Security
Core concepts
Security on Alibaba Cloud spans identity, network, data, and threat detection. Know the shared responsibility model: the provider secures physical infrastructure and managed-service platforms; you secure guest OS, applications, data, and access configuration.
Key services: Security Center (host and threat detection, baseline checks), Anti-DDoS (Basic included, Pro/Premium for volumetric attacks), Web Application Firewall (WAF) (HTTP/HTTPS layer 7 protection against SQLi/XSS), Cloud Firewall (centralized east-west and north-south traffic control), and Key Management Service (KMS) for encryption keys.
Understand encryption at rest (OSS, ECS disks via KMS) and in transit (TLS/HTTPS). ActionTrail records API activity for audit; Cloud Config tracks resource configuration compliance.
Traps
- WAF protects HTTP/HTTPS applications; Anti-DDoS protects against volumetric network attacks - do not swap them.
- Security Center is detection/visibility, not a replacement for security groups.
- Encryption keys belong in KMS, not hardcoded in application config.
Rule of thumb
Layer defenses: Anti-DDoS at the edge, WAF for application attacks, security groups for instance-level filtering, Security Center for detection, KMS for key custody, ActionTrail for audit. A question naming a specific attack type usually maps to one specific layer.