Use Bastionhost for workload O&M operations
In a cloud-native architecture, opening SSH port 22 to the internet for direct server O&M poses a serious security risk. Bastionhost is a core tool for centralized operations management. It provides a unified entry point, fine-grained access control, and full traffic audits. This helps reduce the risk of lateral movement attacks, meet compliance audit requirements, and improve O&M efficiency.
Priority
High
Discouraged practices
Exposing a host's SSH port 22 directly to the internet. This allows attackers to use brute-force attacks or vulnerability exploits to compromise the host.
Sharing a single password or private key among multiple users to access an instance. This makes it difficult to assign accountability.
Failing to record O&M operations. This makes it impossible to trace abnormal behavior.
Implementation guide
Use Alibaba Cloud Bastionhost to perform O&M on compute resources. This prevents personnel from directly accessing compute resources.
Bastionhost supports the multi-account management feature. If you have multiple Alibaba Cloud accounts and want to use a single Bastionhost instance to manage assets across them, use Alibaba Cloud Resource Directory (RD). This enables unified O&M and control of assets across multiple accounts. For more information, see Best practices for multi-account management in Bastionhost.
Configure identity authentication for Bastionhost. Integrate users from your existing Identity Provider (IdP) with Bastionhost for unified user management. To integrate multiple user systems on Alibaba Cloud, such as RAM identities, Bastionhost users, and Cloud Desktop users, with your company's IdP for unified single sign-on (SSO), see Implement unified identity authentication based on a unified IdP.
Use the O&M audit feature of Bastionhost. Conduct comprehensive audits of system O&M operations, such as system logon logs and configuration change logs, and asset O&M sessions, such as session recordings and character commands. This maximizes your O&M security.
NoteBy default, Bastionhost stores logs for only 180 days. Archive audit logs to SLS for further processing and long-term storage. For example, you can ingest the logs into your company's Security Information and Event Management (SIEM) system for unified threat detection and analysis. For detailed instructions, see Archive audit logs to Simple Log Service.
For a detailed solution, see Unified O&M Solution for Hosts Across Multiple Accounts.