Elastic Compute Service:Restrict source IP addresses for instance O&M ports

Check: Find security groups that open O&M ports to all IP addresses

Block: Prohibit instance creation operations that allow access from any IP address to O&M ports

Use a RAM policy at the organization or account level to block security group rules that allow access from any IP address.

• For enterprise users:

  1. Log on to the Resource Directory console using an Alibaba Cloud account. In the left-side menu bar, click Control Policies. Then, create a custom policy and paste the following JSON content.

     This policy denies operations that create instances or that create or modify security groups that allow access from any IP address.

     {
       "Version": "1",
       "Statement": [
         {
           "Effect": "Deny",
           "Action": [
             "ecs:AuthorizeSecurityGroup",
             "ecs:ConfigureSecurityGroupPermissions",
             "ecs:ModifySecurityGroupRule"
           ],
           "Resource": "*",
           "Condition": {
             "StringLike": {
               "ecs:SecurityGroupIpProtocols": [
                 "TCP"
               ]
             },
             "CIDRInRange": {
               "ecs:SecurityGroupSourceCidrIps": [
                 "0.0.0.0/0"
               ]
             }
           }
         },
         {
           "Effect": "Deny",
           "Action": [
             "ecs:CreateInstance",
             "ecs:RunInstances"
           ],
           "Resource": "*",
           "Condition": {
             "Bool": {
               "ecs:NotSpecifySecureGroupId": [
                 "true"
               ]
             }
           }
         }
       ]
     }

  2. In your resource directory, select a suitable node and attach the policy. The policy then blocks these operations for all accounts under that node.

• For non-enterprise users:

  1. Log on to the RAM console using your Alibaba Cloud account. In the navigation pane on the left, click Policies. Then, create a custom policy with the same content as described in the previous section.

  2. Grant the access policy to a RAM user, RAM user group, or RAM role. For more information, see Managing authorization for access policies.

Remediate: Modify security group rules

Modify existing security group rules. Change the authorization object from 0.0.0.0/0 to a specific, trusted IP address range.

1. Locate insecure rules: Use the methods described in the Check section to find security groups and rules that pose a threat.

2. Modify the rules:

   1. Go to the ECS console - Security Groups page. Find the target security group and click Manage Rules in the Operation column.

   2. Find the relevant rule, such as a rule for port 22 that uses 0.0.0.0/0 as the authorization object. Click Modify. Update the authorization object to a trusted source IP address and click Save.