You can use the Condition and Deny mechanisms in Resource Access Management (RAM) policies to convert security standards and compliance requirements into an enforceable security baseline on the cloud platform. This approach prevents the creation and configuration of insecure cloud resources at the source. For example, you can prohibit assigning public IP addresses to ECS instances, enforce the use of key pairs for logon, and restrict security groups from opening vulnerable ports. This helps you build a secure-by-default cloud environment.
Security risks
Standard RAM access policies typically use an Allow mode, which grants permissions that specify the operations a user can perform. For example, a policy can allow the creation of ECS instances with ecs:RunInstances:
{
"Version": "1",
"Statement": [
{
"Effect": "Allow", #Allow
"Resource": "acs:ecs:*:*:instance/*", #Resource scope
"Action": [ #OpenAPI operation
"ecs:RunInstances"
]
}
}Although this mode is straightforward, it poses a hidden threat by granting excessive freedom within the scope of the permission. This can lead to the creation of resources that do not meet security standards. For example:
Exposed attack surface: A database server intended for internal services only is incorrectly assigned an elastic IP address (EIP).
Weak credentials: A password-based logon method is used when creating an ECS instance, which makes the instance vulnerable to brute-force attacks.
Compliance violations: Resources are created without using standard company images that have undergone security hardening.
Best practices
Core principle
The core principle is to add a layer of conditional Deny policies on top of the Allow policies.
Deny has priority: When RAM evaluates an operation request, it checks all relevant policies. If a Deny policy rule is matched, the operation is immediately denied, regardless of whether an Allow policy also exists.
Precise conditional constraints: A Deny policy can include a Condition block. The Deny effect is triggered only when the operation matches the specified Action, Resource, and Condition.
For example, when a user creates an instance (ecs:RunInstances) for any instance resource (acs:ecs:*:*:instance/*), the operation is denied ("Effect": "Deny") if a public IP address is attached ("ecs:AssociatePublicIpAddress": "true").
{
"Version": "1",
"Statement": [
{
"Effect": "Deny", #Deny
"Resource": "acs:ecs:*:*:instance/*", #Resource scope
"Action": [ #OpenAPI operation
"ecs:RunInstances"
],
"Condition": { #Conditional rule
"Bool": {
"ecs:AssociatePublicIpAddress": "true" #Condition key assertion
}
}
}
}This "Allow + Deny with Condition" combination first grants a broad Allow permission for an operation. Then, it acts as a safeguard by precisely denying specific operations that do not comply with the security baseline. For example, "Allow the creation of ECS instances, but deny the operation if an attempt is made to attach a public IP address." This makes the security policy an enforceable rule on the platform, rather than just a guideline.
Procedure
The entity that you want to constrain must have two policies attached: an Allow policy, such as AliyunECSFullAccess, that permits the operation, and the Deny policy that you create. When the user performs an operation, the Allow policy grants the permission, while the Deny policy acts as a security auditor that rejects any non-compliant attempts. The following steps guide you through creating and implementing a security baseline based on RAM policies.
Identify key operations and conditions to constrain
First, identify the security rules you want to enforce and find the corresponding RAM Action and condition key. A condition key is a parameter that an Alibaba Cloud service API provides to RAM for evaluation. You can find these keys in the API documentation for the specific service. For example, for the ecs:RunInstances action, you can find all supported condition keys in the "Authorization Information" section of the RunInstances documentation.
Write a conditional Deny access policy
Log on to the Resource Access Management (RAM) console. In the navigation pane on the left, choose .
On the Access Policy page, click Create Policy.
On the Create Policy page, click the JSON tab, enter the following policy document, and click OK.
The following examples show common and verified access policies:
Enter a Policy Name and a Description, click OK, and then complete the security authentication.
Attach the access policy
After you create the policy, attach it to the RAM user, user group, or role that you want to constrain.
Log on to the RAM console. In the navigation pane on the left, choose .
On the Users page, find the target RAM user and click Add Permissions in the Actions column.
In the Grant Permission panel, select the access policy and click Grant Permissions.