Checks whether an ApsaraDB for Redis instance has Internet access disabled or its whitelists exclude 0.0.0.0/0. If either condition is met, the evaluation result is Compliant.
Scenarios
Adding 0.0.0.0/0 to the IP address whitelist of an ApsaraDB for Redis instance allows access from all CIDR blocks, which poses high security risks. Proceed with caution.
Risk level
Default risk level: high.
You can change the risk level based on your business requirements when you apply this rule.
Compliance evaluation logic
- If Internet access is disabled for the ApsaraDB for Redis instance, or if the instance can access the Internet but its whitelists do not contain 0.0.0.0/0, the evaluation result is Compliant.
- If Internet access is enabled for the ApsaraDB for Redis instance and its whitelists contain 0.0.0.0/0, the evaluation result is Incompliant. For information about how to remediate an incompliant configuration, see the "Incompliance remediation" section of this topic.
Rule details
| Item | Description |
| Rule name | redis-public-and-any-ip-access-check |
| Rule identifier | redis-public-and-any-ip-access-check |
| Tag | Redis and Public |
| Automatic remediation | Not supported |
| Trigger type | Configuration change |
| Supported resource type | ApsaraDB for Redis instance |
| Input parameter | None |
Incompliance remediation
Disable Internet access for the instance, or remove 0.0.0.0/0 from its whitelists. For more information, see Configure an IP whitelist.