Best practices for ECS instance security

Cloud security trends

Cybersecurity threats

The shift to cloud-based architectures introduces new security challenges. A single accidental operation can expose applications to the Internet or disclose keys. Security and compliance are essential to your cloud journey.

Prepare to protect cloud information assets

Protect cloud information assets

Cloud security uses policies, controls, and technologies to protect data, infrastructure, and applications from external and internal threats. To ensure compliance, develop cloud-based applications with security in mind from the start.

Protect Alibaba Cloud accounts

Enable MFA for accounts

Enable MFA for your Alibaba Cloud account. MFA requires security codes in addition to usernames and passwords, dynamically generated by MFA devices.See Enable MFA.

Use RAM users with least-privilege policies

Use instance RAM roles instead of AccessKey pairs to call API operations

Applications deployed on ECS instances typically access other Alibaba Cloud APIs using AccessKey pairs. However, storing AccessKey pairs on instances carries security risks such as leaks and maintenance difficulties. Instance RAM roles address these risks by using RAM for fine-grained permission control without exposing AccessKey pairs.

Attach an instance RAM role to an ECS instance and use a Security Token Service (STS) temporary credential to access other Alibaba Cloud APIs. After attaching the role, access instance metadata in security hardening mode. The STS temporary credential is updated periodically. See Instance RAM roles.

Prevent AccessKey pair leaks

AccessKey pairs are API credentials and must be kept secure. Do not expose them to external channels such as GitHub. If your AccessKey pair is disclosed, your resources are at risk.

Security suggestions for managing accounts and passwords

Manage information assets in bulk

Manage and audit cloud resources in bulk to prevent assets from being left unprotected due to misconfigurations. Use uniform deployment and naming conventions for instances and security groups, and periodically check for non-compliant resources. Use tags for bulk management, Cloud Assistant for automated O&M, and Cloud Config for compliance audits.

Use tags to manage resources in bulk

• Use tags to identify, categorize, and find cloud resources in bulk. In a security incident, tags help quickly identify the scope and severity.

• Configure security policies with specific tags for resources such as security groups at once.

See Tags.

Use Cloud Assistant to automate O&M on resource channels

Use Cloud Config to conduct compliance audits on resources

Cloud Config evaluates and monitors cloud resources for compliance. It aggregates resources across regions, records configuration changes in timelines, and generates alerts for non-compliant configurations. See What is Cloud Config?

Configure security when creating instances

Host business that requires high security on security-enhanced instances

Use secure images

• Use public images and enable security hardening for the images.

  • Use public images provided by Alibaba Cloud.

  • Enable free security hardening for public images to get features such as webshell detection, security configuration checks, and unusual logon alerts.

• Use encrypted custom images.

  Use the AES-256 algorithm to encrypt custom images to prevent data leaks. Create encrypted disks and then create encrypted custom images from them. You can also encrypt an image copy using the Copy and Encrypt feature. For shared encrypted images, create separate BYOK keys to prevent key leaks. See Copy a custom image.

Encrypt data on disks by using KMS

Use snapshots for disaster recovery purposes

• Use snapshots to back up data

  Snapshots are the foundation of disaster recovery and help reduce data loss from system failures, accidental operations, and security issues. Create snapshots based on your needs. See Create snapshot manually.

  Create automatic snapshots daily and retain them for at least seven days to improve disaster tolerance and minimize data loss.

• Use encrypted snapshots

  ECS uses AES-256 encryption for snapshots to prevent data leaks. Create encrypted disks and then create encrypted snapshots from them.

Access instance metadata in security hardening mode

ECS instance metadata includes instance information in Alibaba Cloud. You can view and use the metadata of running instances to configure or manage them. See Instance metadata.

Isolate and secure network resources

VPC abstracts physical networks into isolated secure virtual networks at the data link layer. VPCs are fully isolated and connect only through elastic IP addresses or NAT IP addresses. You can configure IP address ranges, CIDR blocks, route tables, and gateways within each VPC. Connect on-premises data centers to VPCs using VPN Gateway, Express Connect, or Smart Access Gateway (SAG). Connect networks worldwide using Cloud Enterprise Network (CEN).

Networks are vulnerable to cyberattacks. In Alibaba Cloud, control access to VPCs using security groups, network ACLs, routing policies, or Express Connect circuits. Also configure Cloud Firewall, WAF, and Anti-DDoS for external threat protection.

Follow the security suggestions for isolating network resources

Build a secure network environment

• Properly configure security groups to isolate networks and reduce attack surface

  Security groups control network access to and from ECS instances. Configure rules to filter traffic by port and IP address to reduce attack surface.

  For example, port 22 is the default SSH port on Linux instances. Leaving it open poses security risks. Configure rules to allow only specific IP addresses to access port 22, or use VPN to encrypt logon data.

  Suggestion	Description	References
  Principle of least privilege	Security groups should work like whitelists. Open only necessary ports and allocate only necessary public IP addresses. Use a VPN or bastion host for troubleshooting. Incorrect configurations may expose ports or IP addresses to the Internet. Open only ports required by business in security groups for both Internet and internal network traffic. For high-risk service ports, allow access only from specific IP addresses. For HTTP service management backends, allow access only from specific IP addresses and enable WAF for the domain name.	Security group guidelines and use cases
  Do not set 0.0.0.0/0 as an authorization object in your security group rules.	Allowing all inbound access is a common mistake. 0.0.0.0/0 means all IP addresses. A rule with this authorization object opens all ports to external access. Deny access over all ports by default, then allow only required ports such as 80, 8080, and 443.	Add a security group rule
  Disable inbound security group rules that are no longer needed.	If a rule includes 0.0.0.0/0, review the ports your applications expose. For ports that should not provide external services, add a Deny rule. For example, if MySQL runs on port 3306, add a Deny rule with the lowest priority (100).	Add a security group rule
  Reference security groups as authorization objects in security group rules.	Add rules based on the principle of least privilege. Different application layers should use different security groups with appropriate inbound and outbound rules. For distributed applications with security groups that are not mutually accessible, add rules that reference security groups (instead of IP addresses or CIDR blocks) as authorization objects to allow mutual access. For example, create sg-web for the web layer and sg-database for the database layer. In sg-database, add a rule that references sg-web to allow access over port 3306.	Add a security group rule
  For security groups of the classic network type, do not set CIDR blocks or IP addresses as authorization objects in rules that govern internal network traffic.	By default, no inbound rules for internal network traffic are enabled for classic network instances. Exercise caution when configuring such rules.	Security group rule
  Configure appropriate names and tags for security groups.	Clear names and descriptions help identify security groups. Add tags to security groups via the ECS console or API for easy search and management.	Modify a security group Tags
  Add ECS instances that require mutual access to the same security group.	Each ECS instance can belong to up to five security groups. Instances in the same security group communicate over the internal network. If you have multiple security groups, create a new group and add instances that need internal network communication. Do not add all instances to the same security group. For distributed applications, each instance plays a different role and needs specific inbound and outbound rules.	Associate security groups with an instance (primary ENI)
  Isolate instances within a security group.	Security groups act as virtual firewalls with Stateful Packet Inspection (SPI). Instances in the same security group share the same region and security requirements. Alibaba Cloud fine-tunes internal access control policies to isolate instances within a security group.	Use security groups
  Use security group quintuple rules.	Security groups control network access to ECS instances and provide logical security isolation. Quintuple rules enable precise access control based on source IP, source port, destination IP, destination port, and transport layer protocol.	Security group quintuple rules
  Add ECS instances that provide Internet-facing services and those that provide internal network-facing services to different security groups.	Applications on an ECS instance may be Internet-accessible when the instance exposes ports (such as 80 and 443) or uses port forwarding rules (such as NAT port forwarding or EIP-based forwarding). Apply the strictest security group rules. Deny all protocols and ports by default, then allow only ports required by external services such as 80 and 443. Internet-facing instances in the same security group should have clear responsibilities. Deploy backend services like MySQL and Redis on instances without Internet access, then use security group rules to allow access from specific security groups.	Add a security group rule

• Configure security domains to isolate services of different security levels within your organization

  Build private networks with VPCs to host servers of different security levels separately. Create a VPC, assign a CIDR block, configure route tables and gateways, and store important data in this logically isolated VPC. Use an EIP or jump server for daily O&M. See Create and manage a VPC.

• Use jump servers or bastion hosts to protect against internal and external intrusions

  Jump servers have broad permissions. Use bastion hosts instead to record and audit all O&M operations, detect anomalies, and attribute actions to specific personnel.

  Assign the jump server to a dedicated vSwitch in a VPC and associate the corresponding EIP or NAT port forwarding table. Create a dedicated security group (SG_BRIDGE) and open only required ports (TCP 22 for Linux, RDP 3389 for Windows). Restrict inbound access to specific public IP addresses of your organization. To grant the jump server access to another security group (SG_CURRENT), add a rule allowing access from SG_BRIDGE over specific protocols and ports. For SSH, use key pairs instead of passwords. See SSH key pair overview.

• Properly assign public IP addresses to reduce Internet-exposed attack surface

  Proper public IP allocation reduces attack surface. For VPC instances, connect instances needing Internet access to a few designated vSwitches for easier auditing.

  • Do not assign public IP addresses to instances that don't provide Internet services. For multiple Internet-facing instances, use SLB to distribute traffic. See SLB overview.

  • For instances that need outbound Internet access but don't have public IPs, use NAT gateways. Configure SNAT entries for specific CIDR blocks or subnets to avoid exposing services to the Internet. See What is VPN Gateway?

Use security services to build a security defense system

Use Anti-DDoS Origin Basic (free-of-charge), Anti-DDoS Pro, and Anti-DDoS Premium to mitigate DDoS attacks

DDoS attacks flood targets with fraudulent traffic from multiple compromised systems. Alibaba Cloud Security Center defends against Layer 3 to Layer 7 attacks, including SYN, UDP, ACK, ICMP, DNS, and HTTP flood attacks. Anti-DDoS Origin Basic provides up to 5 Gbit/s DDoS mitigation free of charge.

Anti-DDoS Origin Basic is enabled on ECS instances by default, maintaining normal access during DDoS attacks without purchasing scrubbing devices. After creating an instance, set its traffic scrubbing thresholds.

Use Security Center Basic for free to protect against exploitation of system vulnerabilities

Security Center is a centralized security management system that identifies, analyzes, and warns of threats in real time. Features include anti-ransomware, antivirus, web tamper proofing, and compliance checks.

Security Center Basic is available by default and scans for unusual logons, vulnerabilities, and cloud service configuration risks. For advanced features such as threat detection, vulnerability fixing, and virus removal, purchase a paid edition from the Security Center console. See Security Center Basic.

Use WAF to protect against exploitation of system vulnerabilities

WAF protects web applications against common OWASP attacks and HTTP flood attacks, including SQL injections, XSS attacks, webshells, trojans, and unauthorized access. WAF blocks malicious traffic to prevent data leaks and ensure website security and availability. See Getting started.

Protect applications in instance guest operating systems

Configure security settings to ensure secure logons to ECS instances

By default, a non-root account can log on to an ECS instance. Grant administrative permissions using su or sudo. The root account cannot log on with a PEM key file by default. For Linux instances, configure only RSA key pair-based logon. For Windows instances, use complex passwords with at least eight characters and special characters.

Avoid weak service passwords

Use IDaaS for application identity and permissions

Alibaba Cloud Identity as a Service (IDaaS) provides cloud-native identity and permission management, including organization management, account lifecycle management, SSO, and permission control. See IDaaS.

Encrypt data in transit

Configure security groups or firewalls to allow communication only between ports that encrypt data. Use encryption protocols such as TLS 1.2 and later to encrypt sensitive data in transit between clients and ECS instances.

Monitor and audit log exceptions

The M-Trends 2018 report by FireEye found that the global median dwell time (from attack to detection) was 101 days, and 498 days in Asia Pacific. Reliable log data and audit services are essential to shorten dwell time.