Use CloudControl API with its unified interface and AI Agent support to perform security risk audits for diverse cloud resources at a low cost.-Cloud Control API(Cloud Control API)-阿里云帮助中心

Background

Security risks for cloud resources evolve as your infrastructure scales and attack techniques advance. Building a robust system for cloud resource risk audits often requires a deep understanding of various cloud products, integrating disparate APIs, and writing custom detection code. This approach leads to high learning and development costs.

Solution: CloudControl API MCP Server

CloudControl API supports over 80 cloud products and more than 300 types of cloud resources. It integrates with an AI Agent pre-trained in cloud security, allowing you to perform risk audits across diverse cloud resources using natural language prompts. This method significantly reduces audit costs.

You can also direct the AI Agent to package successful parameter calls from the CloudControl API MCP Server into reusable audit tools with multi-language SDKs. This eliminates the need to write code manually or consult product documentation.

For more information, see Learn about CloudControl MCP Server.

Common cloud resource security risks

The following table lists common security risks in the cloud. You can use CloudControl API and an AI Agent to audit these risks.

Risk area	Typical risk item
Compute layer	ECS instances have unnecessarily exposed public IPs; outdated images are in use.
Data layer	RDS has public access enabled.
Load balancing	SLB listeners do not use secure communication protocols, transmitting web traffic in plaintext.

The following examples show how to use natural language with an AI Agent to perform the risk audits mentioned above.

Use case

This section uses the Cursor development environment to demonstrate how to use natural language with an AI Agent to audit security risks for various cloud products.

Audit 1: ECS public IP exposure

Example prompt: Are there any ECS instances in my account with unnecessary public IPs exposed?

The AI Agent returns the check results: Among a total of 10 instances across the China (Hangzhou), China (Beijing), and China (Shanghai) regions, two are bound to a public IP. One of these, a suspected test instance in China (Hangzhou) with a name starting with tf-test, poses an unnecessary public exposure risk. The agent recommends releasing the public IP or switching to an Elastic IP Address and a NAT Gateway.

The AI Agent reads all ECS instances across all regions in the account through the CloudControl MCP Server. It filters for instances with a public IP and uses contextual information, such as the instance name, to identify instances with potentially unnecessary public exposure and provide security recommendations.

Audit 2: RDS public access

Example prompt: Are there any RDS instances in my account with public access enabled?

Are there any RDS instances in my account with public access enabled?
Based on the query results for RDS instances in your account across the China (Hangzhou), China (Beijing), China (Shanghai), and Singapore regions, the public access status is as follows.
RDS Public Access Check Results
Summary
Region              RDS Instance Count    Public Access
China (Hangzhou)    1                     Not Enabled
China (Beijing)     0                     -
China (Shanghai)    0                     -
Singapore           0                     -
Total               1                     All intranet-only
Details for the Sole RDS Instance (Public Access Not Enabled)
Property            Value
Instance ID         rm-bp10hxxx
Description         Multi-AZ data layer MySQL
Engine              MySQL 8.0
Status              Running
Network Type        VPC
Connection Type     Intranet
Connection Address  rm-bp10h29zujxxx
VPC                 vpc-bp1t132cxxx
Availability Zone   cn-hangzhou-h
Note: A DbInstanceNetType of 'Intranet' indicates that the instance only provides connections within a VPC. It does not have a public address and cannot be accessed directly from the internet.

The AI Agent queries the network configurations of all RDS instances across multiple regions to confirm whether the connection type is Intranet. The audit results show that no RDS instances have public access enabled, which meets security requirements.

Audit 3: Insecure SLB listeners

Example prompt: Are there any SLB instances in the account with insecure listeners?

The AI Agent's report shows that one SLB instance was found in the China (Hangzhou) region. It has an intranet address of 172.16.1.77, a network type of VPC intranet, and its instance status is inactive.

The AI Agent inspects the listener configurations of the SLB instance and finds an insecure listener that only uses HTTP on port 80. This listener transmits web traffic in plaintext. The agent also provides tiered security recommendations, such as upgrading to HTTPS, configuring an HTTP to HTTPS redirect, or cleaning up the idle instance.

Recap: Single API for multi-product audits

The preceding examples audited security risks for three cloud products: ECS, RDS, and SLB. By describing audit requirements in natural language, the AI Agent can automatically perform cross-region resource queries, risk assessments, and provide recommendations. This model can be extended to more products, such as security groups, OSS, RAM, and Redis, to build comprehensive cloud resource risk audit capabilities.

Benefits of CloudControl API for risk auditing

Broad coverage: The API covers over 80 cloud products and more than 300 resource types. It allows for unified auditing across multiple dimensions, including networking, compute, data, storage, and identity and access, without integrating with each product's API individually.
Low startup cost: You can describe audit requirements using natural language. The AI Agent then uses its pre-trained cloud security knowledge to identify risks and provide recommendations, eliminating the need to write code or read product security documentation.
Continuous operation: After an audit is complete, you can direct the AI Agent to package successful parameter calls into repeatable audit scripts. This enables continuous security inspections.
Lower context consumption and higher accuracy: CloudControl API has only nine standardized APIs. You can use ListProducts and ListResourceTypes to retrieve resource metadata on demand. Compared to integrating the APIs of multiple products, this design helps the AI Agent understand instructions more accurately and reduces incorrect results (hallucinations).

Summary

With the CloudControl API MCP Server, you can use natural language to direct an AI Agent to audit security risks across a wide range of cloud resources. The broad product coverage and standardized interface design of CloudControl API reduce the cost and complexity of security auditing, making it a routine operation.