Checks

Alibaba Cloud ActionTrail records API calls made to your account, including caller identity, time, source IP, request parameters, and response elements. Ensuring a multi-region trail exists guarantees that operations across all regions and global services are captured, enabling detection of unexpected activities in unused regions.

Alibaba Cloud ActionTrail logs a record of every API call made in your account and stores these log files in an OSS bucket. It is recommended that the Access Control List (ACL) of the OSS bucket used by ActionTrail is set to private to prevent unauthorized public access to sensitive audit log data.

CloudMonitor agent provides visibility into system metrics for Kubernetes Engine clusters, including CPU, disk, network, and IO. Without it, operators lack observability into node and pod health. Enabling CloudMonitor creates a controller that collects metrics from each node's Pods and containers for analysis and alerting.

Alibaba Cloud Kubernetes Engine provides a cluster health check that validates node health and cluster configuration, including kubelet, docker daemon, kernel, and iptables settings. Running checks regularly ensures VPC/VSwitch, SLB, and ECS nodes function correctly. Consecutive failures generate diagnostic reports for corrective action.

Alibaba Cloud Kubernetes Engine provides a cluster health check that validates node health and cluster configuration, including kubelet, docker daemon, kernel, and iptables settings. Weekly checks ensure VPC/VSwitch, SLB, and ECS nodes function correctly. Consecutive failures generate diagnostic reports for corrective action.

Alibaba Cloud Kubernetes Engine clusters should not have the Kubernetes Dashboard (web UI) enabled. The Dashboard uses a highly privileged Service Account that can perform administrative operations across the cluster. Use the ACK Console instead, which provides fine-grained access control through RAM policies and RBAC integration.

With ENI multiple IP mode provided by the Terway network plugin, Kubernetes Engine clusters allocate pod IPs from the VPC CIDR block, enabling better scalability and native integration with Alibaba Cloud services. This mode allows pods to have their own security group associations, providing granular network-level access control independently from host nodes.

Alibaba Cloud Log Service supports collection, search, storage, and analysis for container and audit logs in Kubernetes Engine clusters. When enabled, it automatically collects kube-apiserver audit logs, ingress logs, and stdout/stderr from containers. These logs are stored persistently and are essential for operational visibility, security monitoring, and compliance auditing.

Alibaba Cloud Kubernetes Engine clusters should enable Network Policy via the Terway plugin. A NetworkPolicy defines how pods communicate using label-based rules. By default, pods accept traffic from any source; NetworkPolicy restricts traffic to explicitly allowed connections, enforcing least privilege at the network level.

Alibaba Cloud Kubernetes Engine clusters should be configured as private clusters so the API server endpoint is not publicly accessible. In a private cluster, nodes lack public IPs and all node-to-master communication occurs through VPC peering. This reduces the attack surface by eliminating direct internet exposure of the control plane and worker nodes.

Alibaba Cloud Kubernetes Engine clusters should have RBAC enabled for fine-grained authorization. RBAC lets administrators define roles with specific permissions at cluster and namespace level, ensuring users and service accounts access only needed resources. Legacy ABAC grants broad, static permissions and should be disabled in favor of RBAC.

Alibaba Cloud ECS disk encryption protects data at rest by automatically encrypting data transferred to disks and decrypting when read. Ensuring all attached disks are encrypted prevents unauthorized access to stored data. This check verifies disk encryption is enabled on all ECS disks attached to instances, using KMS for key management.

Alibaba Cloud Security Center provides endpoint protection for ECS instances with real-time detection and removal of malicious software. This check verifies the Security Center agent is installed and active on all ECS instances, ensuring alerts notify administrators when malicious software attempts to install or execute.

Alibaba Cloud Security Center checks for the latest updates in Linux and Windows systems running on ECS instances. Keeping virtual machines updated with the latest OS patches addresses specific bugs, improves general stability, and fixes security vulnerabilities. This check verifies that all known vulnerabilities detected by Security Center have been patched on each ECS instance.

Alibaba Cloud ECS instances should use VPC (Virtual Private Cloud) networks instead of legacy classic networks. Legacy networks have a single IPv4 prefix range and a single gateway IP address for the whole network, preventing the creation of subnetworks or migration to auto/custom subnet networks. This check verifies that no ECS instances are configured with a legacy network type.

Alibaba Cloud ECS security groups provide stateful filtering of ingress and egress network traffic to cloud resources. This check verifies that no security group allows unrestricted ingress access to port 3389 (RDP) from the internet (0.0.0.0/0 or ::/0). Restricting RDP access to trusted IP addresses significantly reduces the attack surface of ECS instances.

Alibaba Cloud ECS security groups provide stateful filtering of ingress and egress network traffic to cloud resources. This check verifies that no security group allows unrestricted ingress access to port 22 (SSH) from the internet (0.0.0.0/0 or ::/0). Restricting SSH access to trusted IP addresses significantly reduces the attack surface of ECS instances.

Alibaba Cloud ECS cloud disk encryption protects data at rest by automatically encrypting data when it is transferred from ECS instances to disks and decrypting it when read. This check verifies that unattached (detached) disks have encryption enabled, since unattached disks may still contain sensitive data from previous workloads and are especially vulnerable if not properly managed.

Alibaba Cloud OSS Bucket Access Logging generates a log record for each request made to your OSS bucket, containing details such as the request type, the resources specified, and the time and date the request was processed. Enabling bucket access logging on all OSS buckets ensures that access patterns are recorded and available for security analysis and incident response workflows.

Alibaba Cloud Object Storage Service (OSS) buckets store objects that may contain sensitive data. It is recommended that the access policy on OSS buckets does not allow anonymous or public access, ensuring that only authorized identities can interact with bucket contents. The bucket ACL should be set to private to prevent unintended data exposure.

Alibaba Cloud OSS buckets should enforce secure transfer by requiring all requests to use HTTPS. A bucket policy that denies requests with acs:SecureTransport set to false ensures that data in transit is encrypted, rejecting any unencrypted HTTP connections to the storage endpoint.

Alibaba Cloud OSS buckets should define a default server-side encryption rule so every newly uploaded object is encrypted at rest with SSE-OSS (AES256) or SSE-KMS (KMS) without relying on per-request headers.

Alibaba Cloud OSS Bucket Versioning stores previous versions of objects when they are overwritten or deleted, allowing any version to be restored at a later time. Enabling versioning on all OSS buckets ensures that data can be recovered after unintended changes or deletions.

Alibaba Cloud RAM access keys provide programmatic access to an account. The root account is the most privileged user and should not have access keys. All root access keys should be removed to limit compromise vectors and encourage role-based accounts following the principle of least privilege.