Cloud Security
What to know
Security on Alibaba Cloud rests on identity, network control, data protection, and monitoring. Identity: RAM users, groups, roles, and policies; use roles with STS temporary credentials for cross-service and cross-account access instead of embedding AccessKeys. Enforce multi-factor authentication and least privilege. Network: security groups (stateful, instance-level allow rules), network ACLs, VPC isolation, and bastion hosts for administrative access. Data: encryption at rest (cloud disk and OSS server-side encryption with KMS-managed keys) and in transit (TLS). Monitoring and compliance: ActionTrail records API calls for audit; CloudMonitor and Log Service for operational visibility; Anti-DDoS and Web Application Firewall for edge protection.
Traps in questions
- Root account versus RAM user: the root account should be locked down with MFA and never used for routine work; day-to-day operations use RAM users or roles.
- Long-term AccessKeys in code are the classic anti-pattern; the correct answer is a RAM role assumed by the workload.
- Security groups are allow-only and stateful - return traffic is automatically permitted; you cannot write explicit deny rules in a security group.
- Encryption at rest protects stored data; it does not replace access control. A question offering "encrypt the disk" as the fix for over-broad permissions is wrong.
- ActionTrail is audit, not prevention.
Worked example
An application on ECS must read from OSS without storing credentials. Rule of thumb: attach a RAM role to the ECS instance; the instance obtains temporary STS credentials scoped by policy to that bucket. No keys in code, automatic rotation, auditable in ActionTrail.
Rule of thumb
Least privilege plus temporary credentials plus audit logging covers most exam scenarios.