Prohibit RAM users from creating Linux instances with password logon

When you create an ECS instance, you may be tempted to set a simple, easy-to-remember password, such as "Test123456!" or "Password!". Such passwords are easy for attackers to guess using a brute-force or dictionary attack. Even if you use a complex password, you might reuse it across multiple systems. If the password for one system is compromised, an attacker can use the leaked password to log on to other systems, which increases your security risks.

Alibaba Cloud recommends that you use an SSH key pair for logon when you create an ECS instance. An SSH key pair is far more secure than a conventional password. It is computationally infeasible to derive the private key from the public key, which effectively eliminates the threat of brute-force attacks. We also recommend that you connect to your instances using Session Manager. Session Manager is a feature of Cloud Assistant that allows you to connect to instances without using an instance password or an SSH key pair, which makes it more secure than conventional logon methods.

This topic provides an example of how to prohibit a RAM user named Alice from creating a Linux instance with password logon.

1. In the RAM console, create a RAM user named Alice.

   For more information, see Create a RAM user.

2. In the RAM console, create a policy named ecs-password-control. On the JSON tab, enter the following policy:

   Note

   This policy denies the creation of Linux instances with custom passwords. It also prevents you from setting a password by resetting the instance password or replacing the system disk.

   {
     "Version": "1",
     "Statement": [
       {
         "Action": [
           "ecs:RunInstances",
           "ecs:CreateInstance",
           "ecs:ReplaceSystemDisk"
         ],
         "Resource": "*",
         "Condition": {
           "Bool": {
             "ecs:PasswordCustomized": [
               "true"
             ]
           },
           "StringEquals": {
             "ecs:ImagePlatform": "linux"
           }
         },
         "Effect": "Deny"
       },
       {
         "Action": [
           "ecs:CreateOrder",
           "ecs:ModifyInstanceAttribute",
           "ecs:InvokeCommand",
           "ecs:AttachDisk"
         ],
         "Resource": "*",
         "Condition": {
           "Bool": {
             "ecs:PasswordCustomized": [
               "true"
             ]
           }
         },
         "Effect": "Deny"
       }
     ]
   }

3. Create another policy named ecs-admin. On the JSON tab, enter the following policy:

   Note

   This policy grants permissions to manage ECS, including purchasing, managing, and viewing ECS instances. This policy simulates an ECS administrator. You can modify the policy to meet your needs.

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "ecs:*",
           "ecs-workbench:*",
           "vpc:CheckCanAllocateVpcPrivateIpAddress",
           "vpc:DescribeVpcs",
           "vpc:DescribeVSwitches",
           "bss:ModifyAgreementRecord",
           "bss:DescribeOrderList",
           "bss:DescribeOrderDetail",
           "bss:PayOrder",
           "bss:CancelOrder"
         ],
         "Resource": "*"
       }
     ]
   }

4. In the RAM console, grant permissions to the RAM user Alice.

   For Authorization Scope, select Account Level, for Principal, select the RAM user (Alice), and for the policy, select the custom policies that you created in the previous step (ecs-password-control and ecs-admin). For more information, see Manage permissions for RAM users.

Log on to the Alibaba Cloud Management Console as the RAM user Alice.

For more information, see Log on to the Alibaba Cloud Management Console as a RAM user.