Identities and permissions
-
Configure your Alibaba Cloud account based on the principle of least privilege.
-
Grant permissions to user groups to separate responsibilities and simplify permission changes.
-
Access cloud resources as a Resource Access Management (RAM) user instead of your Alibaba Cloud account, and attach appropriate permission policies to the RAM user.
-
Access cloud resources by using an instance role or a Security Token Service (STS) token instead of the AccessKey pair of your Alibaba Cloud account or RAM user, and scope the granted permissions to the minimum required.
-
Regularly review and remove RAM users, RAM roles, permissions, keys, or credentials that are no longer needed. Rotate keys for RAM users and applications on a regular basis.
-
Do not disclose your AccessKey ID or AccessKey secret. Do not embed plaintext AccessKey pairs in code or expose them on external platforms such as GitHub. Avoid storing credentials in locations accessible to other users.
-
Change your password regularly and ensure it meets strength requirements.
-
Use a unique, complex password for your Alibaba Cloud account that differs from passwords on other platforms to prevent cross-platform security risks from password leaks. Do not reuse the same password or key pair across different accounts on a host.
Monitoring and audit
Audit account operations regularly.
Use Alibaba Cloud services such as ActionTrail to record console operations and API call logs for your Alibaba Cloud account.