Restrict source IP addresses for instance O&M ports - Elastic Compute Service

Security risks

O&M ports such as SSH port 22 (Linux) and RDP port 3389 (Windows) allow administrators to remotely manage ECS instances. If you allow access from all IP addresses (0.0.0.0/0) in a security group, these ports are exposed to the entire Internet:

Brute-force attacks: Attackers use automated tools to try common username and password combinations. If successful, they gain full control of your server.
Data breach and tampering: Intruders can steal or modify business data on your server, causing direct business loss.
Malware infection: The server can be used as part of a botnet to launch DDoS attacks, perform mining, or attack other networks.

Best practices

Open only necessary ports in security groups and restrict access to trusted source IP addresses.

Console

Create a security group with inbound rules that restrict O&M port access to trusted IP addresses instead of 0.0.0.0/0.

The security group has four custom TCP Allow inbound rules that specify concrete source IP addresses (such as 172.xxx/24) for the HTTP (80), HTTPS (443), SSH (22), and RDP (3389) ports.
When you create an instance on the instance purchase page, select this security group.

Click the Existing Security Groups tab, and then click Reselect Security Group to select the target security group. Make sure the selected security group has port 22 (Linux) or port 3389 (Windows) open. Otherwise, you cannot remotely log on to the ECS instance.

API

Call CreateSecurityGroup to create a security group, then call AuthorizeSecurityGroup to add inbound rules. Specify SourceCidrIp to restrict the source IP address.
When you call RunInstances or CreateInstance, specify SecurityGroupId to assign the instance to the security group.

Compliance capabilities

Check: Find security groups with unrestricted O&M port access

ECS Insight

Go to ECS Insight.
Click the Security tab, then click Unrestricted Access to Specific Security Group Ports to view affected instances.

Security Center

Go to the Security Center console.
In the left navigation pane, choose . On the Cloud Product Configuration Risks tab, find Prohibit Access from Any IP Address to Port 22 and Port 3389 and click Scan in the Operation column.

If the status is Failed, instances allow unrestricted access to port 22 or 3389. Click Details to view them.

Block: Deny instance creation with unrestricted O&M port access

Use a RAM policy to block security group rules that allow access from any IP address (0.0.0.0/0).

For enterprise users:

Log on to the Resource Directory console with an Alibaba Cloud account. In the left menu bar, click Control Policies. Create a custom policy and paste the following JSON content.

This policy denies operations that create instances or modify security groups to allow access from any IP address.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "ecs:AuthorizeSecurityGroup",
        "ecs:ConfigureSecurityGroupPermissions",
        "ecs:ModifySecurityGroupRule"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "ecs:SecurityGroupIpProtocols": [
            "TCP"
          ]
        },
        "CIDRInRange": {
          "ecs:SecurityGroupSourceCidrIps": [
            "0.0.0.0/0"
          ]
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": [
        "ecs:CreateInstance",
        "ecs:RunInstances"
      ],
      "Resource": "*",
      "Condition": {
        "Bool": {
          "ecs:NotSpecifySecureGroupId": [
            "true"
          ]
        }
      }
    }
  ]
}

Select a suitable node in your resource directory and attach the policy. The policy blocks these operations for all accounts under that node.

For non-enterprise users:
1. Log on to the RAM console with your Alibaba Cloud account. In the left navigation pane, click Permission Policy. Create a custom policy with the same JSON content.
2. Grant the policy to a RAM user, RAM user group, or RAM role.

Remediate: Restrict security group rules

Change the authorization object from 0.0.0.0/0 to a trusted IP address range.

Locate insecure rules: Use the methods in the Check section to find security groups with unrestricted O&M port access.
Modify the rules:
1. Go to the ECS console - Security Groups page. Find the target security group and click Manage Rules in the Operation column.
2. Find the rule (for example, port 22 with 0.0.0.0/0 as the authorization object). Click Modify, update the authorization object to a trusted source IP address, and click OK.

Important

When you use Alibaba Cloud Workbench for remote connections, configure the security group Inbound rules as follows.

Authorization Policy	Priority	Protocol Type	Port Range	Authorization Object
Allow	1	Custom TCP	Linux instances (port 22): Select SSH (22). Windows instances (port 3389): Select RDP (3389). For other manually opened ports, enter the port range.	Public IP connection (static public IP or EIP): Add 161.117.0.0/16. VPC private IP connection: Add 100.104.0.0/16.

For security, do not expose O&M ports to public IP addresses such as office network egress IPs. Instead, allow access only from internal VPC IP addresses. See Security group application guide and examples.