Elastic Compute Service:Protect Alibaba Cloud accounts and prevent credential leakage

Protect account passwords and enable MFA

• Set complex passwords: Weak passwords are a primary cause of account breaches. Avoid weak passwords to prevent brute-force attacks.

• Change passwords regularly: Change your password every 90 days to reduce leakage risk from long-term use.

• Enable MFA: Attach or detach a virtual MFA device for your Alibaba Cloud account and RAM users. MFA adds a dynamic verification code, such as a mobile token or a hardware-protected key, as an extra layer beyond password authentication to prevent unauthorized access.

Use ECS RAM roles instead of AccessKeys

If an application on an ECS instance needs to call Alibaba Cloud APIs, such as for ECS scaling, use a RAM role instead of an AccessKey.

from alibabacloud_credentials.client import Client as CredClient
from alibabacloud_credentials.models import Config as CredConfig
from alibabacloud_tea_openapi.models import Config
from alibabacloud_ecs20140526.client import Client as EcsClient
from alibabacloud_ecs20140526 import models as ecs_models
from alibabacloud_tea_util.models import RuntimeOptions

# Step 1: Obtain an STS token
def get_sts_token():
    config = CredConfig(
        type="ecs_ram_role",
        enable_imds_v1=False
    )
    cred_client = CredClient(config)
    credential = cred_client.get_credential()
    return {
        "AccessKeyId": credential.get_access_key_id(),
        "AccessKeySecret": credential.get_access_key_secret(),
        "SecurityToken": credential.get_security_token()
    }

# Step 2: Initialize the ECS client
def create_ecs_client(sts_token):
    config = Config(
        access_key_id=sts_token["AccessKeyId"],
        access_key_secret=sts_token["AccessKeySecret"],
        security_token=sts_token["SecurityToken"],
        endpoint="ecs.cn-hangzhou.aliyuncs.com"
    )
    return EcsClient(config)

# Step 3: Build the request to create an instance
def build_create_instance_request():
    return ecs_models.RunInstancesRequest(
        region_id="cn-hangzhou",
        image_id="aliyun_3_x64_20G_scc_alibase_20220225.vhd",
        instance_type="ecs.e-c1m2.xlarge",
        security_group_id="sg-bp1esyhwfbqeyudt****",
        v_switch_id="vsw-bp1nzprm8h7mmnl8t****",
        instance_name="sdk-test",
        instance_charge_type="PostPaid",
        key_pair_name="sdk-key-pair",
        system_disk_category="cloud_essd"
    )

# Step 4: Call the API to create the instance
def create_instance(client, request):
    runtime = RuntimeOptions()
    try:
        response = client.run_instances_with_options(request, runtime)
        print("Instance created successfully. Instance ID:", response.body.instance_id_sets.instance_id_set[0])
    except Exception as e:
        print("Failed to create instance. Error message:", e)

# Main function
if __name__ == "__main__":
    sts_token = get_sts_token()  # Obtain an STS token
    ecs_client = create_ecs_client(sts_token)  # Initialize the ECS client
    request = build_create_instance_request()  # Build the request to create an instance
    create_instance(ecs_client, request)  # Call the API to create the instance

Protect AccessKeys and reduce leakage risk

If you must use an AccessKey, strengthen its security management throughout its lifecycle — creation, storage, distribution, and use.

• Creation: Follow the principle of "one AccessKey per person, one AccessKey per application." Do not share an AccessKey among multiple users or programs. This lets you quickly identify the responsible party, limit the impact, and rotate the key if leaked.

• Permission management: Follow the principle of least privilege and grant only necessary permissions. Use RAM users and assign permissions based on responsibilities. Avoid using the Alibaba Cloud account AccessKey. See Avoid using your Alibaba Cloud account and grant different permissions to RAM users with different responsibilities.

• Secure storage: Store AccessKeys on trusted devices, such as:

  • A file readable only by root or a specific user.

  • A database or Key Management Service (KMS) with access control.

  • Do not store AccessKeys in notes, code repositories, chat records, or personal signatures.

• Secure distribution: Send the encrypted AccessKey file through one channel (such as email) and the decryption password through a separate channel (such as a text message).

• Secure use: Do not hard-code AccessKeys in your code. Store the AccessKey in a separate configuration file, encrypt it, and save it on a trusted server. After distribution, decrypt the file and set permissions so only the owner can read it.

• Network access control: Configure a network access control policy for the AccessKey in the RAM console.

• Regular rotation and cleanup

  • Rotate regularly: Rotate your AccessKey every 90 days. Generate a new AccessKey and notify users to update.

  • Clean up regularly: Check AccessKey operation records in the RAM console and revoke unused keys. See Delete the AccessKey of a RAM user.

• Monitor for AccessKey leakage: Use the AccessKey leakage detection feature in Security Center to check whether an AccessKey has been leaked. This feature supports alert notifications. If a leak occurs, Alibaba Cloud provides restrictive protection for the AccessKey to prevent escalation.

Compliance