplets.json.erb
+++ b/jobs/cloud_controller_worker/templates/storage_cli_config_droplets.json.erb
@@ -12,37 +12,54 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+  custom.each { |k, v| add(options, k.to_s, v) }
+end
+
+def apply_custom_from_props!(options, scope)
+  begin
+    custom = p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 scope = "cc.droplets.connection_config"
 provider = p("cc.droplets.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = p("#{scope}.azure_storage_account_name")
   options["container_name"] = p("#{scope}.container_name")
-  add(options, "account_key",        p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = p("#{scope}.azure_storage_access_key")
   add(options, "environment",        p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = p("cc.droplets.connection_config.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_props!(options, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_props!(options, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cloud_controller_worker/templates/storage_cli_config_packages.json.erb b/jobs/cloud_controller_worker/templates/storage_cli_config_packages.json.erb
index f11ec11221..363bde44e6 100644
--- a/jobs/cloud_controller_worker/templates/storage_cli_config_packages.json.erb
+++ b/jobs/cloud_controller_worker/templates/storage_cli_config_packages.json.erb
@@ -12,37 +12,54 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+  custom.each { |k, v| add(options, k.to_s, v) }
+end
+
+def apply_custom_from_props!(options, scope)
+  begin
+    custom = p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 scope = "cc.packages.connection_config"
 provider = p("cc.packages.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = p("#{scope}.azure_storage_account_name")
   options["container_name"] = p("#{scope}.container_name")
-  add(options, "account_key",        p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = p("#{scope}.azure_storage_access_key")
   add(options, "environment",        p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = p("#{scope}.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_props!(options, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_props!(options, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/jobs/cloud_controller_worker/templates/storage_cli_config_resource_pool.json.erb b/jobs/cloud_controller_worker/templates/storage_cli_config_resource_pool.json.erb
index 9b3f7f40d9..5895ced893 100644
--- a/jobs/cloud_controller_worker/templates/storage_cli_config_resource_pool.json.erb
+++ b/jobs/cloud_controller_worker/templates/storage_cli_config_resource_pool.json.erb
@@ -12,37 +12,54 @@ def cli_cfg_with_default_timeout(connection_cfg, blobstore_type, default_seconds
   cfg
 end
 
-# helper: add key only when value is present
+# add key only when value is present
 def add(h, key, val)
   return if val.nil?
   return if val.respond_to?(:empty?) && val.empty?
   h[key] = val
 end
 
+# merge optional custom flags into options
+def apply_custom!(options, custom)
+  return unless custom.respond_to?(:each)
+  custom.each { |k, v| add(options, k.to_s, v) }
+end
+
+def apply_custom_from_props!(options, scope)
+  begin
+    custom = p("#{scope}.custom", {})
+    apply_custom!(options, custom)
+  rescue
+    # ignore if property not defined
+  end
+end
+
 scope = "cc.resource_pool.connection_config"
 provider = p("cc.resource_pool.blobstore_provider", nil)
 
-if provider != "AzureRM"
-  options = {} # for now: all non-azure providers output an empty JSON object
-else
+if provider == "AzureRM"
   options = {}
   options["provider"] = provider
   options["account_name"]   = p("#{scope}.azure_storage_account_name")
   options["container_name"] = p("#{scope}.container_name")
-  add(options, "account_key",        p("#{scope}.azure_storage_access_key"))
+  options["account_key"] = p("#{scope}.azure_storage_access_key")
   add(options, "environment",        p("#{scope}.environment", "AzureCloud"))
   add(options, "put_timeout_in_seconds", p("#{scope}.put_timeout_in_seconds", nil))
 
-  # optional passthrough for extra storage-cli flags
-  begin
-    custom = p("#{scope}.custom", {})
-    if custom.respond_to?(:each)
-      custom.each { |k, v| add(options, k.to_s, v) }
-    end
-  rescue
-    # ignore if property not defined
-  end
+  apply_custom_from_props!(options, scope)
   options = cli_cfg_with_default_timeout(options, 'storage_cli')
+elsif provider == "aliyun"
+  options = {}
+  options["provider"] = provider
+  options["access_key_id"] = p("#{scope}.aliyun_accesskey_id")
+  options["access_key_secret"] = p("#{scope}.aliyun_accesskey_secret")
+  options["endpoint"] = p("#{scope}.aliyun_oss_endpoint")
+  options["bucket_name"] = p("#{scope}.aliyun_oss_bucket")
+  add(options, "region_id",            p("#{scope}.aliyun_region_id", nil))
+
+  apply_custom_from_props!(options, scope)
+else
+  options = {} # for now: all non-azure and non-aliyun providers output an empty JSON object
 end
 -%>
 <%= JSON.pretty_generate(options) %>
\ No newline at end of file
diff --git a/packages/ali-storage-cli/README.md b/packages/ali-storage-cli/README.md
new file mode 100644
index 0000000000..24aa31ccf9
--- /dev/null
+++ b/packages/ali-storage-cli/README.md
@@ -0,0 +1,9 @@
+ali-storage-cli-package
+============
+ali-storage-cli, a command line interface for AliOSS Storage, is used for BOSH deployments instead of outdated fog-aliyun tools.
+
+The file can be downloaded from the following location:
+
+| Filename | Download URL       |
+|----------|--------------------|
+| xxx      | [xxx](example url) |
diff --git a/packages/ali-storage-cli/packaging b/packages/ali-storage-cli/packaging
new file mode 100644
index 0000000000..3d8aa073b0
--- /dev/null
+++ b/packages/ali-storage-cli/packaging
@@ -0,0 +1,5 @@
+set -e
+
+mkdir -p ${BOSH_INSTALL_TARGET}/bin
+mv ali-storage-cli/ali-storage-cli-linux-amd64 ${BOSH_INSTALL_TARGET}/bin/ali-storage-cli
+chmod +x ${BOSH_INSTALL_TARGET}/bin/ali-storage-cli
diff --git a/packages/ali-storage-cli/spec b/packages/ali-storage-cli/spec
new file mode 100644
index 0000000000..0e778f6d8f
--- /dev/null
+++ b/packages/ali-storage-cli/spec
@@ -0,0 +1,4 @@
+---
+name: ali-storage-cli
+files:
+  - ali-storage-cli/ali-storage-cli-linux-amd64
\ No newline at end of file