CIS Huawei Cloud Foundations Benchmark v1.0.0

Level 1

1 Identity and Access Management

Ensure IAM password policy requires a minimum password length of 14 or greater characters.

Run prowler to check the IAM password policy minimum length configuration.

Automated

Short passwords are easier to crack via brute force attacks. A minimum length of 14 characters significantly increases the keyspace and provides exponentially more security against automated password cracking.

1. Log on to the Huawei Cloud console. 2. Choose IAM & Security. 3. Click the Password Policy tab. 4. Set Minimum Password Length to 14 or greater. 5. Click OK.

Level 1

1 Identity and Access Management

Ensure IAM password policy requires passwords to expire after a defined period.

Run prowler to check if the IAM password policy has a password validity period set.

Automated

Regular password expiration reduces the risk of compromised credentials being used indefinitely. It forces users to periodically update their passwords, limiting the window of opportunity for attackers.

1. Log on to the Huawei Cloud console. 2. Choose IAM & Security. 3. Click the Password Policy tab. 4. Set Password Validity Period to a non-zero value (e.g., 90 days). 5. Click OK.

Level 1

1 Identity and Access Management

Ensure IAM password policy disallows reuse of at least the last 3 passwords.

Run prowler to check if the IAM password policy disallows reuse of at least 3 recent passwords.

Automated

Preventing password reuse ensures users cannot cycle through previously used passwords, which reduces the risk of compromised credentials being reused.

1. Log on to the Huawei Cloud console. 2. Choose IAM & Security. 3. Click the Password Policy tab. 4. Set Number of Recent Passwords Disallowed to 3 or greater. 5. Click OK.

Level 1

1 Identity and Access Management

Ensure IAM password policy requires at least 3 character types (uppercase, lowercase, digits, special characters).

Run prowler to check if the IAM password policy requires at least 3 character types.

Automated

Requiring multiple character types increases password complexity and makes passwords more resistant to dictionary and brute force attacks.

1. Log on to the Huawei Cloud console. 2. Choose IAM & Security. 3. Click the Password Policy tab. 4. Set Password Character Combination to 3 or greater. 5. Click OK.

Level 1

1 Identity and Access Management

Ensure IAM password policy enforces a minimum password age to prevent users from changing passwords too frequently.

Run prowler to check if the IAM password policy enforces a minimum password age.

Automated

A minimum password age prevents users from rapidly cycling through passwords to bypass password reuse restrictions.

1. Log on to the Huawei Cloud console. 2. Choose IAM & Security. 3. Click the Password Policy tab. 4. Set Minimum Password Age to a non-zero value (e.g., 1 day). 5. Click OK.

Level 2

1 Identity and Access Management

Ensure the root account has hardware multi-factor authentication (MFA) enabled.

Run prowler to check if the root account has hardware MFA enabled.

Automated

The root account is the most privileged account in the Huawei Cloud environment. Enabling hardware MFA provides an additional layer of security against unauthorized access.

1. Log on to the Huawei Cloud console as root. 2. Go to IAM & Security. 3. Click the MFA tab. 4. Enable virtual or hardware MFA for the root account. 5. Follow the setup instructions.

Level 1

1 Identity and Access Management

Ensure all IAM users have multi-factor authentication (MFA) enabled.

Run prowler to check if all IAM users have MFA enabled.

Automated

MFA provides an additional layer of security against unauthorized access. Without MFA, a compromised password alone is sufficient to gain access.

1. Log on to the Huawei Cloud console. 2. Go to IAM & Security > Users. 3. For each user, click Enable MFA and follow the setup instructions.

Level 1

1 Identity and Access Management

Ensure disabled IAM users are identified and reviewed for potential removal.

Run prowler to identify disabled IAM users.

Automated

Disabled user accounts may retain permissions and could be re-enabled by an attacker. Regular review ensures stale accounts are removed.

1. Log on to the Huawei Cloud console. 2. Go to IAM & Security > Users. 3. Review disabled users. 4. Remove accounts that are no longer needed.

Level 1

2 Storage

Ensure OBS buckets do not allow public read or write access.

Run prowler to check if any OBS buckets are publicly accessible.

Automated

Publicly accessible buckets expose data to anyone on the internet, which can lead to data breaches and unauthorized access.

1. Log on to the Huawei Cloud console. 2. Go to Object Storage Service. 3. Select each bucket. 4. Review and modify the bucket ACL to remove public access. 5. Click OK.

Level 1

2 Storage

Ensure all EVS volumes have encryption enabled.

Run prowler to check if all EVS volumes have encryption enabled.

Automated

Encrypting EVS volumes protects data at rest against unauthorized access if the physical storage media is compromised.

1. Log on to the Huawei Cloud console. 2. Go to Elastic Volume Service. 3. For each unencrypted volume, create an encrypted volume and migrate data. 4. Delete the unencrypted volume.

Level 1

3 Network Security

Ensure default security groups do not allow unrestricted inbound or outbound traffic.

Run prowler to check if default security groups restrict all traffic.

Automated

Default security groups with open rules expose resources to traffic from any source, increasing the attack surface.

1. Log on to the Huawei Cloud console. 2. Go to VPC > Security Groups. 3. Select the default security group. 4. Remove any rules with 0.0.0.0/0 or ::/0 as source/destination. 5. Add restrictive rules as needed.

Level 1

3 Network Security

Ensure security groups do not allow open ingress (0.0.0.0/0) on sensitive ports (SSH, RDP, MySQL, Redis, MongoDB).

Run prowler to check if any security groups allow open ingress on sensitive ports.

Automated

Exposing sensitive ports to the internet allows attackers to attempt brute force attacks, exploitation, or unauthorized access to services.

1. Log on to the Huawei Cloud console. 2. Go to VPC > Security Groups. 3. For each security group, review ingress rules. 4. Remove or restrict rules that allow 0.0.0.0/0 on sensitive ports. 5. Use bastion host or VPN for access instead.

Level 2

3 Network Security

Ensure Web Application Firewall (WAF) is enabled to protect web applications from common attacks.

Run prowler to check if WAF is enabled.

Automated

WAF protects web applications from common web exploits such as SQL injection, XSS, and CSRF attacks.

1. Log on to the Huawei Cloud console. 2. Go to Web Application Firewall. 3. Create or configure a WAF policy. 4. Enable WAF for your web applications.

Level 1

4 Compute

Ensure ECS instances do not have public IP addresses unless required.

Run prowler to check if any ECS instances have public IP addresses.

Automated

Public IP addresses expose instances to the internet, increasing the attack surface. Use a bastion host or VPN for access instead.

1. Log on to the Huawei Cloud console. 2. Go to Elastic Cloud Server. 3. For each instance with a public IP, release the EIP if not required. 4. Use a bastion host or VPN for access.

Level 1

5 Database

Ensure all RDS instances have automated backup enabled.

Run prowler to check if all RDS instances have backup enabled.

Automated

Automated backups ensure data can be recovered in case of data loss, corruption, or disaster.

1. Log on to the Huawei Cloud console. 2. Go to Relational Database Service. 3. For each instance, enable automated backup. 4. Configure backup retention period.

Level 1

5 Database

Ensure RDS instances are not publicly accessible.

Run prowler to check if any RDS instances are publicly accessible.

Automated

Publicly accessible databases expose data to anyone on the internet, significantly increasing the risk of unauthorized access and data breaches.

1. Log on to the Huawei Cloud console. 2. Go to Relational Database Service. 3. For each instance, remove the public IP address. 4. Configure VPC-only access.

Level 1

6 Load Balancing

Ensure ELB load balancers are not publicly exposed unless required.

Run prowler to check if any ELB load balancers are publicly exposed.

Automated

Publicly exposed load balancers can be targeted by DDoS attacks and unauthorized access attempts.

1. Log on to the Huawei Cloud console. 2. Go to Elastic Load Balance. 3. Review each load balancer. 4. For internal-facing services, switch to internal load balancer.

Level 1

7 Logging and Monitoring

Ensure Cloud Trace Service (CTS) tracking is enabled for auditing and compliance.

Run prowler to check if CTS tracking is enabled.

Automated

CTS tracking records all API calls and configuration changes, providing an audit trail for security analysis and compliance.

1. Log on to the Huawei Cloud console. 2. Go to Cloud Trace Service. 3. Create or enable a tracker. 4. Configure the tracker to record all management and data events.

Level 1

8 Key Management

Ensure all KMS keys have automatic key rotation enabled.

Run prowler to check if all KMS keys have rotation enabled.

Automated

Key rotation regularly replaces cryptographic material, reducing the risk of key compromise over time.

1. Log on to the Huawei Cloud console. 2. Go to Key Management Service. 3. Select each key. 4. Click the Rotation tab. 5. Enable rotation and set the rotation period.

Level 1

8 Key Management

Ensure KMS keys are not in pending deletion state, which could lead to data loss.

Run prowler to check if any KMS keys are in pending deletion state.

Automated

Keys pending deletion will be permanently deleted after the waiting period, making all data encrypted with those keys unrecoverable.

1. Log on to the Huawei Cloud console. 2. Go to Key Management Service. 3. Review keys in pending deletion state. 4. Cancel deletion for keys that are still needed.