Establish secure logon mechanisms

Users typically log on using a username and password. If an attacker obtains these credentials, they can log on to Alibaba Cloud and cause irreversible losses. Therefore, it is critical to protect the usernames and passwords for all user identities.

Priority

High

What to avoid

• Failing to implement a strong password policy for Resource Access Management (RAM) users and your Alibaba Cloud account. A strong password policy should require high password complexity and multi-factor authentication (MFA).

• Using the same logon password for different services, sites, or users.

• Failing to rotate logon passwords regularly.

Implementation guide

After you register an Alibaba Cloud account, you can log on to the Alibaba Cloud Management Console using a username and password. A successful logon grants you the root identity. After you register the account, immediately perform security hardening:

1. Set a strong password for the Alibaba Cloud account. Use a combination of digits, uppercase and lowercase letters, and special characters. The password must be at least 8 characters long.

2. Enable MFA.

3. Update the password regularly. For example, change the password every 90 days and do not reuse previous passwords.

Create an independent identity for each person who needs to access cloud resources. Use these identities for daily cloud operations management instead of the root identity. If you use RAM users instead of the root identity to log on to the console for operations and maintenance (O&M), you can improve logon security in the following ways:

1. Increase password strength. For example, increase the password length and use a combination of digits, uppercase and lowercase letters, and special characters. For RAM users, an administrator can set a password policy for RAM users to enforce complex passwords. This reduces the threat of password leaks and cracking.

2. Avoid password reuse. Using the same password across different services, sites, or users increases the risk of a leak. If a password is leaked, an attacker can use it to access other services. To reduce this threat, ensure that each service and user has a unique password.

3. Rotate passwords regularly. The longer a password is in use, the higher the threat of a leak. Resetting passwords regularly reduces their lifespan and lowers the threat. For RAM users, an administrator can set a password expiration period in the password policy for RAM users to enforce regular password rotation.

4. Use multi-factor authentication. MFA is a simple and effective security practice that adds another layer of protection in addition to a username and password. For RAM users, an administrator can attach an MFA device to a RAM user for secondary identity verification. This verification is used when users log on to Alibaba Cloud or perform sensitive operations to better protect your account.

5. Enforce MFA for important operations. You can use permissions to allow only RAM users with MFA enabled to perform certain important operations.

   1. In a single-account scenario, you can use RAM to restrict cloud resource access to only RAM users with MFA enabled.

   2. In a multi-account scenario, you can use control policies in Resource Directory to centrally manage policies across your organization. These policies define the permission boundaries for accounts. For example, the following policy prevents RAM users who are not enabled with MFA from deleting ECS instances:

      {
        "Statement": [
          {
            "Action": "ecs:DeleteInstance",
            "Effect": "Deny",
            "Resource": "*",
            "Condition": {
              "Bool": {
                "acs:MFAPresent": "false"
              }
            }
          }
        ],
        "Version": "1"
      }

Related resources

Related practices

• Avoid using the root identity

• Implement unified identity verification based on a unified IdP

References

• RAM Tutorials

• Custom control policy examples for Resource Directory