Elastic Compute Service:Avoid using your Alibaba Cloud account and grant role-based permissions to RAM users

Protect your Alibaba Cloud account

1. Enable MFA: Attach a virtual MFA device to your Alibaba Cloud account. This adds a dynamic verification code (mobile token or hardware-protected key) on top of password authentication to prevent unauthorized access if your password is leaked.

2. Manage logon behavior:

   • Configure risk control: Limit logon frequency. Log on only when necessary, such as creating a RAM administrator or activating a service.

   • Set or purge a logon mask: Allow only specific IP addresses to access the console.

   • Set the session duration: Reduce the automatic sign-out time from the default 48 hours to 4 hours or less.

3. Disable the AccessKey of your Alibaba Cloud account: Instead, create a RAM user and grant permissions based on the principle of least privilege.

4. Audit and monitor regularly: Use ActionTrail to monitor logon events of your Alibaba Cloud account and check for abnormal behavior.

5. Use RAM users for daily operations: Create a RAM user as an account administrator. Create separate RAM users for different roles and grant permissions as needed.

Plan RAM users and access control

Create accounts, roles, and permissions based on job responsibilities. The following example shows role assignments in a typical enterprise:

1. Account administrator

   Used only to create RAM users, roles, and access permissions. Grant AliyunRAMFullAccess to this account. Although it cannot directly manage resources of other Alibaba Cloud services, it can create privileged accounts. This is a highly sensitive account; protect it as follows:

   • Do not create an AccessKey for the account.

   • Do not create RAM roles with the same permissions.

   • Enable MFA and restrict the source IP addresses for logon.

2. Resource administrator

   Used to create and manage resources such as ECS instances, VPCs, vSwitches, network interface cards, disks, security groups, snapshots, and images. Grant the AliyunECSFullAccess, AliyunVPCFullAccess, and AliyunEIPFullAccess policies. To attach a RAM role to an ECS instance, also grant the sts:AssumeRole permission.

   Suggestion: For many cloud resources, use resource groups to isolate resources. Create a separate ECS resource administrator account for each resource group to separate permissions horizontally.

3. O&M engineer

   Assigned to users who log on to and operate ECS instances (for example, start and stop). Not granted permissions to modify resources, network interface cards, or disks. Customize RAM permissions:

   {
     "Version": "1",
     "Statement": [
       // 1. Read-only permissions to view resource status
       {
         "Effect": "Allow",
         "Action": [
           // View ECS resources
           "ecs:DescribeInstances",        // View instance status
           "ecs:DescribeInstanceStatus",   // Query instance status information
           "ecs:DescribeNetworkInterfaces", // View network interface card status
           "ecs:DescribeDisks",            // View disk status (inferred from the document context)
           "ecs:DescribeSecurityGroups",   // View security group status
           "ecs:DescribeSecurityGroupReferences", // Query authorized security groups
           // View VPCs and vSwitches
           "vpc:DescribeVpcs",             // Query VPC status
           "vpc:DescribeVSwitches",        // Query vSwitch status
           "vpc:DescribeVSwitchAttributes" // Query detailed vSwitch configurations
         ],
         "Resource": "*"  // Allows access to all resources
       },
       // 2. Workbench permissions (logon and read)
       {
         "Effect": "Allow",
         "Action": [
           "ecs-workbench:LoginInstance",  // Permission to log on to an instance using Workbench
           "ecs:DescribeTerminalSessions"  // View Workbench session records
         ],
         "Resource": "*"
       },
       // 3. Cloud Assistant permissions (read, log on, and execute commands)
       {
         "Effect": "Allow",
         "Action": [
           // Read permissions for Cloud Assistant
           "ecs:DescribeCommands",         // View the list of commands
           "ecs:DescribeInvocations",       // View command execution records
           "ecs:DescribeInvocationResults", // View command execution results
           "ecs:DescribeCloudAssistantStatus", // Query the status of Cloud Assistant
           // Permissions to execute commands using Cloud Assistant
           "ecs:InvokeCommand",             // Execute a command
           "ecs:RunCommand"                 // Immediately execute a command
         ],
         "Resource": "*",
         // Restricts command execution to regular users (security best practice)
         "Condition": {
           "StringNotEqualsIgnoreCase": {
             "ecs:CommandRunAs": ["system", "root"]  // Prohibits the use of the root or system account
           }
         }
       }
     ]
   }

   Note: In this policy, "Resource": "*" allows managing all instances. To reduce risks:

   Consider the following:

   • Use resource groups or tags to limit the scope of operations.

   • Use fine-grained resource ARNs instead of wildcard characters to grant permissions as needed.

4. Application role

   Applications may also need to access Alibaba Cloud services such as OSS and Simple Log Service (SLS). Create a dedicated account or role for each application. Do not share accounts between users and applications, or between different applications:

   • Prohibit the application account from logging on to the console.

   • If your application is deployed on ECS (including container service), do not use an AccessKey. Attach a RAM role to the instance instead.

Use CloudSSO for centralized identity management

Use CloudSSO if any of the following applies:

• Multiple employees need RAM accounts with the same permissions.

• Multiple employees share one RAM account.

• Employees may leak cloud platform credentials such as AccessKeys or logon passwords.

CloudSSO is a multi-account unified identity management and access control service based on a resource directory (RD). Users log on once with a single set of credentials and access multiple cloud applications without re-entering passwords. Use CloudSSO to centrally manage enterprise users on Alibaba Cloud. After configuring SSO between your enterprise identity management system and Alibaba Cloud, you can centrally assign access permissions across all RD accounts.

• No cloud credentials required: Employees no longer need Alibaba Cloud logon passwords or AccessKeys, reducing credential leakage risk.

• Unified identity authentication: Users log on with internal enterprise accounts (such as company mailboxes or Active Directory accounts) for a seamless experience.

• Centralized permission management: Use access configurations to centrally assign role permissions to users or user groups with fine-grained control.

• Standard protocol support: Integrates with enterprise IdPs based on the SAML 2.0 protocol.

See Get started with CloudSSO.

Check operations performed by your Alibaba Cloud account