In a single-tenant fully managed service, a customer's business runs in a virtual private cloud (VPC) within the service provider's Alibaba Cloud account. The VPCs for different customers are isolated from each other, which prevents data security and privacy issues that may occur in a multi-tenant scenario. Because the service provider manages all resources in that VPC, the customer's data is exposed to risks if the service provider's operations fall short of security standards. Compute Nest provides a compliance package check mechanism that checks the VPC for data security risks and logs a risk event whenever a violation is detected.
Security risks in single-tenant deployments
The following risks can affect a customer's data when it resides in a VPC managed by the service provider:
| Risk | Description |
|---|---|
| Internet access | Resources such as servers and databases are reachable over the Internet, making them vulnerable to network attacks or data breaches. |
| Resource changes | Unrelated resources added to the VPC can serve as jump servers, leading to unauthorized access, service interruptions, or data tampering. |
| Data export | Data migrated or exported from the VPC may result in a breach of customer data. |
| Private connections | Connecting the customer VPC to another VPC of the service provider through a private connection creates a path for data leakage or tampering. |
Enable the compliance package check
The service provider enables the compliance package check when creating or updating a fully managed service. The feature is free of charge.
Once enabled, the compliance package check cannot be disabled.
To enable the feature:
In the Compute Nest console, go to the service creation or update page.
In the Advanced Configuration (Optional) section, enable the compliance package check.
After you enable the feature, the system checks for potential data breach risks in the customer's VPC and logs a risk event whenever a compliance rule is triggered.
Compliance rules
The compliance package detects risk events based on the following rules:
| Rule | What is checked |
|---|---|
| No Internet access | Whether public IP addresses or public gateways are assigned to resources such as servers and databases |
| No resource changes | Whether new or unrelated resources (such as additional servers) have been added to the VPC |
| Data at rest accessible only within VPC | Whether data at rest stored in the VPC is accessible from outside the VPC |
| No data export | Whether operations such as configuration data synchronization, data migration, server image creation, or disk snapshot creation have occurred |
| No private connections | Whether private connections between VPCs have been configured |
View risk events
When a compliance rule is triggered for a deployed service instance, both the service provider and the customer can view the risk event on the Logs tab of the service instance.
A red dot on the Logs tab indicates one or more unread risk events.
View risk events as a service provider
In the Compute Nest console, find the customer's deployed service instance.
On the Logs tab, click the compliance package log to view the risk event details.
Subscribe to risk event notifications in CloudMonitor
To receive risk alerts without manually checking the console, subscribe to the ServiceInstanceNonCompliance event in CloudMonitor. This event fires whenever a compliance rule violation is detected for a service instance.
To set up notifications:
Log on to the CloudMonitor console.
In the left-side navigation pane, choose Event Center > Notification Configuration. On the Notification Configuration page, click Create Policy and configure the Name and Contact Group parameters.
In the left-side navigation pane, choose Event Center > Event Subscription. On the Event Subscription page, click Create Subscription Policy.
In the Basic information section, enter a policy name. In the Subscription Scope section, select ComputeNest from the Products drop-down list and select ServiceInstanceNonCompliance from the Event name drop-down list.
Select the notification configuration created in step 2 and configure your preferred notification methods.
Click Submit. The contact group you specified receives a notification whenever a
ServiceInstanceNonComplianceevent fires. To review past events, go to the System Event page in the CloudMonitor console.
