Checks

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require at least one lowercase letter to increase the character diversity of passwords. This enhances account resiliency against brute force logon attempts and dictionary attacks.

Alibaba Cloud RAM password policies can temporarily block logon after several incorrect logon attempts within an hour. It is recommended that the password policy is set to temporarily block logon after 5 incorrect logon attempts within an hour to protect accounts against automated brute force logon attempts and credential stuffing attacks.

Alibaba Cloud RAM password policies can require passwords to expire after a given number of days. It is recommended to expire passwords after 365 days or less for periodic credential rotation. The CIS benchmark recommends an annual reset as a balanced approach that avoids overly frequent changes while ensuring compromised credentials have a limited lifespan.

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require a minimum of 14 or greater characters for any password. Longer passwords provide exponentially more security against automated password cracking, as the keyspace increases dramatically with each additional character.

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require at least one numeric character to increase the character diversity of passwords. This enhances account resiliency against brute force logon attempts and dictionary attacks by expanding the keyspace.

Alibaba Cloud RAM password policies can be configured to prevent the reuse of previously used passwords. It is recommended that the password policy prevent the reuse of passwords to ensure users cannot cycle back to previously compromised credentials. This increases account resiliency against brute force logon attempts and reduces the risk of credential reuse attacks.

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require at least one special character (symbol) to increase the character diversity of passwords. Special characters significantly increase the keyspace that attackers must search, enhancing account resiliency against brute force logon attempts.

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require at least one uppercase letter to increase the character diversity of passwords. This enhances account resiliency against brute force logon attempts and dictionary attacks by requiring mixed-case passwords.

Alibaba Cloud RAM users, groups, and roles have no access by default. RAM policies grant privileges to these principals. It is recommended to apply policies to groups and roles rather than individual users, simplifying access management and reducing unintended permissions as the number of users grows.

Alibaba Cloud RAM policies grant permissions to users, groups, or roles. Follow the principle of least privilege by granting only required permissions. Policies with "Effect": "Allow", "Action": "*", and "Resource": "*" should be avoided as they grant full administrative access to all resources.

Alibaba Cloud RAM access keys consist of an access key ID and a secret, which are used to sign programmatic requests. RAM users need their own access keys to make programmatic calls from SDKs, CLIs, or direct API calls. It is recommended that all access keys be regularly rotated every 90 days or less to reduce the window of opportunity for compromised keys to be used.

Alibaba Cloud RAM users can log on to the console by using their username and password. If a user has not logged on for 90 days or longer, it is recommended to disable the console access of the user. Disabling unused console access reduces the attack surface by removing unnecessary logon capabilities from potentially abandoned or dormant accounts.

Alibaba Cloud RAM supports MFA, adding protection on top of username and password. With MFA enabled, console logon requires an authentication code from a virtual MFA device after entering credentials. MFA should be enabled for all RAM users with console passwords to strengthen account security.

Alibaba Cloud RDS instances should only accept connections from trusted networks and IP addresses. This check verifies that the IP whitelist does not contain entries such as 0.0.0.0/0 or 0.0.0.0 that would allow access from anywhere on the internet. Only specific, trusted IP addresses should be whitelisted to minimize the attack surface of the database server.

Alibaba Cloud RDS PostgreSQL instances should have the log_connections parameter set to on. Enabling this parameter logs each attempted connection to the server, including successful client authentication. This log data is essential for identifying, troubleshooting, and repairing configuration errors, detecting unauthorized access attempts, and supporting security auditing.

Alibaba Cloud RDS PostgreSQL instances should have the log_disconnections parameter set to on. Enabling this parameter logs session terminations and the duration of each session. This data is valuable for identifying abnormal disconnection patterns, troubleshooting performance issues, and supporting security auditing and incident investigation.

Alibaba Cloud RDS PostgreSQL instances should have the log_duration parameter set to on. Enabling this parameter logs the duration of each completed SQL statement, generating query and error logs that can be used to identify slow queries, troubleshoot performance issues, and detect potential denial-of-service patterns targeting the database.

Alibaba Cloud RDS instances should have SQL auditing (SQL Explorer) enabled to track database events in an audit log. This helps maintain regulatory compliance, understand database activity, and detect anomalies indicating security violations. Applies to all RDS engines except SQL Server 2012/2016/2017 and MariaDB TX.

Alibaba Cloud RDS instances with SQL auditing enabled should have a retention period configured to be greater than or equal to the required minimum (default: 6 months / 180 days). Audit logs are essential for checking anomalies, understanding database activity, and gaining insight into suspected breaches or misuse of information and access.

Alibaba Cloud RDS instances should enforce SSL encryption for all incoming connections. SSL protects data in transit between the application and the database, preventing interception of sensitive data such as credentials, database queries, and query outputs. This check verifies that SSL encryption is enabled on the RDS instance.

Alibaba Cloud RDS instances should have Transparent Data Encryption (TDE) enabled. TDE performs real-time encryption and decryption of the database, associated backups, and log files at rest, without requiring changes to the application. This check verifies that TDE is enabled to protect sensitive data stored in the RDS instance from unauthorized physical access.

Alibaba Cloud RDS instances with TDE enabled should use a customer-managed key (BYOK) rather than a service-managed key. BYOK provides increased transparency and control over the encryption key lifecycle, enhanced security through an HSM-backed KMS service, and promotes separation of duties between the data owner and the cloud provider.

Alibaba Cloud Security Center should be running the Advanced or Enterprise Edition to enable comprehensive threat detection capabilities for network and endpoints. These editions provide malware detection, webshell detection, anomaly detection, and precision defense features that are not available in the Basic or Free editions.

Alibaba Cloud Security Center requires an agent to be installed on each endpoint to provide comprehensive endpoint intrusion detection and protection capabilities. The agent enables remote logon detection, webshell detection and removal, anomaly detection of abnormal process behaviors and network connections, and monitoring of changes to key files and suspicious accounts.