Cloud resource security

Alibaba Cloud builds security into every product from the design phase. This practice ensures that our cloud services start with strong security settings. These settings are the foundation of your security. Because user scenarios are diverse and complex, we offer flexible custom configurations. These options allow you to adapt to different industries and specific business needs. This flexibility means you also have a responsibility for security. You must follow the security guidelines and best practices for each product. Configure and manage your cloud resources carefully based on your business needs.

1. Elastic Compute Service (ECS) security

Operating system security

Operating system security is the foundation of ECS security. For user logon and the operating system, configure your system as follows:

1. Logon security: The traditional method for logging on to a server is to use a username and password over a public IP address and port. This method is vulnerable to password cracking from scans. Additionally, the logon records cannot be traced or audited. You can use the following methods instead:

   1. Connect to an instance using a session management connection. This method is similar to using Bastionhost. It lets you securely log on to an ECS instance without a password and supports tracing of all logon operations.

   2. Use an SSH key pair to log on instead of a username and password.

   3. SSH keys support only Linux instances. If you cannot use an SSH key, log on with an ECS user account instead of the default root account. In addition, use KMS to manage and regularly update your logon credentials to avoid risks from leaked passwords.

2. Operating system security

   1. Use the security agent plugin, enable security hardening for the image, and regularly scan for and fix security vulnerabilities in the operating system.

   2. Use Security Center to fix system vulnerabilities and to scan for and remove trojans and viruses from the operating system.

   3. Use the patch management feature of CloudOps Orchestration Service to automatically set up patch scans and corresponding remediation policies.

   4. If you have security compliance requirements, you can also use the Alibaba Cloud Linux MLPS 2.0 image. This is a native operating system provided by Alibaba Cloud that enhances the security and compliance of the entire operating system.

Access control

After you secure the operating system, you can further restrict access to the ECS instance:

1. Account access control

   1. Use Alibaba Cloud RAM and resource groups to group and grant permissions to ECS instances. This practice restricts RAM users to viewing and managing only the instances to which they are granted permissions.

   2. Attach tags to ECS instances and then use custom policies in RAM to specify which tags are authorized. This practice restricts RAM users to viewing and managing only the specified ECS instances.

2. Network access control

   1. Security groups: When you expose cloud resources to different networks, follow the principle of least privilege. Minimize the attack surface to meet your business needs and ensure that resources are accessible only from necessary IP addresses.

   2. Network ACL (Access Control List): You can manage and configure all traffic that enters and leaves a subnet at the network layer.

3. Local disk access control: For ECS instances with local disks, you can use file system permissions at the operating system level to manage access. This practice prevents unauthorized read and write operations.

Backup and recovery

Finally, you should back up the sensitive data on your ECS instances. If you are affected by a ransomware attack, you can quickly recover your business and reduce losses. You can back up your data as follows:

1. Use an automatic snapshot policy to regularly back up data on disks that store critical business data. This policy helps you recover from data loss caused by accidental deletion, ransomware, or application failures. You can quickly restore disk data when needed to ensure business continuity.

2. Use custom images to back up the environment configuration and data of an ECS instance. This practice allows for quick recovery when needed.

2. ApsaraDB RDS security

Access restrictions

Databases often store important business data, and exposing this data can cause serious data leaks. You must strictly limit the scope of access when you use your database:

1. Restrict access sources using whitelists and security group rules

   1. After you create an RDS instance, you must add IP addresses to a whitelist. Only devices with these IP addresses can access the RDS instance.

   2. Associate and reuse ECS security group policies. This practice allows only ECS instances in that security group to access RDS.

2. Restrict RDS access to within a VPC

Switch the network type of your RDS instance from the default classic network to a VPC. Typically, you should select the VPC where your ECS instance is located. This enables service interconnection between the ECS instance and the RDS instance within the same VPC. If your on-premises servers also need to access RDS, you can connect your IDC resources to Alibaba Cloud using a VPN or a leased line.

Data encryption

Databases often store sensitive data, such as personal identity information, contact details, and order information. You should encrypt this data during transmission, storage, and use. This practice ensures that the data remains protected even if the physical layer is attacked or the data is accessed improperly. Common encryption methods include the following:

1. Use SSL to encrypt data in transit: You can use SSL to authenticate the source of the connected database service. This effectively prevents man-in-the-middle attacks and ensures the security and privacy of data during transmission.

2. Data encryption at rest:

   1. Transparent Data Encryption (TDE): TDE encrypts data before it is written to disk. When an application requests the data, it is decrypted. While the data is being used for operations such as queries and updates, it exists in plaintext. At the storage layer, however, the data is stored as ciphertext.

   2. Disk encryption: For RDS instances that use cloud disks, Alibaba Cloud offers a free disk encryption feature. This feature encrypts the entire data disk at the block storage level. Even if a data backup is leaked, it cannot be decrypted, which maximizes data security. Encryption does not affect your business, and your applications do not need to be modified.

Database backup

You should regularly back up your database. This practice prevents data from becoming unavailable due to hardware failure, human error, virus attacks, or data corruption. RDS provides a default backup feature. For more specific needs, you can also use DBS.

• RDS default backup: RDS provides a built-in backup feature. The system automatically performs full data backups and incremental log backups.

• DBS backup: An advanced backup feature that supports cross-account backup, single database or single table backup, geo-redundancy, and storing backups in OSS.

3. Object Storage Service (OSS) security

Access control

To ensure the security of data in Object Storage Service (OSS), OSS resources, including buckets and objects, are private by default. Only the resource owner or authorized users can access them. You must not set them to public-read or public-read-write. To grant a third-party user access to your OSS resources, you can use various access control policies. These policies include resource access permissions based on RAM users ( RAM Policy ), access permissions based on a single bucket ( bucket policy ), and access permissions based on a single object ( Object Policy ). For buckets and objects, you can set an access control list (ACL) for read and write permissions.

The following are some common configuration recommendations:

• Configure access permissions based on user needs. For example, you can restrict a RAM user to have only read permissions for one or more specific buckets.

• For sensitive buckets, you can restrict access by RAM user, source IP address, and other criteria.

• Set an ACL for read and write permissions on buckets and objects. You should grant the corresponding permissions only after approval.

Data encryption

OSS supports server-side and client-side data encryption:

• With server-side encryption, data is encrypted within OSS, and the keys are managed by OSS or KMS. This method is mainly for high-security scenarios where frequent access to encryption keys is not needed, and it simplifies key management.

• With client-side encryption, the client, such as an application or user, encrypts the data before uploading it to OSS. The decryption process also occurs on the client. This method is suitable for cross-cloud or multicloud environments. It is also suitable for situations where data is highly sensitive, has strict compliance requirements, or must be decrypted by a specific entity.

Data backup

OSS provides two different data protection mechanisms: versioning and Cloud Backup.

• Versioning saves previous versions of an object when it is overwritten or deleted. If an object is accidentally overwritten or deleted, you can restore it to any of its previous versions.

• Cloud Backup is often used for disaster recovery and failure scenarios. It can periodically back up objects in a bucket. If large-scale data loss occurs, you can use Cloud Backup to recover the data.

You can use both methods together to provide multilayer protection for your data.

4. Container service security

Identity authentication and access control

1. Use Role-Based Access Control (RBAC) to manage user access permissions. You can precisely control access to resources by restricting the scope of roles and cluster roles.

2. Cluster access control: Cluster access supports two methods: kubeconfig and service accounts.

   1. kubeconfig: The default certificate is valid for 3 years. You should set the validity period as needed. You must revoke the credential immediately if you suspect it has been leaked.

   2. Service accounts: You can control the access scope of service accounts using the RBAC mechanism. You must follow the principle of least privilege during configuration.

3. Pod access control:

   1. Network Policies: You can use configuration files to set up network communication rules between pods. For example, you can specify which pods can communicate with each other and on which ports and protocols. This helps improve security and reduce the attack surface.

   2. Deploy service account token volume projection: You can dynamically generate and manage short-term, pod-based tokens. This practice reduces potential issues from token leaks or expiration.

   3. Isolate pod permissions by configuring the RAM permissions of a ServiceAccount using RAM Roles for Service Accounts (RRSA).

4. You can use ACK-TEE confidential computing to place important data and code in a special trusted execution environment (TEE).

Runtime security protection

1. Restrict system calls from containerized applications to the kernel using tools such as Secure Computing Mode (Seccomp). You can set your Seccomp policy as follows:

   1. Set defaultAction to "deny". This setting denies all system calls that are not explicitly allowed in the policy and is the most basic and secure setting for a Seccomp policy.

   2. Follow the principle of least privilege and allow only the system calls that the application needs.

   3. For allowed system calls, you can further restrict their parameters. For example, you can restrict the open call to allow opening only specific types of files or files with specific flags.

2. Use configuration inspection to dynamically check for security risks in application workloads.

You can use the security configuration inspection feature provided by ACK to detect insecure configuration items in your cluster workloads in real-time. The results are shown to operations and maintenance (O&M) engineers in intuitive reports. After the inspection is complete, you should review the report to harden the security of your workload configurations.

3. Use Alibaba Cloud Security Center for threat detection and prevention.

Security Center uses cloud-native deployment capabilities for automated threat data collection, detection, analysis, response, and remediation for container services and provides unified security management. By combining Kubernetes logs and cloud platform operation logs, Security Center performs real-time behavior auditing and Fraud Detection. This helps address risks such as container escape, AccessKey leaks, and unauthorized access in container services and orchestration platforms.