To implement least privilege access and minimize attack surface, ensure that your Elastic Compute Service (ECS) security groups are configured with fine grained rules.
Security In Alibaba Cloud, security groups act as virtual firewalls, controlling inbound and outbound traffic for your ECS instances, similar to how a traditional firewall works. You can define rules within a security group to specify which traffic is allowed and which is blocked. Setting up fine-grained security group rules effectively reduces breach impact by restricting access to resources beyond these rules, making them inaccessible to your ECS instance. To keep your ECS instances secure, it is strongly recommended to follow the Principle of Least Privilege (POLP) and configure your security group rules for specific situations. For example, fine-grained security group rules are useful when a website deployed on your ECS instance needs to provide external web services or when you want to connect to your instance from an on-premises server.
Audit
To determine if your security groups are configured with fine grained rules, perform the following operations:
Remediation / Resolution
To ensure that your security groups are configured with fine grained rules only, perform the following operations:
References
- Alibaba Cloud Documentation
- Security group rules
- Best practices of the security group (part 1)
- Security groups for different use cases
- ossutil Documentation
- DescribeSecurityGroups
- DescribeSecurityGroupAttribute
- ModifySecurityGroupRule
- RevokeSecurityGroup