Assign different credentials for different workloads and environments
When a program accesses cloud resources, it must authenticate its identity using access credentials. These credentials can be a fixed AccessKey or a temporary Security Token Service (STS) token. If multiple programs share the same credentials, the permissions must cover all possible scenarios. This leads to overly broad permissions. Additionally, sharing credentials increases the impact of a leak. If the credentials are leaked, all applications and scenarios that use them are compromised. This increases the security risk and makes immediate remediation more difficult. Different environments for the same application, such as production and staging environments, often need to access different resources. Code in a staging environment is typically less stable and secure, which increases the risk of a leak. If these environments share credentials, a leak in the staging environment can compromise the production environment. This creates a significant security risk for your business.
Follow the principle of least privilege to reduce your attack surface. Assign a unique access credential to each workload or application. Assign separate credentials for each environment, such as development, staging, and production. This practice prevents mixing permissions and contains the impact of a potential leak.
Priority
High
Not recommended
Sharing a single access credential, such as an AccessKey or an STS token from the same RAM role, across multiple workloads. This mixes permissions and increases the potential impact of a leak.
Reusing access credentials across different environments. For example, using credentials from a development environment in a production environment. This increases the risk of a leak and increases the attack surface.
Mixing human and programmatic identities. For example, using the same Resource Access Management (RAM) user for both an employee to log on to the console and for a program to access Alibaba Cloud with an AccessKey. This practice mixes permissions, increases management costs, and increases the risk of a leak.
Implementation guide
Use temporary credentials, such as STS tokens, to call Alibaba Cloud OpenAPI and access cloud resources. This reduces the risks associated with leaked fixed credentials. For more information, see Use temporary credentials instead of fixed credentials.
Create and use credentials.
Use temporary credentials, such as STS tokens, to access Alibaba Cloud. This is the preferred method because it reduces the risks from leaked fixed credentials such as AccessKeys. To obtain a temporary credential, assume a RAM role. Create and assign different RAM roles for different workloads and environments. For more information, see Overview of RAM roles. To learn about different scenarios for using STS tokens, see Use temporary credentials instead of fixed credentials. Use STS tokens instead of AccessKeys whenever possible.
If you must use a fixed credential such as an AccessKey to access Alibaba Cloud, create a separate RAM user and AccessKey for each workload and environment. For instructions, see Create a RAM user and Create an AccessKey. To keep AccessKeys secure, manage them centrally, store them encrypted, and rotate them regularly. For more information, see Centrally manage fixed credentials, Encrypt credentials during storage and use, and Periodically review and rotate fixed credentials.
Perform regular reviews. Use the administration and detection features of Cloud Governance Center to regularly review and resolve issues such as mixed identities. Subscribe to administration reports to receive the latest detection results. This helps you promptly view and handle security risks. For instructions, see Subscribe to administration reports.
Security hardening.
Grant fine-grained permissions to programmatic identities. Ensure they have only the minimum permissions required. For more information, see Grant permissions based on the principle of least privilege.
For scenarios that use fixed credentials such as AccessKeys, use an AccessKey network access control policy. Restrict the source IP addresses of API requests that use the AccessKey. This ensures that AccessKey calls originate only from trusted network environments, which improves security.