Network access control

After migrating to the cloud, the first step is to plan your network architecture and manage your network's attack surface. You can use cloud networking technologies to build flexible business networks. Minimize your network exposure to reduce security risks while ensuring normal business operations.

A virtual private cloud (VPC) is a foundational service that provides an isolated network environment for deploying your business systems. You can deploy different products and services in different VPCs. A network ACL (Network Access Control List) is a network access control feature in a VPC. You can customize network ACL rules and associate the network ACL with a vSwitch to control traffic to and from Elastic Compute Service (ECS) instances in that vSwitch.

Network isolation is not just about restricting access at network borders. Adopt a zero-trust approach that does not rely solely on network perimeters. You must implement sufficient network isolation even within the same network perimeter in the cloud. For example, you can use security groups to restrict network access between different ECS instances. Determine if your services require public network access. If they do not, attach the instances to a vSwitch that has no route to the Internet.

Alibaba Cloud also provides security products, such as Cloud Firewall, to help businesses defend against advanced and complex attacks. These native security features provide default security and support rapid scaling.

For more information about the relationship between security groups, network ACLs, and Cloud Firewall, see the following:

Use security groups to manage instance traffic

A security group is a virtual firewall that controls inbound and outbound traffic for instances such as ECS, ApsaraDB RDS, and SLB. Inbound rules in a security group control incoming traffic to an instance. Outbound rules control outgoing traffic from an instance.

Security group configuration planning

In Alibaba Cloud, an instance can be associated with a maximum of five security groups. A single security group can contain up to 200 rules. This means an instance can have over a thousand security group rules applied simultaneously. Before you add security group rules, define the access restrictions for all instances. Plan each rule and the applications or instances it covers. This practice helps prevent an excessive number of temporary rules, which can make management more complex.

Principles for configuring security groups

Follow these principles when you use security groups.

1. Principle of least privilege: Open only specific ports, such as port 80. Avoid setting the authorization object to 0.0.0.0/0. Do not assign public IP addresses to resources that do not require public network access.

2. Granular permission management by role: Think of a security group as a business role defined by network access permissions. Instances within the group assume that role. An instance should not have too many roles, so avoid adding it to too many groups. Avoid using a single security group for all applications or creating a separate security group for each instance.

3. Test before making changes: Before you modify a security group in a production environment, clone the security group. Test your changes on the cloned group to avoid affecting your production applications.

4. Configure security group auditing: Regularly audit your security group rules for compliance and deliver the results to Simple Log Service (SLS). If a change makes a rule non-compliant with your audit policy, SLS can send you an alert.

5. Limit RAM user permissions: Restrict Resource Access Management (RAM) users from creating or referencing security groups that pose security risks. Ensure that all new security groups meet your security baselines and requirements. This helps establish a routine for administering security group rules.

6. Maintain all rules: Security group rules are a critical part of an instance's configuration. When you add a rule, include a description so others can understand its purpose. When an instance is released or an IP address changes, check for and remove any obsolete rules from the security group.

Use ACLs to control VPCs

A network ACL is a network access control feature for a VPC. You can customize network ACL rules and associate the network ACL with a vSwitch. This controls traffic to and from the ECS instances in that vSwitch. You can use both network ACLs and security groups to control traffic for vSwitches and ECS instances. The following figure shows the relationship between network ACLs and security groups:

Security groups and network ACLs are important tools for network access control, especially in a VPC environment. Each has a different focus, and using them together can improve the security of your cloud environment. The following are suggestions for using security groups and network ACLs together:

1. Clear layers and responsibilities: Security groups provide granular control. They are attached directly to cloud resources, such as ECS instances, to control traffic to and from that instance. They focus on instance-level access control. By default, instances within the same security group can communicate with each other without additional rules. Network ACLs operate at the subnet level. They are an optional security layer for a VPC that controls traffic entering and leaving one or more subnets. They are suitable for broad, subnet-level control and act as a first line of defense.

• Complementary rule design: Design your rules so that security group and network ACL rules do not conflict. For example, if a network ACL restricts inbound traffic on a specific port, the security group for instances in that subnet must allow the necessary outbound response traffic. This ensures that communication is successful.

• Order of execution: Network ACL rules are executed before security group rules. Therefore, you can set broader rules in the network ACL to allow traffic to reach an instance. Then, use the security group for more granular control.

• Layered defense: Treat security groups and network ACLs as part of a multilayer defense. If one layer is misconfigured, the other can still provide protection. For example, you can use a network ACL to globally block certain high-risk ports. Then, use a security group to refine access permissions for specific instances.

III. Use Cloud Firewall to control inbound and outbound traffic for your entire cloud environment

For enterprise scenarios, Alibaba Cloud provides Cloud Firewall. This service offers unified security policy management for traffic within a VPC or between VPCs. It controls network traffic entering and exiting your entire cloud environment, including resources such as ECS instances, VPC networks, and database services. Cloud Firewall provides centralized management, flexible policy configuration, and supports application-layer rules to control application-layer protocols such as HTTP and HTTPS. Cloud Firewall is available in the following types, based on its applicable scope:

1. Internet firewall: The Internet firewall operates at the Internet border to provide unified control and protection for all inbound and outbound traffic for your public assets. It has a built-in intrusion prevention module that supports features such as compromised host detection, blocking of outbound connections, and visualization of business access relationships. It supports one-click protection and requires no complex network configurations or image file installations. The firewall uses a cluster deployment and supports seamless performance scaling.

2. VPC firewall: The VPC firewall detects and controls east-west traffic between VPCs, and between VPCs and on-premises data centers. This traffic is transmitted over Cloud Enterprise Network (CEN) transit routers (Enterprise and Basic Editions) and Express Connect circuits. The firewall secures internal-facing traffic between VPCs, between a VPC and an on-premises data center through a Virtual Border Router (VBR), between a VPC and a third-party cloud through a VBR, and between a VPC and a VPN.

3. Internal firewall: The internal firewall manages ECS security groups to control inbound and outbound traffic for ECS instances within a VPC. After you publish an access control policy, it is automatically synchronized to the relevant ECS security group and takes effect. The firewall also supports security group compliance checks and micro-segmentation visualization.