Checks

Alibaba Cloud Security Center should have all risk item notifications enabled across Vulnerability, Baseline Risks, Alerts, and AccessKey Leak event detection categories. This ensures that relevant security operators receive notifications as soon as critical security events occur, enabling timely incident response.

Alibaba Cloud Security Center should have scheduled vulnerability scanning enabled on all servers to periodically discover system vulnerabilities. The scan should cover all vulnerability types including yum, cve, sys, cms, and emg to ensure comprehensive detection of known security weaknesses across the infrastructure.

Alibaba Cloud SLS should have an alarm configured for Cloud Firewall rule changes. By directing ActionTrail logs to SLS with alert rules, real-time monitoring of firewall modifications is achieved. This ensures creation, update, or deletion of Cloud Firewall control policies is promptly detected and reviewed.

Alibaba Cloud SLS should have an alarm configured for customer-created KMS CMKs that are disabled or scheduled for deletion. By directing ActionTrail logs to SLS with alert rules, disabling or deletion of encryption keys is promptly detected, preventing accidental or malicious loss of access to encrypted data.

Alibaba Cloud Simple Log Service (SLS) Logstore data retention should be configured for at least 365 days. The Logstore retention period controls how long activity logs are stored and available for analysis. Ensuring a minimum retention of 365 days provides sufficient time to investigate security incidents, perform forensic analysis, and meet regulatory compliance requirements.

Alibaba Cloud SLS should have an alarm configured for failed console authentication attempts. By directing ActionTrail logs to SLS with alert rules, repeated login failures are detected promptly, enabling early identification of brute-force or credential stuffing attacks against the Management Console.

Alibaba Cloud SLS should have an alarm configured for console logins not protected by MFA. By directing ActionTrail logs to SLS with alert rules, single-factor console sign-in events are detected, helping identify accounts that bypass MFA enforcement policies.

Alibaba Cloud SLS should have an alarm configured for OSS bucket policy changes. By directing ActionTrail logs to SLS with alert rules, modifications to bucket access policies are detected promptly, enabling quick identification of dangerous permission changes on sensitive storage resources.

Alibaba Cloud SLS should have an alarm configured for OSS Bucket RAM permission changes. By directing ActionTrail logs to SLS with alert rules, OSS permission modifications are monitored in real time. This ensures changes to bucket access controls and RAM policies affecting OSS are promptly detected.

Alibaba Cloud SLS should have an alarm configured for RAM Role creation, deletion, and update activities. By directing ActionTrail logs to SLS with alert rules, role changes are monitored in real time. This ensures RAM role modifications are detected promptly, enabling early identification of unauthorized privilege escalation.

Alibaba Cloud SLS should have an alarm configured for RDS Instance configuration changes. By directing ActionTrail logs to SLS with alert rules, database configuration modifications are monitored in real time. This ensures changes to security parameters, network settings, or access controls are promptly detected.

Alibaba Cloud SLS should have an alarm configured for root account login attempts. By directing ActionTrail logs to SLS with alert rules, usage of the fully privileged root account is detected promptly, supporting least privilege and enabling timely review of root-level operations.

Alibaba Cloud SLS should have an alarm configured for Security Group changes. By directing ActionTrail logs to SLS with alert rules, real-time monitoring is achieved. Security Groups are stateful packet filters controlling VPC ingress and egress traffic; monitoring their changes ensures network access modifications are promptly detected.

Alibaba Cloud SLS should have an alarm configured for unauthorized API calls. By directing ActionTrail logs to SLS with alert rules, API calls resulting in unauthorized errors are detected promptly, helping identify misconfigured applications, compromised credentials, or active attacker reconnaissance.

Alibaba Cloud SLS should have an alarm configured for VPC changes. By directing ActionTrail logs to SLS with alert rules, VPC modifications are monitored in real time. This ensures creation, deletion, or modification of VPCs and associated components is promptly detected.

Alibaba Cloud SLS should have an alarm configured for VPC network route changes. By directing ActionTrail logs to SLS with alert rules, route table modifications are monitored in real time. This ensures creation, deletion, or modification of route entries is detected, verifying VPC traffic flows through expected paths.

Alibaba Cloud VPC Flow Logs capture IP traffic information for Elastic Network Interfaces, VSwitches, or entire VPCs. When a flow log is created for a VPC, all ENIs within it, including newly created ones, are automatically monitored. Flow log data is stored in Log Service where it can be viewed and analyzed for security and operational purposes.