CIS Alibaba Cloud Foundations Benchmark
Secure configuration guidelines for Alibaba Cloud (Aliyun) Infrastructure
v1.0.0 September 2024Overview
▶This CIS Benchmark provides prescriptive guidance for establishing a secure configuration posture for Alibaba Cloud. Recommendations cover RAM identity and access management, networking and VPC, ECS compute, storage and OSS, database services, and logging and monitoring.
| Section | Area | Focus |
|---|---|---|
| 1 | IAM | RAM, MFA, policies |
| 2 | Networking | VPC, security groups, WAF |
| 3 | Compute | ECS, IMDSv2, snapshots |
| 4 | Storage | OSS, encryption, NAS |
| 5 | Database | RDS, SQL audit, TDE |
| 6 | Logging | ActionTrail, Security Center |
Profile Definitions
▶| Profile | Description | Intended Use |
|---|---|---|
| L1 | Level 1 — Standard | Essential security for all Alibaba Cloud deployments; minimal performance impact. |
| L2 | Level 2 — Hardened | Advanced hardening for PCI-DSS, HIPAA, or high-security environments. |
1 — Identity & Access Management
▶1.1 RAM Configuration
▶This recommendation verifies that MFA Is Enabled for All RAM Users with Console Access on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that MFA Is Enabled for All RAM Users with Console Access:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure MFA Is Enabled for All RAM Users with Console Access:
aliyun ram UpdateLoginProfile ...
This recommendation ensures that RAM Password Policy Requires Minimum 14 Characters on the Alibaba Cloud cloud platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.
Without this enforcement, the Alibaba Cloud cloud platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.
Use the Alibaba Cloud CLI or Console and verify that RAM Password Policy Requires Minimum 14 Characters:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure RAM Password Policy Requires Minimum 14 Characters:
aliyun ram UpdateLoginProfile ...
This recommendation ensures that RAM Password Policy Requires Uppercase and Symbols on the Alibaba Cloud cloud platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.
Without this enforcement, the Alibaba Cloud cloud platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.
Use the Alibaba Cloud CLI or Console and verify that RAM Password Policy Requires Uppercase and Symbols:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure RAM Password Policy Requires Uppercase and Symbols:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Unused RAM User Credentials Are Removed on the Alibaba Cloud cloud platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Alibaba Cloud cloud platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Use the Alibaba Cloud CLI or Console and verify that Unused RAM User Credentials Are Removed:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Unused RAM User Credentials Are Removed:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that AccessKey Rotation Is Configured for 90 Days on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that AccessKey Rotation Is Configured for 90 Days:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure AccessKey Rotation Is Configured for 90 Days:
aliyun ram UpdateLoginProfile ...
1.2 RAM Policies & Groups
▶This recommendation verifies that AdministratorAccess Policy Is Not Attached Directly to Users on the Alibaba Cloud cloud platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Alibaba Cloud cloud platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Use the Alibaba Cloud CLI or Console and verify that AdministratorAccess Policy Is Not Attached Directly to Users:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure AdministratorAccess Policy Is Not Attached Directly to Users:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that RAM Groups Are Used for Permission Assignment on the Alibaba Cloud cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Alibaba Cloud cloud platform uses the correct component aligns with industry best practices and standards.
Use the Alibaba Cloud CLI or Console and verify that RAM Groups Are Used for Permission Assignment:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure RAM Groups Are Used for Permission Assignment:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Custom Policies Follow Least Privilege on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Custom Policies Follow Least Privilege:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Custom Policies Follow Least Privilege:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that STS Assume Role Conditions Are Configured on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that STS Assume Role Conditions Are Configured:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure STS Assume Role Conditions Are Configured:
aliyun ram UpdateLoginProfile ...
2 — Networking & VPC
▶2.1 VPC Configuration
▶This recommendation verifies that No Security Group Allows Ingress from 0.0.0.0/0 to Port 22 on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that No Security Group Allows Ingress from 0.0.0.0/0 to Port 22:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure No Security Group Allows Ingress from 0.0.0.0/0 to Port 22:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that No Security Group Allows Ingress from 0.0.0.0/0 to Port 3389 on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that No Security Group Allows Ingress from 0.0.0.0/0 to Port 3389:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure No Security Group Allows Ingress from 0.0.0.0/0 to Port 3389:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Default Security Group Restricts All Traffic on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Default Security Group Restricts All Traffic:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Default Security Group Restricts All Traffic:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that VPC Flow Logs Are Enabled on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that VPC Flow Logs Are Enabled:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure VPC Flow Logs Are Enabled:
aliyun ram UpdateLoginProfile ...
2.2 Connectivity & Load Balancing
▶This recommendation verifies that NAT Gateway Is Used for Internet Egress on the Alibaba Cloud cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Alibaba Cloud cloud platform uses the correct component aligns with industry best practices and standards.
Use the Alibaba Cloud CLI or Console and verify that NAT Gateway Is Used for Internet Egress:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure NAT Gateway Is Used for Internet Egress:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that SLB Listeners Use HTTPS or TCP on the Alibaba Cloud cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Alibaba Cloud cloud platform uses the correct component aligns with industry best practices and standards.
Use the Alibaba Cloud CLI or Console and verify that SLB Listeners Use HTTPS or TCP:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure SLB Listeners Use HTTPS or TCP:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that WAF Is Enabled for Public-Facing Applications on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that WAF Is Enabled for Public-Facing Applications:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure WAF Is Enabled for Public-Facing Applications:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Anti-DDoS Is Configured for Public Resources on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Anti-DDoS Is Configured for Public Resources:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Anti-DDoS Is Configured for Public Resources:
aliyun ram UpdateLoginProfile ...
3 — ECS Compute
▶3.1 Instance Configuration
▶This recommendation ensures that ECS Instances Do Not Have Public IP Unless Required on the Alibaba Cloud cloud platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.
Without this enforcement, the Alibaba Cloud cloud platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.
Use the Alibaba Cloud CLI or Console and verify that ECS Instances Do Not Have Public IP Unless Required:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure ECS Instances Do Not Have Public IP Unless Required:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that ECS Instances Use Encrypted System Disks on the Alibaba Cloud cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Alibaba Cloud cloud platform uses the correct component aligns with industry best practices and standards.
Use the Alibaba Cloud CLI or Console and verify that ECS Instances Use Encrypted System Disks:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure ECS Instances Use Encrypted System Disks:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Instance Metadata Service Uses IMDSv2 on the Alibaba Cloud cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Alibaba Cloud cloud platform uses the correct component aligns with industry best practices and standards.
Use the Alibaba Cloud CLI or Console and verify that Instance Metadata Service Uses IMDSv2:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Instance Metadata Service Uses IMDSv2:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Cloud Assistant Agent Is Installed on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Cloud Assistant Agent Is Installed:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Cloud Assistant Agent Is Installed:
aliyun ram UpdateLoginProfile ...
3.2 Instance Access
▶This recommendation verifies that SSH Key Pairs Are Used Instead of Passwords on the Alibaba Cloud cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Alibaba Cloud cloud platform uses the correct component aligns with industry best practices and standards.
Use the Alibaba Cloud CLI or Console and verify that SSH Key Pairs Are Used Instead of Passwords:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure SSH Key Pairs Are Used Instead of Passwords:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Security Center Agent Is Running on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Security Center Agent Is Running:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Security Center Agent Is Running:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Auto-Snapshot Policies Are Configured on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Auto-Snapshot Policies Are Configured:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Auto-Snapshot Policies Are Configured:
aliyun ram UpdateLoginProfile ...
4 — Storage & OSS
▶4.1 Object Storage Service
▶This recommendation verifies that OSS Buckets Are Not Publicly Accessible on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that OSS Buckets Are Not Publicly Accessible:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure OSS Buckets Are Not Publicly Accessible:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Server-Side Encryption Is Enabled for OSS Buckets on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Server-Side Encryption Is Enabled for OSS Buckets:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Server-Side Encryption Is Enabled for OSS Buckets:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that OSS Bucket Logging Is Enabled on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that OSS Bucket Logging Is Enabled:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure OSS Bucket Logging Is Enabled:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that OSS Bucket Versioning Is Enabled on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that OSS Bucket Versioning Is Enabled:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure OSS Bucket Versioning Is Enabled:
aliyun ram UpdateLoginProfile ...
4.2 Block & File Storage
▶This recommendation verifies that ECS Data Disks Use Encryption on the Alibaba Cloud cloud platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Alibaba Cloud cloud platform uses the correct component aligns with industry best practices and standards.
Use the Alibaba Cloud CLI or Console and verify that ECS Data Disks Use Encryption:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure ECS Data Disks Use Encryption:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that NAS File Systems Are Encrypted on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that NAS File Systems Are Encrypted:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure NAS File Systems Are Encrypted:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Automatic Snapshot Cleanup Is Configured on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Automatic Snapshot Cleanup Is Configured:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Automatic Snapshot Cleanup Is Configured:
aliyun ram UpdateLoginProfile ...
5 — Database Services
▶5.1 RDS Configuration
▶This recommendation verifies that RDS Instances Are Not Publicly Accessible on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that RDS Instances Are Not Publicly Accessible:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure RDS Instances Are Not Publicly Accessible:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that SSL Is Enabled for RDS Connections on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that SSL Is Enabled for RDS Connections:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure SSL Is Enabled for RDS Connections:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that RDS Automated Backups Are Configured on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that RDS Automated Backups Are Configured:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure RDS Automated Backups Are Configured:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that TDE Is Enabled for RDS Where Supported on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that TDE Is Enabled for RDS Where Supported:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure TDE Is Enabled for RDS Where Supported:
aliyun ram UpdateLoginProfile ...
5.2 Database Access Control
▶This recommendation verifies that RDS Whitelists Are Configured on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that RDS Whitelists Are Configured:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure RDS Whitelists Are Configured:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that SQL Audit Is Enabled for RDS on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that SQL Audit Is Enabled for RDS:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure SQL Audit Is Enabled for RDS:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Database Accounts Follow Least Privilege on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Database Accounts Follow Least Privilege:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Database Accounts Follow Least Privilege:
aliyun ram UpdateLoginProfile ...
6 — Logging & Monitoring
▶6.1 ActionTrail & SLS
▶This recommendation verifies that ActionTrail Is Enabled for All Regions on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that ActionTrail Is Enabled for All Regions:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure ActionTrail Is Enabled for All Regions:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that ActionTrail Logs Are Delivered to OSS or SLS on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that ActionTrail Logs Are Delivered to OSS or SLS:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure ActionTrail Logs Are Delivered to OSS or SLS:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Log Service (SLS) Is Configured for Key Resources on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Log Service (SLS) Is Configured for Key Resources:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Log Service (SLS) Is Configured for Key Resources:
aliyun ram UpdateLoginProfile ...
6.2 Security Center & Cloud Monitor
▶This recommendation verifies that Security Center Is Enabled at Enterprise Edition or Higher on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Security Center Is Enabled at Enterprise Edition or Higher:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Security Center Is Enabled at Enterprise Edition or Higher:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Cloud Monitor Alert Rules Are Configured on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Cloud Monitor Alert Rules Are Configured:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Cloud Monitor Alert Rules Are Configured:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Config Service Rules Are Enabled for Compliance on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Config Service Rules Are Enabled for Compliance:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Config Service Rules Are Enabled for Compliance:
aliyun ram UpdateLoginProfile ...
This recommendation verifies that Event Notifications Are Configured for Critical Changes on the Alibaba Cloud cloud platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Alibaba Cloud cloud platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Use the Alibaba Cloud CLI or Console and verify that Event Notifications Are Configured for Critical Changes:
aliyun ram ListUsers aliyun ecs DescribeInstances
Use the Alibaba Cloud CLI or Console to configure Event Notifications Are Configured for Critical Changes:
aliyun ram UpdateLoginProfile ...