Checks

Ensure that Cloud Trace Service (CTS) tracker is enabled to record all API calls and operations performed in the Huawei Cloud account.

Ensure that Elastic Cloud Server (ECS) instances use SSH key pairs instead of password-based authentication for secure access.

Ensure that Elastic Cloud Server (ECS) instances do not use the default security group, which may have overly permissive rules.

Ensure that Elastic Cloud Server (ECS) instances do not have public IP addresses assigned, reducing exposure to the internet.

Ensure that Elastic Cloud Server (ECS) instances have at least one security group attached to control network traffic.

Ensure that Elastic Load Balancer (ELB) instances do not have public IP addresses unless explicitly required, to reduce the attack surface.

Ensure that all Huawei Cloud Elastic Volume Service (EVS) disks are encrypted to protect data at rest.

Huawei Cloud IAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require a minimum of 14 or greater characters for any password. Longer passwords provide exponentially more security against automated password cracking, as the keyspace increases dramatically with each additional character.

Huawei Cloud IAM password policies can enforce character complexity by requiring multiple character types (uppercase, lowercase, digits, special characters). It is recommended that at least 3 character types be required to increase password strength.

Huawei Cloud IAM password policies can enforce password expiration. It is recommended that the password validity period be set to a non-zero value so that passwords must be rotated periodically, reducing the window of opportunity for compromised credentials.

Huawei Cloud IAM password policies can enforce a minimum password age, preventing users from changing passwords too frequently. This works in conjunction with password reuse prevention to ensure users cannot cycle through disallowed passwords to reuse an old one.

Huawei Cloud IAM password policies can prevent users from reusing recent passwords. It is recommended that the policy disallow reuse of at least the last 3 passwords to ensure users choose new passwords upon rotation.

The Huawei Cloud account (root/domain owner) should enforce MFA. Because the domain owner is not a listable IAM user, root MFA is assessed through the account's operation protection policy, which requires MFA verification (virtual MFA, SMS, or email) before critical operations such as deleting resources or managing credentials can be performed.

Disabled IAM user accounts that are no longer needed should be removed to reduce the attack surface. Stale disabled accounts may still have associated resources, permissions, or access keys that could be exploited if re-enabled.

Huawei Cloud IAM users should have MFA enabled. MFA adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to the Huawei Cloud console, they are prompted for their username and password as well as for an authentication code from their MFA device.

Huawei Cloud Key Management Service (KMS) keys that are in PendingDeletion state should be reviewed. Keys scheduled for deletion may cause decryption failures for dependent resources, leading to data unavailability. Ensure deletion is intentional and all dependent resources have been migrated.

Ensure that Huawei Cloud Key Management Service (KMS) keys have automatic key rotation enabled to regularly rotate the cryptographic material.

Ensure that Object Storage Service (OBS) buckets are not publicly accessible to prevent unauthorized access to stored objects.

Ensure that Huawei Cloud Relational Database Service (RDS) instances have automatic backup enabled to protect against data loss.

Ensure that Huawei Cloud Relational Database Service (RDS) instances have storage disk encryption enabled using a Key Management Service (KMS) key.

Ensure that Huawei Cloud Relational Database Service (RDS) instances do not have public IP addresses to prevent direct internet access to databases.

Ensure that SMN notification topics have at least one confirmed subscription so alerts can be delivered to recipients.

Ensure that default security groups restrict all traffic to prevent unauthorized access to cloud resources.

Ensure that Virtual Private Cloud (VPC) security groups do not have ingress rules that allow all protocols from 0.0.0.0/0 (i.e., rules with no port range specified).