Security Center:AccessKey pair leak detection

Scope

• Detection platform: Only supports detecting AccessKey pair leaks in public source code on GitHub. Other code hosting platforms are not supported.

• Detection targets: AccessKey pairs of Alibaba Cloud accounts (primary accounts) and RAM users, including both the AccessKey ID and AccessKey Secret.

Notification methods

Security Center uses different notification methods depending on whether the leaked AccessKey Secret (hereinafter referred to as SK) is still valid:

Modify notification methods

1. Access the Security Center console - System Settings - Notification Settings. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

2. On the Email/Internal Message tab, find AccessKey Leak Detection and select the required Notification Method.

Add notification recipients

By default, only account contacts receive notifications. To add other recipients, use one of the following methods:

• SMS, email, and internal message:

  On the Basic Receiving Management page, modify message recipients in the Security Message > Cloud Shield Security Information Notification section.

  Note

  After you modify message recipients here, the changes also apply to other notification items in Security Center, as well as to notification items for products such as Anti-DDoS and Web Application Firewall.

  For more information, see Configure event alerts.

Step 1: Manually handle the leak

Security Center does not support automatic handling of AccessKey pair leak events. You must first complete the following operations externally:

1. Delete or hide the leaked content on GitHub: Contact the relevant personnel to delete or hide the files, repositories, or code that contain the AccessKey pair information.

2. Handle the leaked AccessKey in the RAM console: Delete or disable the leaked AccessKey and create a new one, ensuring that core business operations are not affected. For more information, see Delete an AccessKey pair for a RAM user and Disable an AccessKey pair for a RAM user.

Step 2: Mark the handling status in the console

After you complete the manual handling, mark the status of the AccessKey alert event in the Security Center console:

1. Access the Security Center console - Risk Administration - AK Leakage Detection.

2. Click Handle in the Actions column of the target event, select one of the following handling methods, and then click Handle Now.

Detect abnormal AccessKey calls from an attacker's perspective

Based on security attack-and-defense experience and large models, Security Center can detect common abnormal AccessKey calls. For example, the IP address that calls the AccessKey has launched attacks recently, the IP address calls AccessKey pairs of multiple users in batches on the cloud, the called API is sensitive and the AccessKey has been leaked before.

1. Log on to the Security Center console.

2. In the navigation pane on the left, select Detection and Response > Alert. In the upper-left corner of the console, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

   Note

   If you have activated Agentic SOC, select Agentic SOC > Manage > Alert.

3. Set Alert Type to Malicious Process (Cloud Threat Detection) and check for any abnormal AccessKey call alerts.

   Note

   If an abnormal AccessKey call alert exists, view its details and promptly confirm whether the AccessKey call is a normal behavior.

4. (Optional) Configure alert notifications: go to System Settings > Notification Settings, find Alert in the Notification Item column, and select your preferred methods.

   Note

   The Basic Edition supports only the internal message notification method.

Monitor for abnormal AccessKey calls by your Alibaba Cloud account

ActionTrail provides built-in alerts to monitor AccessKey calls by your Alibaba Cloud account and abnormal AccessKey calls. Enable the built-in alerts Abnormal Frequency of AccessKey Usage Alert and Root Account AccessKey Usage Detection in the ActionTrail console to receive notifications when abnormal AccessKey calls occur. For more information, see Query Insights events.

Detect abnormal AccessKey calls based on historical behavior

The Insights feature provided by ActionTrail analyzes AccessKey pairs with abnormal call rates based on historical behavior, helping you detect abnormal activities in a timely manner. For more information about how to enable and view Insights events, see Query Insights events in the ActionTrail console.