Security overview - Elastic Compute Service - Alibaba Cloud Documentation Center

Navigate ECS security by scenario: respond to active attacks, harden your instances, or configure compliance baselines.

Important

ECS security responsibility follows the shared responsibility model: Alibaba Cloud is responsible for the physical hardware, underlying network, virtualization platform, and management control services; customers are responsible for OS patching and upgrades, application security configuration, access management, and data encryption and traffic security.

When you are attacked or alerted

When an ECS instance is under attack, you may observe service unavailability, slow response times, or timeouts. Monitoring may reveal abnormal network traffic, unauthorized login attempts, or unexplained CPU spikes. The following table covers three common attack types and how to identify and respond to each.

Attack type and symptoms	What to do
DDoS: High-volume requests exhaust bandwidth, CPU, memory, or connections, causing service degradation or outage. The included DDoS basic protection has a traffic threshold; exceeding it triggers blackhole routing.	Every public IP receives DDoS basic protection within the included quota. For attacks that exceed the quota or target the application layer, purchase DDoS Native Protection or Anti-DDoS. For details, see Use DDoS scrubbing to defend against attacks.
Unauthorized access: After credential compromise or account takeover, attackers may make repeated failed login attempts or log in from suspicious locations.	Enable the free Security Hardening service and configure your trusted login locations, IP addresses, time windows, and accounts. Anomalous logins trigger automatic alerts. For configuration steps, see Enable unusual logon detection.
Host malware: Cryptomining malware causes service disruption, data leakage, and lateral spread. When an instance is compromised, Cloud Security Center sends SMS and email alerts.	Use Cloud Security Center to handle the incident, or manually reset passwords and key pairs and block the attacker's IP address. For isolation and removal steps, see Mining virus response and protection.

After an attack is contained, perform root cause analysis and ongoing hardening to prevent recurrence:

Root cause analysis: Use ActionTrail records to review cloud operations, reconstruct the attack path, and determine the intrusion method and affected resource scope.
Targeted hardening: Tighten the exploited configuration items and close the gaps in your security hardening baseline.
Detection tuning: Adjust your monitoring alert rules and use Cloud Security Center to improve future detection coverage.

Security hardening

Instance hardening checklist

Security domain	Typical use cases	Technical controls
OS security	Remote operations, system hardening, vulnerability patching, runtime protection.	Credential and login hardening Avoid logging on to instances as the root user Avoid using weak passwords to log on to instances Avoid using preset logon credentials in custom images Enable abnormal logon detection Image and port management Restrict instance creation to a specified range of images Restrict access to instance O&M ports by source IP address Host protection Fix high-risk security vulnerabilities Enable host protection
Data security	Cloud disk storage, image distribution, sensitive data transmission, ransomware protection.	Encryption and backup Use encrypted cloud disks Enable automatic snapshot policies for cloud disks Image security Control image and snapshot permissions to prevent data leaks Metadata and access security Use the strengthened mode to access instance metadata Allow only HTTPS requests to the ECS OpenAPI
Network security	VPC planning, network isolation, public network access control, traffic monitoring.	Network isolation Use a VPC to achieve network isolation Use security groups to control internal network access Use a network ACL to strengthen network access control Minimize public exposure Access cloud services over an internal network or leased line Use PrivateLink to reduce unnecessary public network traffic Reduce the public network exposure of ECS instances Threat protection Use Anti-DDoS services to defend against public network attacks Use Cloud Firewall to defend against public network attacks Use Web Application Firewall to defend against web attacks
Identity and access management	Employee onboarding authorization, multi-account management, programmatic API authentication.	Account security Avoid using the root account, and grant role-based permissions to RAM users Protect your cloud account to prevent credential leaks Permission scoping Enable fine-grained permission management by using tags Use resource groups to manage permissions horizontally Use a RAM policy to constrain cloud operations Restrict the source IP addresses that can call OpenAPI operations
Security audit and operations	Internal audit, security behavior tracing, compliance checks.	Audit logging Use ActionTrail to analyze cloud operations Enable VPC flow logs for traffic analysis Operations security Using Bastionhost to meet MLPS 2.0 requirements

Trusted computing and confidential computing

Alibaba Cloud provides multi-layer compute security capabilities: automatic memory encryption, Trusted Computing (vTPM).

Default memory encryption: Protects in-memory data from physical attacks with no changes to your OS or applications. Supported by default on instance families such as g8i general-purpose, c8i compute-optimized, and r8i memory-optimized.
Trusted computing: Builds a hardware root of trust using a virtual Trusted Platform Module (vTPM) to establish verified boot for ECS instances, validating core startup components to ensure they have not been tampered with.

Classified protection compliance

Effective December 1, 2019, a series of standards including the Basic Requirements for Classified Protection of Cybersecurity (GB/T 22239-2019) took effect. Implementing the classified protection scheme is a basic obligation for every enterprise and organization. Alibaba Cloud provides the classified protection compliance check feature to help you quickly implement the classified protection scheme.

On the Security Compliance Check tab, view the check result statistics.
- View the total number of check items and non-compliant items. In the Total Check Items and Non-compliant Items sections, view the total number of classified protection compliance check items and the number of non-compliant items. Click Non-compliant Items to view the list of non-compliant check items.
- Online consultation for classified protection. Click Consult next to Contact Us to open a chat window and ask questions about classified protection. This service is available from 09:00 to 17:00 on weekdays.
- Handle asset baseline issues. Click Click here to configure to go to the Baseline Check page and view and handle baseline issues on your assets. For more information, see View and handle baseline check results.
- Search for a specific check item. In the search box, filter by check item category and compliance status, or enter the name of a check item to view matching results.
Remediate non-compliant check items. Follow the instructions under Improvement Suggestion to remediate each non-compliant check item.
Note
The classified protection compliance check assesses whether your system has the required security capabilities, such as access control and log audit. You can pass the classified protection assessment only after you implement these capabilities and resolve all identified issues.