Deploy compute resources using a unified base image
In a cloud computing environment, a unified base image is a core component for building standard, secure, and efficient workloads. For large-scale deployments across multiple Alibaba Cloud accounts, managing and using a unified base image helps an enterprise achieve the following:
Security: Centralize security scans and enforce the use of compliant images.
Consistency: Maintain a unified global baseline and reduce configuration drift.
Efficiency: Automate batch distribution for rapid coverage.
Priority
High
Discouraged practices
Building images independently in each Alibaba Cloud account of a multi-account environment. This practice leads to versioning issues, inconsistent security baselines, and security risks.
Deploying images to production without a security scan. This can lead to attackers exploiting known vulnerabilities in the images.
Relying on manual replication of images to other Alibaba Cloud accounts in the enterprise. This process is inefficient and error-prone.
Not using versioning for images. This practice makes rollbacks difficult, can cause version conflicts, and affects business stability.
Implementation guide
Image security is crucial for both Elastic Compute Service (ECS) and containerized deployments, especially at scale. Large-scale deployments across multiple member accounts present several challenges. For example, business units might build images independently, which makes it difficult to maintain a unified security baseline and introduces security risks. Distributing images across multiple regions and accounts is also a challenge.
For ECS images, you can use the golden image solution. Build images through an automated process in a separate, shared account. During the build process, automatically scan images for vulnerabilities and apply fixes to ensure security. You can implement unified control by restricting the image IDs that application accounts can use. This prevents the use of non-compliant images. Use resource sharing and automation to efficiently distribute images in batches to all application accounts. For more information, see Multi-account Golden Image solution.
For container images, you can use Container Registry (ACR) to centrally manage and build container images.
Image building: Use an Enterprise instance to build images and implement an automated continuous integration flow from source code to container image. To ensure image version consistency, enable image version immutability. This prevents image versions from being overwritten due to human error.
Image scanning: Use the container image security scan feature to scan for and fix vulnerabilities in images.
Image distribution: Use the image distribution feature of Container Registry to quickly distribute images across regions and accounts. For more information, see Sync instances within the same account and Sync instances across different accounts.