Cloud

Secure Alibaba Cloud with cnspec

Scan an Alibaba Cloud account against security and compliance best practices with cnspec.

Scan your Alibaba Cloud account to find security risks before they become incidents. cnspec evaluates RAM identities, OSS buckets, ECS instances, VPC networks, SLB load balancers, and managed databases (ApsaraDB RDS, Redis, MongoDB, and PolarDB), all without installing agents on your infrastructure.

New to cnspec? Read the Quickstart to install cnspec and run your first scan. To scan other platforms, see the cloud scanning overview.

Prerequisites

To scan Alibaba Cloud with cnspec, you must have:

Read-only permissions are sufficient for assessment. Alibaba Cloud provides the ReadOnlyAccess system policy, which grants the read access cnspec needs.

Authenticate

cnspec resolves Alibaba Cloud credentials in this order:

  1. The command-line flags below
  2. The standard Alibaba Cloud environment variables (ALIBABA_CLOUD_ACCESS_KEY_ID, ALIBABA_CLOUD_ACCESS_KEY_SECRET, and ALIBABA_CLOUD_SECURITY_TOKEN)
  3. The shared credentials file at ~/.alibabacloud/credentials
  4. An ECS instance RAM role, when you run cnspec inside Alibaba Cloud

Create an AccessKey pair in the Alibaba Cloud RAM console for a RAM user, then export it once and reuse it across commands:

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret

You can also pass the credentials on the command line with --access-key-id and --access-key-secret:

cnspec scan alicloud --access-key-id YOUR_ACCESS_KEY_ID --access-key-secret YOUR_ACCESS_KEY_SECRET

To assume a RAM role instead of using the AccessKey pair directly, pass its ARN with --role-arn:

cnspec scan alicloud --role-arn acs:ram::YOUR_ACCOUNT_UID:role/YOUR_ROLE_NAME \
  --access-key-id YOUR_ACCESS_KEY_ID --access-key-secret YOUR_ACCESS_KEY_SECRET

Verify with a quick Alibaba Cloud check

Confirm that cnspec can reach your Alibaba Cloud account:

cnspec run alicloud -c 'alicloud.accountId != empty'

If cnspec connects, it prints your account UID and confirms the check passed.

Scan Alibaba Cloud

Scan your Alibaba Cloud account:

cnspec scan alicloud

By default, cnspec discovers and scans every region enabled on the account. To scan a single region, pass --region:

cnspec scan alicloud --region cn-hangzhou

To scan a specific set of regions, pass a comma-separated list with --regions:

cnspec scan alicloud --regions cn-hangzhou,ap-southeast-1

When the scan completes, cnspec prints each check with a pass or fail result and an overall risk score from 0 (no risk) to 100 (highest risk). To learn how to read a report in depth, see Understand Scan Results.

Scan with the Mondoo Alibaba Cloud Security policy

Mondoo maintains an out-of-the-box Alibaba Cloud Security policy that checks RAM identities, OSS bucket security, ECS and VPC configuration, SLB load balancers, managed database settings, and more.

Mondoo Platform users: Enable the policy in your space. In the Mondoo App, go to Findings > Policies, search for "Alibaba", and add the policy. To learn more, read Manage policies in Mondoo Platform.

Open source users: Pass the policy bundle URL directly to cnspec:

cnspec scan alicloud \
  --policy-bundle https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-alibaba-security.mql.yaml

You can also create your own policies to meet your specific requirements.

Explore and test checks interactively

Open a cnspec shell to discover resources and try out checks:

cnspec shell alicloud

List the regions enabled on the account

cnspec> alicloud.regions

List RAM users

cnspec> alicloud.ram.users { userName displayName email lastLoginDate }

Review the account password policy

cnspec> alicloud.ram.passwordPolicy { minimumPasswordLength requireNumbers requireSymbols requireUppercaseCharacters requireLowercaseCharacters }

Find OSS buckets with public access

cnspec> alicloud.oss.buckets.where(acl != "private") { name region acl }

Find OSS buckets without default encryption

cnspec> alicloud.oss.buckets.where(sseAlgorithm == empty) { name region }

List ECS instances

cnspec> alicloud.ecs.instances { instanceId instanceName status instanceType regionId }

List security groups and their rules

cnspec> alicloud.ecs.securityGroups { securityGroupName securityGroupId permissions }

List VPC networks

cnspec> alicloud.vpc.networks { vpcName vpcId regionId cidrBlock }

Find internet-facing load balancers

cnspec> alicloud.slb.loadBalancers.where(addressType == "internet") { loadBalancerName address regionId }

Find RDS instances without TLS enabled

cnspec> alicloud.rds.instances { dbInstanceId engine engineVersion dbInstanceStatus }

List managed database instances

cnspec> alicloud.redis.instances { instanceId instanceName engineVersion }
cnspec> alicloud.mongodb.instances { dbInstanceId engine engineVersion }
cnspec> alicloud.polardb.clusters { dbClusterId engine dbVersion }

Learn more

Secure a Tenancy

Scan an Oracle Cloud Infrastructure tenancy against security and compliance best practices with cnspec.

DigitalOcean

Scan a DigitalOcean account against security and compliance best practices with cnspec.

On this page

PrerequisitesAuthenticateVerify with a quick Alibaba Cloud checkScan Alibaba CloudScan with the Mondoo Alibaba Cloud Security policyExplore and test checks interactivelyList the regions enabled on the accountList RAM usersReview the account password policyFind OSS buckets with public accessFind OSS buckets without default encryptionList ECS instancesList security groups and their rulesList VPC networksFind internet-facing load balancersFind RDS instances without TLS enabledList managed database instancesLearn more