Identity and access control
Identity and access control helps you centrally manage user identities on Alibaba Cloud. Only authenticated users with specific permissions can access or manage your Alibaba Cloud resources. This practice prevents unauthorized access and helps you meet compliance auditing requirements. This topic describes the security features of Elastic Compute Service (ECS) for identity and access control, covering three areas: identity authentication security, access control security, and advanced security enhancements.
Improve identity authentication security
Enable multi-factor authentication (MFA) for your Alibaba Cloud account to improve security. Do not use the AccessKey pair of your Alibaba Cloud account. Instead, create AccessKey pairs for Resource Access Management (RAM) users and assign them to your applications. This practice prevents the exposure of plaintext AccessKey pairs on external developer platforms. Regularly delete inactive RAM users. When possible, use temporary tokens from the Security Token Service (STS).
Improve access control security
Use predefined system policies and custom RAM policies in ECS to grant permissions to users based on their job responsibilities. You can use resource groups to manage resources based on dimensions such as purpose or departmental structure, and then grant users permissions to access specific resource groups. You can also use tags for fine-grained resource management and control.
Advanced security enhancements for identity and access control
Associate RAM roles with specific ECS instances instead of using plaintext AccessKey pairs. Enable ActionTrail for post-event behavior analysis and security tracking. This helps you detect potential security risks and meet compliance auditing requirements. You can also activate the free identity and access governance service to regularly check for security risks in identities and permissions. This helps you promptly enhance the security of your identity and permission configurations in the cloud.
Improve identity authentication security
Identity authentication is the process of verifying a user's identity using credentials. This process typically involves using a password or an AccessKey pair to log on to an ECS instance.
Enable multi-factor authentication (MFA)
Description
Multi-factor authentication (MFA) is a simple and effective security practice that adds a second layer of security to your username and password. When you log on to the console or perform sensitive operations, you can use MFA for secondary identity verification. MFA does not affect API calls made with an AccessKey pair. This practice makes your account more secure. For more information, see MFA devices supported by RAM.
Configuration
Do not directly use the AccessKey pair of your Alibaba Cloud account to log on to ECS instances. You can enable MFA for your Alibaba Cloud account. MFA adds a security code (the second factor), which is generated by an MFA device, to your username and password (the first factor). This practice improves the security of your account. For more information, see Bind an MFA device to an Alibaba Cloud account.
Use RAM users instead of Alibaba Cloud accounts and set permissions properly
Ensure users have the least privilege required to access ECS resources. Avoid sharing accounts or granting overly broad permissions.
If multiple users in your organization, such as employees, systems, or applications, need to access multiple Elastic Compute Service (ECS) instances, you can use Resource Access Management (RAM). You can create multiple RAM users under your Alibaba Cloud account and then grant specific access policies to these RAM users to allow them to use the instances. This approach avoids the security risk of sharing a single AccessKey pair among multiple people. It also provides fine-grained access control over your ECS resources at the account level. For more information, see RAM users.
After identity authentication, RAM creates two types of identities: entity identities (RAM users) and virtual identities (RAM roles). A virtual identity must be assumed by an entity user before it can be used. For more information, see Identity management.
Prevent AccessKey pair leaks
An AccessKey pair of an Alibaba Cloud account is the credential used to access Alibaba Cloud APIs. You must keep it secure. Do not expose your AccessKey pair on external channels, such as GitHub. This practice prevents malicious use and security threats. A leaked AccessKey pair compromises the security of all your resources. Follow these security recommendations for using AccessKey pairs to reduce the risk of leaks.
Do not embed AccessKey pairs in your code.
Rotate your AccessKey pairs regularly.
Revoke unnecessary AccessKey pairs regularly.
Follow the principle of least privilege and use RAM users.
Enable
acs:SourceIpto restrict access to Alibaba Cloud APIs to specific public IP CIDR blocks.Set
acs:SecureTransportto true to enforce access to Alibaba Cloud over HTTPS.
Improve access control security
Grant permissions based on job responsibilities
When multiple users in your enterprise need to collaborate on resources, RAM lets you avoid sharing the keys of your Alibaba Cloud account. You can assign permissions to users based on the principle of least privilege. This practice reduces information security risks for your enterprise.
By default, an Alibaba Cloud account has full permissions to all its resources. RAM users created by the Alibaba Cloud account have no permissions by default. You must grant permissions to RAM users. The authorization process consists of two steps:
Create an access policy.
Two types of policies are available: system policies and custom policies. System policies are maintained by Alibaba Cloud. You can use system policies but cannot modify them. In contrast, you can create, update, and delete custom policies.
ECS system policies: System policies for Elastic Compute Service
ECS custom policies: Custom policies
Grant permissions to a RAM user or RAM role.
Attach one or more access policies to a RAM user or RAM role. The authorization can apply to all resources under the Alibaba Cloud account or only to resources within a specific resource group. You can attach both system policies and custom policies.
Use resource groups for fine-grained resource management
Description
Resource groups allow you to group your cloud resources based on dimensions such as purpose, permissions, or ownership. This capability helps you manage resources for multiple users and projects within your enterprise. Each cloud resource can belong to only one resource group. Adding a resource to a resource group does not change its relationships with other resources. For example, you can group resources by purpose by placing production instances in a production resource group and staging instances in a staging resource group. For more information, see What is a resource group?.
Configuration
To create a resource group, see Create a resource group.
Add an ECS instance to a resource group.
When you create an ECS instance, you can add it to a resource group. For more information, see Create a custom instance.
You can also transfer an existing ECS instance to a resource group. For more information, see Manually transfer resources between resource groups.
For examples of how to classify and manage ECS resources using resource groups, see Use resource groups to restrict RAM users from managing specified ECS instances and Use resource groups to split the bills of ECS instances.
Use tags for fine-grained resource management
Description
In addition to resource groups, you can use tags to classify resources. Compared with resource groups, tags are a more flexible tool for resource classification. For example, you can add multiple tags to a resource based on its region, department, and environment. A single resource can have multiple tags. You can also control access to ECS resources based on tags. For more information, see What is a tag?.
Configuration
To create tags and attach them to an ECS instance, see Tags.
For examples of how to classify and manage ECS resources using tags, see Use tags to group and authorize ECS instances and Use tags to restrict RAM users from managing specified ECS instances.
Advanced security enhancements for identity and access control
Use instance RAM roles instead of AccessKey pairs
Description
Typically, applications on ECS instances use the AccessKey pair of an Alibaba Cloud account or a RAM user to access Alibaba Cloud APIs. To meet API call requirements, the AccessKey pair must be hardcoded in the instance, for example, in a configuration file. However, this method grants excessive permissions and poses risks, such as information leaks and difficult maintenance. To resolve these issues, Alibaba Cloud provides instance RAM roles. Instance RAM roles ensure the security of AccessKey pairs and enable fine-grained permission control and management through RAM.
Configuration
An instance RAM role lets you associate a role with an ECS instance. Applications on the instance can then use temporary credentials from the Security Token Service (STS) to access other Alibaba Cloud APIs. The temporary credentials can be obtained only from within the instance. This way, you do not need to configure an AccessKey pair. This ensures the security of your Alibaba Cloud account's AccessKey pair and enables fine-grained control and permission management through RAM. For more information, see Instance RAM roles.
Enable ActionTrail
Features
ActionTrail is an Alibaba Cloud service that lets you query and deliver operation records of your Alibaba Cloud account resources. It can be used for scenarios such as security analytics, resource change tracking, and compliance auditing. ActionTrail supports delivering management events to a Logstore of Simple Log Service (SLS) or a bucket of Object Storage Service (OSS). This meets requirements for real-time auditing and issue analysis and backtracking. For more information, see What is ActionTrail?.
You can query the management events generated by your operations on ECS in ActionTrail. For more information, see Audit events for Elastic Compute Service. When an abnormal operation occurs on an ECS instance, you can quickly query the event to obtain information such as the time of the event, the region, and the affected ECS instance. This helps you resolve the issue quickly.
Configuration methods
Elastic Compute Service (ECS) is integrated with ActionTrail by default. It is enabled by default and requires no manual configuration.
Activate the identity and access governance service
Description
The identity and access governance service continuously checks for security risks in the identities and permissions of your Alibaba Cloud account and its RAM users. This check is based on security best practices for cloud migration. The service helps you promptly identify governance gaps and provides user-friendly guidance to enhance your identity and permission configurations in the cloud.
Configuration
You can activate the free identity and access governance service to check for security risks in identities and permissions. This helps you promptly enhance the security of your identity and permission configurations in the cloud. To activate the service, see Overview of identity and access governance.