Security Scenario Pack

ID: pack:aliyun:security

Description

Directory roll-up of Alibaba Cloud security packs, covering identity, network exposure, data protection, audit logging, supply chain, key management, platform security, and security group controls.

Included Rules

• rule:aliyun:ack-cluster-public-endpoint-check
• rule:aliyun:ack-cluster-rrsa-enabled
• rule:aliyun:actiontrail-trail-intact-enabled
• rule:aliyun:api-gateway-api-auth-required
• rule:aliyun:api-gateway-api-internet-request-https
• rule:aliyun:api-gateway-group-enabled-ssl
• rule:aliyun:cr-repository-image-scanning-enabled
• rule:aliyun:cr-repository-type-private
• rule:aliyun:ecs-disk-auto-snapshot-policy
• rule:aliyun:ecs-disk-idle-check
• rule:aliyun:ecs-in-use-disk-encrypted
• rule:aliyun:ecs-instance-attached-security-group
• rule:aliyun:ecs-instance-enabled-security-protection
• rule:aliyun:ecs-instance-login-use-keypair
• rule:aliyun:ecs-instance-ram-role-attached
• rule:aliyun:ecs-instances-in-vpc
• rule:aliyun:ecs-running-instance-no-public-ip
• rule:aliyun:ecs-security-group-egress-not-all-access
• rule:aliyun:ecs-security-group-not-internet-cidr-access
• rule:aliyun:ecs-security-group-not-open-all-port
• rule:aliyun:ecs-security-group-not-open-all-protocol
• rule:aliyun:ecs-security-group-risky-ports-check-with-protocol
• rule:aliyun:ecs-security-group-white-list-port-check
• rule:aliyun:elasticsearch-instance-enabled-data-node-encryption
• rule:aliyun:elasticsearch-public-and-any-ip-access-check
• rule:aliyun:emr-cluster-master-public-access-check
• rule:aliyun:ess-scaling-configuration-enabled-internet-check
• rule:aliyun:fc-service-bind-role
• rule:aliyun:fc-service-internet-access-disable
• rule:aliyun:fc-service-vpc-binding
• rule:aliyun:kms-key-rotation-enabled
• rule:aliyun:kms-secret-rotation-enabled
• rule:aliyun:mongodb-public-and-any-ip-access-check
• rule:aliyun:mse-cluster-config-auth-enabled
• rule:aliyun:nas-filesystem-encrypt-type-check
• rule:aliyun:oss-bucket-anonymous-prohibited
• rule:aliyun:oss-bucket-logging-enabled
• rule:aliyun:oss-bucket-only-https-enabled
• rule:aliyun:oss-bucket-policy-no-any-anonymous
• rule:aliyun:oss-bucket-public-read-prohibited
• rule:aliyun:oss-bucket-public-write-prohibited
• rule:aliyun:oss-bucket-server-side-encryption-enabled
• rule:aliyun:oss-bucket-versioning-enabled
• rule:aliyun:oss-encryption-byok-check
• rule:aliyun:polardb-cluster-enabled-ssl
• rule:aliyun:polardb-public-and-any-ip-access-check
• rule:aliyun:ram-group-has-member-check
• rule:aliyun:ram-password-policy-check
• rule:aliyun:ram-policy-no-statements-with-admin-access-check
• rule:aliyun:ram-user-activated-ak-quantity-check
• rule:aliyun:ram-user-ak-create-date-expired-check
• rule:aliyun:ram-user-ak-used-expired-check
• rule:aliyun:ram-user-group-membership-check
• rule:aliyun:ram-user-last-login-expired-check
• rule:aliyun:ram-user-login-check
• rule:aliyun:ram-user-mfa-check
• rule:aliyun:ram-user-no-product-admin-access
• rule:aliyun:rds-instance-enabled-log-backup
• rule:aliyun:rds-instance-enabled-ssl
• rule:aliyun:rds-instance-enabled-tde-disk-encryption
• rule:aliyun:rds-public-access-check
• rule:aliyun:rds-public-connection-and-any-ip-access-check
• rule:aliyun:redis-instance-backup-log-enabled
• rule:aliyun:redis-instance-enabled-ssl
• rule:aliyun:redis-instance-no-public-ip
• rule:aliyun:redis-public-and-any-ip-access-check
• rule:aliyun:root-ak-check
• rule:aliyun:root-mfa-check
• rule:aliyun:security-center-version-check
• rule:aliyun:security-ecs-disk-encrypted
• rule:aliyun:security-ecs-instance-security-group-required
• rule:aliyun:security-ecs-instance-vpc-required
• rule:aliyun:security-rds-instance-vpc-required
• rule:aliyun:security-redis-instance-vpc-required
• rule:aliyun:sg-public-access-check
• rule:aliyun:slb-acl-public-access-check
• rule:aliyun:slb-instance-log-enabled
• rule:aliyun:slb-listener-https-enabled
• rule:aliyun:slb-listener-risk-ports-check
• rule:aliyun:vpc-flow-logs-enabled
• rule:aliyun:vpc-network-acl-risky-ports-check
• rule:aliyun:waf-instance-logging-enabled