Back to Checks
huaweicloud

ECS instances should use SSH key pairs for authentication

ecs_instance_key_pair
Service: ecsSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Ensure that Elastic Cloud Server (ECS) instances use SSH key pairs instead of password-based authentication for secure access.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

ECS instances without SSH key pairs may rely on password-based authentication, which is more susceptible to brute-force attacks and unauthorized access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks ecs_instance_key_pair

Recommendation

Bind SSH key pairs to all ECS instances and disable password-based authentication.

Remediation

CLI

hcloud ECS ReinstallServerWithCloudInit --server_id=<instance_id> --os-reinstall.keyname=<key_pair_name>

Other

1Log on to the **Huawei Cloud** console
2Navigate to **Elastic Cloud Server**
3Select the instance
4Click **More** > **Manage Key Pair**
5Bind an existing **key pair** or create a new one
6Disable password-based login

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.ecs.ecs_client import ecs_client


class ecs_instance_key_pair(Check):
    """Ensure ECS instances use SSH key pairs for authentication."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for instance in ecs_client.instances.values():
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=instance)
            report.region = instance.region
            report.resource_id = instance.id
            report.resource_arn = f"huaweicloud:ecs:{instance.region}:{ecs_client.audited_account}:instance/{instance.id}"

            if instance.key_name:
                report.status = "PASS"
                report.status_extended = f"ECS instance {instance.name} ({instance.id}) uses SSH key pair '{instance.key_name}' for authentication."
            else:
                report.status = "FAIL"
                report.status_extended = f"ECS instance {instance.name} ({instance.id}) does not use an SSH key pair for authentication."

            findings.append(report)

        return findings

References