Back to Checks
alibabacloud

ECS instance does not use legacy network

ecs_instance_no_legacy_network
Service: ecsSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:ALIYUN::ECS::Instance

Alibaba Cloud ECS instances should use VPC (Virtual Private Cloud) networks instead of legacy classic networks. Legacy networks have a single IPv4 prefix range and a single gateway IP address for the whole network, preventing the creation of subnetworks or migration to auto/custom subnet networks. This check verifies that no ECS instances are configured with a legacy network type.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Legacy networks lack the security isolation and network segmentation capabilities provided by VPCs, creating a single point of failure for high-traffic instances. Without proper network segmentation, lateral movement by attackers becomes easier, impacting confidentiality and integrity of workloads sharing the same flat network.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ecs_instance_no_legacy_network

Recommendation

Migrate all ECS instances from legacy classic networks to VPC networks. Create new instances within a VPC and migrate workloads from legacy network instances.

Remediation

CLI

aliyun ecs CreateInstance --InstanceName <instance_name> --ImageId <image_id> --InstanceType <instance_type> --VSwitchId <vswitch_id>

Other

1Log on to the **ECS Console**.
2In the left-side navigation pane, choose **Instance & Image** > **Instances**.
3Click **Create Instance**.
4Specify the basic instance information and click **Next: Networking**.
5Select **VPC** as the Network Type and choose an appropriate VSwitch.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ecs.ecs_client import ecs_client


class ecs_instance_no_legacy_network(Check):
    """Check if ECS instances are not using legacy (classic) network."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for instance in ecs_client.instances:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=instance
            )
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"acs:ecs:{instance.region}:{ecs_client.audited_account}:instance/{instance.id}"

            if instance.network_type == "classic":
                report.status = "FAIL"
                report.status_extended = (
                    f"ECS instance {instance.name if instance.name else instance.id} "
                    f"is using legacy (classic) network type."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"ECS instance {instance.name if instance.name else instance.id} "
                    f"is using VPC network type."
                )

            findings.append(report)

        return findings

References