Centrally manage static credentials
Avoid issuing static credentials, such as AccessKey pairs and database account passwords, directly to individuals. Do not hard-code credentials in plaintext in your code. You can use a secrets manager, such as KMS Secrets Manager or a third-party Vault, to centrally manage credentials. This practice prevents individuals from directly handling credentials and reduces the risk of a data breach.
Priority
High
Discouraged practices
Creating credentials and providing them to developers in plaintext. If a developer leaves the company, it is difficult to track where the credentials are used, which complicates source tracing.
Hard coding credentials in plaintext in code or configuration files. If the code is accidentally committed to a public repository, such as GitHub, credentials such as AccessKey pairs can be exposed. Even in an internal repository, poor permission management can result in unauthorized access to the AccessKey pairs.
Creating AccessKey pairs for employees and providing them in plaintext. For example, an Operations and Maintenance (O&M) engineer might receive an AccessKey pair and write it into a local script for automated O&M. If the computer is lost or the script is accidentally committed to a public repository such as GitHub, the AccessKey pair is exposed.
Implementation guide
For scenarios that require static credentials, such as AccessKey pairs for Resource Access Management (RAM) users, you can centrally manage the credentials. This prevents individuals from directly accessing them. On Alibaba Cloud, the following solutions are recommended:
To centrally manage RAM user AccessKey pairs, use KMS Secrets Manager to host RAM credentials. This method lets you centrally manage AccessKey pairs. When a service requires an AccessKey pair, you can host one for it and set an automatic rotation period to reduce the risk of a data breach. During rotation, Secrets Manager calls Resource Access Management (RAM) to create a new AccessKey pair and then deletes the old one. KMS then writes the new AccessKey pair to the secret value and deletes the old secret value. If you discover that a RAM credential has been compromised, you can immediately rotate the credential. In this case, you can set the rotation interval to 30 minutes for a quick rotation to minimize losses. For more information, see Centrally manage static AccessKey pairs using KMS.
For database account passwords on the cloud, you can use KMS to host database credentials. This eliminates the need to configure your applications with static database account passwords. An administrator can create a database credential in Secrets Manager and set a periodic, automatic rotation for the credential to reduce the security risk of a data breach. If a credential is leaked, you can also use the immediate rotation feature in the console to quickly rotate the credential and mitigate threats. KMS currently supports credential hosting for the following database products:
For ECS account passwords or public-private key pairs, you can use KMS Secrets Manager to host ECS credentials. Business applications and Alibaba Cloud services can dynamically retrieve account passwords from KMS. You can also configure rotation for the credentials to reduce the risk of password leaks.
For other generic secret types, such as account passwords, AccessKey pairs, OAuth keys, or API tokens, you can use KMS Secrets Manager to host generic secrets. This mitigates the data breach risk caused by hard coding generic secrets in your code. KMS does not directly support periodic rotation for generic secrets. However, you can use Function Compute to configure periodic rotation. For more information, see Use Function Compute to rotate a generic secret.
After you centralize credential management, you can easily encrypt, store, and periodically rotate credentials. This further improves the security of credential storage and usage.