Alibaba Cloud Security Lab: RAM, STS, OSS, WAF

It teaches how to put identity and data controls on an Alibaba Cloud account: using RAM users and roles instead of the main account, replacing AccessKey pairs with STS tokens, writing least-privilege RAM policies, recording evidence with ActionTrail, keeping OSS buckets private with Block Public Access, restricting security group rules, storing secrets in KMS, and layering WAF and Security Center.

Alibaba Cloud says an account AccessKey pair has full permissions on all resources by default, that a compromise is extremely high risk, and strongly recommends not creating or using one. A RAM user AccessKey inherits only that user's permissions, and temporary STS credentials expire automatically.

By default ActionTrail retains management events for 90 days and does not collect data events such as reading an object from OSS. To keep events longer or record data events you create a trail that delivers events to Simple Log Service, OSS or, for single-account trails, MaxCompute; storage is charged by the destination service.

It prevents anonymous access to OSS resources at the account, bucket, access point or Object FC Access Point level. When enabled, existing public permissions are ignored and new ones cannot be created. Account-level settings take priority over lower levels.

Monitor mode logs alerts for suspicious traffic without blocking it, which Alibaba Cloud suggests for new applications so you can tune out false positives before enforcing. It does not block, so leaving it on permanently gives you visibility but no protection.