Best practices for preventing AccessKey and credential leaks - Security Center

Accidental code commits or misuploaded configuration files can expose AccessKeys (AKs) and account passwords, leading to data breaches and resource abuse. Security Center automatically detects and responds to AccessKey leaks, and this topic provides best practices to minimize credential leak risks.

Credential types and security risks

Alibaba Cloud provides two types of API credentials for different usage scenarios:

AccessKey (AK for short): used for programmatically calling cloud service APIs. An AccessKey consists of an AccessKey ID (used to identify the user) and an AccessKey Secret (used to verify identity and must be kept confidential).
Account password: used to log on to the Alibaba Cloud console to manage resources.

An AccessKey functions as a programmatic login credential. The AccessKey Secret verifies user identity and must be kept confidential. If leaked, attackers can impersonate your identity to operate cloud resources, causing data breaches and resource abuse.

RAM user AccessKey management interface

Note

Leaked API credentials can lead to data breaches, resulting in significant losses to users.

Security Center AccessKey leak detection mechanism

To address accidental AccessKey leaks, Security Center provides detection capabilities across pre-leak, during-leak, and post-leak stages, forming a complete automated AK security loop:

Pre-leak: Use Cloud Security Posture Management (CSPM) to check whether cloud product configurations have security risks.
During leak: Partner with code hosting platforms such as GitHub to introduce the Token scan mechanism, detecting AK leaks within seconds after code is committed.
Post-leak: Monitor abnormal AK call behaviors and immediately generate alerts when suspected use of leaked AKs by attackers is detected.

Alibaba Cloud has partnered with GitHub to introduce the Token scan mechanism for rapid detection and response to AccessKey leaks. When code containing an AccessKey is committed to GitHub, Security Center can detect the leak and notify you within seconds.

Pre-leak: Configuration detection and risk troubleshooting

In the Security Center console, choose Risk Governance > CSPM from the left-side navigation pane to go to the CSPM page and check whether the configuration items of your cloud products have security risks. We recommend that you focus on the following configurations:

Ensure that the operation audit logs for cloud products are Activate Now so that you can analyze whether any abnormal API calls exist.
Use the AccessKey of a RAM user instead of the primary Alibaba Cloud account AccessKey, and follow the principle of least privilege. This way, even if the AccessKey is leaked, attackers cannot gain control over the entire cloud account.
Enable multi-factor authentication (TOTP) for the primary account to significantly reduce the risk of unauthorized access caused by password leaks.

Note
Multi-factor authentication (MFA) has been renamed to TOTP.

During leak: Viewing leak sources and details

In the Security Center console, choose Risk Governance > AccessKey Leak Detection from the left-side navigation pane to go to the AccessKey Leak Detection page and view detailed information about AK leaks, including the leak source, involved accounts, and leak time. Alternatively, choose the same path to go to the AccessKey Leak Detection page to view details.

Post-leak: Abnormal call alerts

In the Security Center console, on the Alert Handling module, filter and view Cloud Service Threat Detection alert types. When Security Center detects suspected abnormal AK calls by attackers, it immediately triggers alerts for timely response.

Navigation path: Detection and Response - Alert Handling > Cloud Service Threat Detection

Best practices to reduce credential leak risks

Beyond Security Center's detection capabilities, the following best practices help minimize credential leak risks in daily operations.

Daily usage guidelines

Do not embed AccessKey in code

Hardcoding AccessKeys in code can lead to AK leaks when the code is committed, shared, or open-sourced. Use environment variables, a key management service, or configuration files to store AccessKeys, and add them to the ignore list of your version control system.
Rotate AccessKeys regularly

Regular AccessKey rotation reduces the impact of old code leaks on your production workloads. Generate a new AccessKey, replace the old one in your code, and then disable or delete the old key.
Disable unused AccessKeys

In the Alibaba Cloud AccessKey console, check the last access time of each AccessKey. For AccessKeys that have not been used for an extended period, Disable them to reduce the attack surface.
Assign dedicated RAM user AccessKeys for different workloads

Create independent RAM users for different business scenarios, grant each the minimum required permissions, and assign different RAM user AccessKeys for different workloads. Avoid using a single high-privilege AccessKey to manage all workloads.

Security audit configuration

Enable operation log audit and deliver logs to OSS and SLS for storage and analysis

Delivering operation logs to OSS provides complete evidence for security incident investigations. Delivering logs to SLS enables you to quickly search and analyze abnormal behaviors across large-scale logs.