The cloud your other tools don't cover.

Every check we run on Alibaba Cloud

All 183 checks, generated directly from the scanner so this list matches what actually runs. Search for a service to see whether your stack is covered.

No Alibaba Cloud check matches that. It may be covered on another cloud, or it may be something we do not scan yet. Ask us about it .

• Commitment

  Steady fleet with no reserved instances

  A region runs many long-lived pay-as-you-go ECS instances but holds no reserved instances. A commitment-discount opportunity.

• Commitment

  Underutilized reserved instance

  An active reserved instance covers an instance type with no matching running ECS instance in the region. The commitment is being wasted.

• Compute

  ACK node pool without autoscaling

  ACK node pools with autoscaling disabled and a large fixed node count. Enabling the cluster autoscaler lets the pool scale in during low demand and stop paying for idle nodes.

• Compute uses metrics

  Idle ECS instances (low CPU)

  Running ECS instances averaging under 5% CPU (peak under 20%) over the lookback window. Release or stop candidates.

• Compute

  Long-running non-prod ECI container group

  Non-production ECI container groups that have been Running for a week or more. ECI is billed per second for the lifetime of the group, so a forgotten dev/test pod quietly accrues cost.

• Compute

  Non-prod ECS not using preemptible

  Non-production running instances using on-demand billing (SpotStrategy NoSpot). Preemptible (spot) instances cost far less for interruptible non-prod workloads.

• Compute

  Non-prod GPU instance

  Non-production instances with a GPU attached. GPU instances are expensive and rarely need to stay powered for non-prod use.

• Compute uses metrics

  Over-provisioned ECS instances

  Running ECS instances averaging 5-20% CPU with peaks under 50%. Candidates to downsize one instance tier.

• Compute

  Previous-generation ECS family

  ECS instances on a previous-generation family. The current-gen equivalent delivers more performance for a lower hourly rate.

• Compute

  Stopped ECS instances still billing

  ECS instances that are Stopped but kept in KeepCharging mode, so they bill full compute while doing nothing.

• Database

  AnalyticDB on previous-gen node class

  AnalyticDB (ADB) clusters running on a previous-generation node class. Current elastic generations deliver better price/performance for the same spend.

• Database uses metrics

  Idle RDS instances

  Running RDS instances averaging under 5% CPU over the lookback window. Idle databases that can be downsized or retired.

• Database uses metrics

  Idle Redis instances

  Redis (KVStore) instances averaging under 2% CPU and under 5% memory use over the lookback window. Idle caches.

• Database

  MongoDB on previous-gen class

  ApsaraDB for MongoDB (DDS) instances on a previous-generation instance class; current-gen classes offer better price/performance.

• Database uses metrics

  Over-provisioned RDS instances

  Running RDS instances averaging 5-25% CPU with peaks under 50%. Candidates to downsize one instance class.

• Database uses metrics

  Over-provisioned Redis instances

  Redis (KVStore) instances using under 30% of memory (peak under 50%). Candidates to downsize to a smaller memory class.

• Database

  Oversized non-prod Elasticsearch

  A non-production-looking Elasticsearch instance runs a large number of nodes, which is usually unnecessary outside production (informational).

• Database

  PolarDB on previous-gen node class

  PolarDB clusters running on a previous-generation node class. Current generations deliver more performance per dollar for the same spend.

• Database

  Previous-generation RDS instance class

  ApsaraDB RDS instances on a previous-generation (legacy ``rds.<engine>.s*``) instance class. Current-gen general/dedicated classes deliver more performance per dollar.

• Database

  Production RDS without multi-AZ

  Production ApsaraDB RDS instances on the Basic (single-AZ) category, which has no standby for automatic failover.

• Database

  Redis on previous-gen class

  ApsaraDB for Redis (KVStore) instances on a previous-generation instance class; Tair / current-gen classes offer better value.

• Database

  Single-node production Elasticsearch

  A production-looking Elasticsearch instance has a single node, so it has no high availability. A node failure means an outage and possible data loss.

• Governance

  ACK cluster on an old Kubernetes version

  ACK clusters running a Kubernetes minor version below the supported window. Old versions miss security fixes and block cluster upgrades.

• Governance

  ACK cluster without API audit logging

  ACK clusters with Kubernetes API-server audit logging to SLS disabled, so privileged control-plane actions are not recorded.

• Governance

  ALB without access logging

  Application Load Balancers with access logging to SLS not enabled, so there is no request-level audit trail of the traffic they route.

• Governance

  API Gateway group without throttling

  An API group exposes published APIs but the region has no traffic-control (throttling) policy, leaving the backend unprotected from request floods.

• Governance

  AnalyticDB cluster without backups

  AnalyticDB (ADB) clusters with a backup retention period of 0 days (or no backup policy at all). No point-in-time recovery after data loss or corruption.

• Governance

  CLB without access logging

  Classic Load Balancers with access logging not configured, so there is no request-level audit trail of the traffic they route.

• Governance

  Cloud disk without automatic snapshots

  In-use cloud disks with no auto-snapshot policy. There is no automated backup, so data loss from accidental deletion or corruption is unrecoverable.

• Governance

  DTS job failed

  A Data Transmission Service (DTS) job is in a failed/error state, so the migration or synchronization it drives is not running.

• Governance

  Default VPC present

  A default VPC exists in the account/region. Default VPCs ship with permissive defaults and are easy to deploy into by accident.

• Governance

  Disabled KMS key

  KMS keys in the Disabled state. A disabled key can decrypt nothing and is usually a leftover that should be cleaned up or re-enabled.

• Governance

  ECS on legacy classic network

  ECS instances on the legacy classic network rather than a VPC, which lacks VPC isolation, security, and feature support.

• Governance

  Elasticsearch on EOL version

  An Elasticsearch instance runs a major version at or below 6.x, which is end-of-life and no longer receiving security fixes upstream.

• Governance

  Empty RocketMQ instance

  A RocketMQ instance has no topics defined, so it carries no workload. A cleanup candidate.

• Governance

  FC function on a deprecated runtime

  Function Compute functions running on an end-of-life language runtime (old Node.js / Python / Java). Deprecated runtimes stop receiving security patches and eventually block new deployments.

• Governance

  Idle DTS job not released

  A DTS job has finished or been paused but the job (and any paid DTS instance behind it) has not been released.

• Governance

  Idle Kafka instance (no topics)

  Running Message Queue for Kafka instances with no topics configured. The cluster bills while sitting completely unused.

• Governance

  Idle RocketMQ topic

  A RocketMQ topic has no subscribed consumer groups, so nothing is consuming from it. An idle cleanup candidate.

• Governance

  Idle Tablestore instance (no tables)

  Tablestore (OTS) instances with zero tables. An empty instance serves no traffic and is usually a leftover that can be cleaned up.

• Governance

  Inactive RAM user

  Console-enabled RAM users created 90+ days ago that have never logged in. Stale identities widen the attack surface and should be removed.

• Governance

  Instance missing owner tag

  An ECS instance has no owner or environment tag, so it cannot be attributed to a responsible team or lifecycle stage.

• Governance

  Low resource tag coverage

  A large fraction of ECS instances and cloud disks carry no tags. Untagged resources cannot be attributed to a team or cost center, leaving a cost-allocation and governance gap.

• Governance

  MNS queue without a dead-letter queue

  An MNS queue has no dead-letter target configured, so messages that repeatedly fail processing are dropped rather than quarantined.

• Governance

  MongoDB on an old engine version

  ApsaraDB for MongoDB (DDS) instances on an engine version below 4.0, which is past end-of-life and misses security and performance fixes.

• Governance

  MongoDB without audit log

  ApsaraDB for MongoDB (DDS) instances with audit logging disabled, so there is no record of access to the database.

• Governance

  MongoDB without automated backup

  ApsaraDB for MongoDB (DDS) instances with no automated backup policy (no retention or backup window configured), leaving the data with no recovery point.

• Governance

  No Bastionhost despite an ECS fleet

  The account runs many ECS instances but operates no Bastionhost, so privileged access to the fleet is not centrally brokered or audited.

• Governance

  Non-prod AnalyticDB cluster running

  AnalyticDB (ADB) clusters whose name/tags mark them as non-production (dev/test/staging) yet are running. ADB clusters bill while up. Pause or clean up idle non-prod warehouses.

• Governance

  Non-prod ECS running 24/7

  Non-production instances left in the Running state continuously. They are strong candidates for a stop/start schedule to save off-hours cost.

• Governance

  OSS bucket without access logging

  OSS buckets with access logging disabled, leaving no audit trail of who accessed the bucket's objects.

• Governance

  OSS bucket without versioning

  OSS buckets with versioning not Enabled (never enabled or suspended), leaving objects unprotected against accidental overwrite or deletion.

• Governance

  Offline CDN domain

  CDN domains in an offline or configuring/failed state. Not serving traffic but still provisioned. Candidates for cleanup.

• Governance

  Oversized VPC CIDR

  A VPC reserves a very large CIDR block (short prefix). Oversized ranges waste address space and complicate future peering/CIDR plans.

• Governance

  PolarDB cluster without deletion lock

  PolarDB clusters that do not have the deletion lock enabled, so a single accidental API call or console action can destroy the cluster.

• Governance

  PolarDB with insufficient backup retention

  PolarDB clusters whose level-1 (data) backup retention is below a safe minimum, shrinking the recovery window after data loss or corruption.

• Governance

  Prod ECS without deletion protection

  Production-looking ECS instances with DeletionProtection disabled, so they can be released by an accidental API/console call.

• Governance

  RDS backups disabled

  ApsaraDB RDS instances with a backup retention period of 0 days or log (binlog) backup turned off. No point-in-time recovery.

• Governance

  RDS deletion protection disabled

  Production ApsaraDB RDS instances with deletion protection turned off, so the database can be deleted with a single API call.

• Governance

  RDS end-of-life engine version

  ApsaraDB RDS instances on an end-of-life engine version (MySQL 5.5/5.6, PostgreSQL < 11, or an out-of-support SQL Server) that no longer receives security patches.

• Governance

  RDS without SQL audit

  ApsaraDB RDS instances with the SQL audit (SQL collector) policy turned off, so there is no audit trail of the queries run against the database.

• Governance

  RDS without log (binlog) backup

  ApsaraDB RDS instances with log (binlog) backup disabled, so point-in-time recovery is impossible and only full snapshots remain.

• Governance

  Redis without audit log

  ApsaraDB for Redis (Tair/KVStore) instances with the audit log feature disabled, so there is no record of the commands run against the cache.

• Governance

  Repository without immutable tags

  A Container Registry repository does not enforce tag immutability, so an existing tag can be overwritten with a different image.

• Governance

  Reserved instance expiring soon

  An active reserved instance expires within 30 days. Without renewal the covered workload reverts to pay-as-you-go pricing.

• Governance

  Reserved instance recently expired

  A reserved instance expired within the last 30 days. Any workload it covered is now billing at pay-as-you-go rates. A coverage gap.

• Governance

  SLS Logstore short retention

  A Logstore retains logs for fewer than 7 days. Short retention drops history before incident response or audits can use it.

• Governance

  SLS Logstore without an index

  A Logstore has no index, so its logs cannot be queried or used for search-based alerting. Limiting audit and investigation value.

• Governance

  Snapshots without a retention limit

  Manually created snapshots with no retention period. They are kept until deleted by hand, so storage cost grows unbounded over time.

• Governance

  Stale API Gateway group

  An API group has no published APIs. Empty groups still reserve a sub-domain and clutter the gateway; they should be cleaned up.

• Governance

  Stale FC function

  Function Compute functions not modified in 180+ days. Long-untouched functions are frequently abandoned and worth reviewing for cleanup.

• Governance

  Stale KMS secret

  KMS Secrets Manager secrets that have not had a new version created in over a year, a sign the secret may be abandoned and should be reviewed for removal.

• Governance

  Stale MNS queue

  An MNS queue has no messages and has not been modified for a long time, suggesting it is abandoned (best-effort, from config only).

• Governance

  Stale container repository

  A Container Registry repository has had no push for a long time, suggesting it is abandoned and a candidate for cleanup.

• Governance

  Stopped Kafka instance not released

  Message Queue for Kafka instances whose service has stopped / expired but which have not been released, leaving leftover resources behind.

• Governance

  Untagged cloud disk

  A cloud disk has zero tags, leaving its storage spend with no owner or cost-center attribution (cost-allocation gap).

• Network

  ALB with no registered targets

  Application Load Balancers whose server groups have no registered backend servers. They bill an hourly instance fee while routing to nothing.

• Network

  CLB with no listeners

  Classic Load Balancers with no listeners configured. They bill an hourly instance fee while unable to route any traffic.

• Network

  Idle NAT gateways (no entries)

  NAT gateways with no SNAT and no DNAT (forward) entries configured. They bill an hourly instance fee while translating no traffic.

• Network

  Idle load balancers (no backends)

  Server Load Balancers with no backend servers attached. They bill an hourly instance fee while routing to nothing.

• Network uses metrics

  Idle load balancers (no traffic)

  CLB load balancers with near-zero inbound traffic and active connections over the lookback window. Idle even if a backend exists.

• Network

  Idle pay-by-bandwidth Elastic IPs

  Pay-by-bandwidth Elastic IPs in the Available state (bound to nothing). They reserve and bill a fixed bandwidth ceiling while serving nothing.

• Network

  NAT gateway without SNAT entries

  NAT gateways with no SNAT entries configured. No subnet uses the gateway for outbound (source) translation. Review whether it is needed.

• Network

  Non-prod CLB on guaranteed-performance spec

  Classic Load Balancers that look non-production yet run on a guaranteed-performance spec, a pricier tier than shared performance.

• Network

  Orphaned VPC peering connection

  VPC peering connections that exist but are not referenced by any route table entry. The peering provides no connectivity yet remains an approved cross-VPC path that should be cleaned up.

• Network

  Oversized Elastic IP bandwidth

  Elastic IPs bound to a resource but provisioned with a very high bandwidth ceiling. Likely oversized for the bound workload.

• Network

  Unattached Elastic IPs

  Elastic IP addresses in the Available state (bound to nothing). Pay-as-you-go EIPs bill an idle reservation fee while unattached.

• Network

  Unattached secondary ENI

  A secondary Elastic Network Interface is in the Available state, attached to no instance. Unattached ENIs are leftover plumbing that clutter the network and hold IP addresses.

• Network

  Unused CEN bandwidth package

  A CEN (Cloud Enterprise Network) bandwidth package is not bound to any CEN instance. It reserves cross-region bandwidth that nothing is using.

• Network

  Unused vSwitch

  A vSwitch has its full address range available, suggesting no resources are deployed into it (best-effort, from IP accounting).

• Network

  VPN gateway with no connections

  A VPN gateway has no IPsec connections, so it provides no connectivity while still reserving (and potentially billing for) the gateway.

• Network

  vSwitch near IP exhaustion

  A vSwitch has very few available IP addresses remaining. New resources launched into it may fail to acquire an address.

• Security

  ACK cluster with a public API server

  ACK (Kubernetes) clusters exposing the API server over a public internet endpoint, widening the attack surface of the control plane.

• Security

  ACK cluster without Secret encryption

  ACK clusters that do not have KMS-backed encryption-at-rest for Kubernetes Secrets, so Secret values are stored unencrypted in etcd.

• Security

  ACK cluster without network policy enforcement

  ACK clusters using a Flannel-based CNI, which does not enforce Kubernetes NetworkPolicy. Pod-to-pod traffic is unrestricted across the cluster, so a single compromised pod can reach every other workload.

• Security

  ACR instance public endpoint enabled

  A Container Registry Enterprise Edition instance has its public network endpoint enabled, exposing the registry to the internet.

• Security

  ALB HTTP listener without HTTPS redirect

  Application Load Balancers with an HTTP listener that does not redirect to HTTPS, allowing clients to keep using plaintext connections.

• Security

  API Gateway API publicly visible on the internet

  An API has PUBLIC visibility (listed in the API marketplace) on a group served from an internet sub-domain, widening its discoverable surface.

• Security

  API Gateway API without authentication

  An API Gateway API uses AuthType NONE (anonymous access) while its group is reachable on a public sub-domain. Anyone can call it unauthenticated.

• Security

  AnalyticDB whitelist open to the world

  AnalyticDB clusters whose security IP whitelist contains 0.0.0.0/0, so any host on the internet can attempt to connect to the data warehouse.

• Security

  Bastionhost with public network access

  Bastionhost instance with public network access enabled, exposing the privileged-access console to the public internet.

• Security

  CDN domain allows plain HTTP

  CDN domains that have HTTPS available but do not force a redirect from HTTP to HTTPS, leaving an insecure plaintext path open.

• Security

  CDN domain permitting weak TLS

  CDN domains whose HTTPS configuration still permits TLS 1.0 or 1.1, protocols with known weaknesses that modern clients should not use.

• Security

  CDN domain without HTTPS

  CDN accelerated domains with no SSL/HTTPS configured. Traffic is served over plaintext HTTP and is open to interception.

• Security

  CLB HTTPS listener on a weak TLS policy

  Classic Load Balancer HTTPS listeners using a TLS cipher policy that still permits TLS 1.0 or 1.1, protocols with known weaknesses.

• Security

  Cloud Firewall accepts any port from the internet

  A Cloud Firewall internet-direction control policy accepts traffic from 0.0.0.0/0 to any port, defeating the purpose of the edge firewall.

• Security

  Cloud Firewall default action is Accept

  The Cloud Firewall internet-traffic default action is Accept rather than a default-deny posture, so traffic not matched by an explicit policy is allowed through.

• Security

  Cloud Firewall not enabled

  Cloud Firewall is not enabled even though the account has internet-exposed assets (public ECS, EIPs, or internet-facing SLBs), leaving north-south traffic without edge inspection.

• Security

  DNS zone without DNSSEC

  Public DNS domains with DNSSEC disabled, leaving resolution open to cache poisoning and spoofing attacks.

• Security

  Disabled ActionTrail trail

  An ActionTrail trail exists but its Status is Disable, so it is not delivering events even though it is configured.

• Security

  ECS instance with public IP

  Running ECS instances with a public IP address or a bound EIP, giving them a direct attack surface on the internet.

• Security

  ECS without instance RAM role

  ECS instances with no instance RAM role, implying applications use long-lived static AccessKeys instead of rotated instance credentials.

• Security

  ENI without a security group

  An Elastic Network Interface has no security group attached, so its traffic is governed by no rules. An unguarded network attachment.

• Security

  Elasticsearch HTTPS not enforced

  An Elasticsearch instance accepts plaintext HTTP rather than enforcing HTTPS, so credentials and query data travel unencrypted.

• Security

  Elasticsearch Kibana open to the world

  Elasticsearch instances whose Kibana public-network access is enabled with a 0.0.0.0/0 whitelist, exposing the Kibana console to the internet.

• Security

  Elasticsearch public endpoint

  An Elasticsearch instance has its public network endpoint enabled, reachable from outside the VPC.

• Security

  FC HTTP trigger with anonymous auth

  Function Compute HTTP triggers configured with anonymous authType, so the function can be invoked over HTTP without any credentials.

• Security

  FC function with plaintext secret env var

  Function Compute functions whose environment-variable keys look like secrets (password / token / key), suggesting credentials are stored in plaintext instead of a secret store.

• Security

  Internet-facing ALB

  Application Load Balancers with an internet-facing address. They are reachable from the public internet and warrant WAF / access review.

• Security

  Internet-facing CLB

  Classic Load Balancers with an internet-facing address. They are reachable from the public internet and warrant access review.

• Security

  KMS key pending deletion

  KMS keys in the PendingDeletion state. Once deleted, every ciphertext or secret encrypted under the key becomes permanently unrecoverable.

• Security

  KMS key without automatic rotation

  Enabled customer master keys (CMKs) with automatic rotation disabled. Rotating keys limits the blast radius of a compromised key.

• Security

  KMS secret without automatic rotation

  KMS Secrets Manager secrets with automatic rotation disabled, so a leaked secret value stays valid until someone rotates it by hand.

• Security

  Kafka instance with public endpoint

  Message Queue for Kafka instances deployed with an internet (public) endpoint, reachable from outside the VPC.

• Security

  Kafka instance without ACL

  Message Queue for Kafka instances with ACL / authentication not enabled, so any client that can reach the instance on the network can read from and write to its topics.

• Security

  Linux ECS without key pair

  Linux ECS instances with no key pair bound, implying password-based SSH authentication that is more vulnerable to brute-force attacks.

• Security

  MongoDB without TLS

  ApsaraDB for MongoDB (DDS) instances that do not enforce TLS/SSL on client connections, so traffic and credentials travel in cleartext.

• Security

  NAS without encryption

  NAS file systems created with encryption disabled. Data at rest is not protected by server-side encryption.

• Security

  No ActionTrail trail

  The account has no ActionTrail trail, so management-plane API activity is not being delivered to OSS or SLS for audit and forensics.

• Security

  No SLS project

  The account has no Log Service (SLS) project, so there is no centralized place collecting logs for auditing or investigation.

• Security

  No custom RAM password policy

  The account has no custom RAM password policy and relies on weak defaults. Set explicit complexity, length, and rotation requirements.

• Security

  No multi-region ActionTrail trail

  No enabled ActionTrail trail covers all regions (TrailRegion=All), so activity in some regions is unaudited even though trails exist.

• Security

  OSS bucket not enforcing HTTPS

  OSS buckets whose bucket policy does not deny plaintext (HTTP) access, allowing objects and credentials to traverse the network unencrypted.

• Security

  OSS bucket policy grants wildcard principal

  OSS buckets whose bucket policy has an Allow statement with a Principal of '*' and no Condition. This exposes the objects to anyone regardless of the bucket ACL, a common cause of accidental data exposure.

• Security

  OSS bucket without default encryption

  OSS buckets that have no server-side default encryption rule, so new objects are not guaranteed to be encrypted at rest.

• Security

  OSS bucket world-writable (public-read-write ACL)

  OSS buckets with a public-read-write ACL. Anyone on the internet can not only read every object but also overwrite or delete them and upload new ones, the single most dangerous OSS misconfiguration.

• Security

  PolarDB without SSL

  PolarDB clusters that do not enforce SSL on their connection endpoint, so client traffic and credentials can travel unencrypted.

• Security

  Possible dangling DNS record

  CNAME (or aliased) records pointing at cloud-provider endpoints that may have been released. A subdomain-takeover risk. Informational.

• Security

  Public OSS buckets

  OSS buckets with a public-read or public-read-write ACL, exposing their objects to anyone on the internet.

• Security

  Public assets without Anti-DDoS protection

  The account exposes public-facing assets (internet load balancers or public EIPs) but has no Anti-DDoS Pro/Premium instance protecting them, leaving those endpoints exposed to volumetric attacks.

• Security

  Public container repository

  A Container Registry repository has a public repo type, so its images are pullable by anyone without authentication.

• Security

  Public domain not protected by WAF

  A known public domain (from CDN) is not present in the set of WAF-protected domains, so its application-layer traffic is unfiltered.

• Security

  Publicly reachable AnalyticDB cluster

  AnalyticDB (ADB) clusters with a public (Internet) connection endpoint, reachable from outside the VPC.

• Security

  Publicly reachable MongoDB

  ApsaraDB for MongoDB (DDS) instances on the Classic network (not a VPC), reachable from outside a private network boundary.

• Security

  Publicly reachable RDS instances

  ApsaraDB RDS instances with an Internet (public) network endpoint, reachable from outside the VPC.

• Security

  Publicly reachable Redis

  ApsaraDB for Redis (KVStore) instances with a public (Internet) connection endpoint, reachable from outside the VPC.

• Security

  Publicly shared custom images

  Self-owned custom images shared to all Alibaba Cloud accounts. Anyone can launch them, exposing whatever software, keys, or data they contain.

• Security

  RAM policy grants full admin (Action * on *)

  Custom RAM policy documents with an Allow statement granting Action '*' on Resource '*', which is effectively unrestricted administrator access.

• Security

  RAM role trust policy allows wildcard principal

  RAM roles whose assume-role (trust) policy permits a wildcard principal with no condition, so any identity that can reach the role can assume it.

• Security

  RAM user with AdministratorAccess

  RAM users with the AdministratorAccess policy attached directly. Admin rights should be granted through groups/roles and scoped down.

• Security

  RAM user with two active AccessKeys

  RAM users with two active AccessKeys at once. A second active key is only meant to be transient during rotation; standing pairs double the credential exposure.

• Security

  RAM user without MFA

  RAM users with console access (a login profile) but no MFA device bound. A stolen password fully compromises the account.

• Security

  RDS SSL/TLS disabled

  ApsaraDB RDS instances that do not enforce SSL/TLS, so client connections (and credentials) can travel in cleartext.

• Security

  RDS public endpoint with open whitelist

  ApsaraDB RDS instances with an Internet (public) endpoint AND a 0.0.0.0/0 whitelist entry. The database is reachable and accepts connections from anywhere on the internet.

• Security

  RDS whitelist open to the world

  ApsaraDB RDS instances whose IP whitelist contains 0.0.0.0/0, allowing connection attempts from any address.

• Security

  RDS without Transparent Data Encryption

  ApsaraDB RDS instances with Transparent Data Encryption (TDE) disabled, so the database files are not encrypted at rest.

• Security

  Redis without TLS

  ApsaraDB for Redis (KVStore) instances with SSL/TLS disabled, so client traffic (including the auth password) is sent in cleartext.

• Security

  Redis without authentication

  ApsaraDB for Redis (KVStore) instances that accept connections without a password. Either classic-network instances or VPC instances with free (password-less) auth enabled.

• Security

  SLS project policy allows broad access

  An SLS project's resource policy appears to grant broad or anonymous access (wildcard principal/action), exposing logs to unintended readers (best-effort, from the policy document).

• Security

  Secondary ENI with a public IP

  A secondary Elastic Network Interface carries a public IP address, widening the network's internet-facing surface (informational).

• Security

  Security Center on free/basic version only

  Security Center (SAS) is on the free/basic edition, which provides only limited threat detection (no advanced anti-ransomware, virus defense, or deep vulnerability scanning).

• Security

  Security group open to the world

  Security-group ingress rules that allow a sensitive port (SSH, RDP, common databases) from 0.0.0.0/0.

• Security

  Stale RAM AccessKey

  Active RAM AccessKeys older than 90 days. Long-lived keys widen the window for leaked credentials to be abused; rotate them regularly.

• Security

  Tablestore instance public to the internet

  Tablestore (OTS) instances whose network ACL allows INTERNET access, so the instance endpoint is reachable from the public internet.

• Security

  Tablestore instance without VPC-restricted ACL

  Tablestore (OTS) instances whose network ACL does not restrict access to a VPC, so traffic is not confined to a private network.

• Security

  Unencrypted cloud disks

  Cloud disks created without encryption at rest. Data on the disk and its snapshots is stored in the clear.

• Security

  Unhandled Security Center alerts

  Security Center has unhandled suspicious-event alerts that have not been triaged or resolved.

• Security

  Unhandled Security Center vulnerabilities

  Security Center reports a non-trivial number of unhandled vulnerabilities (e.g. CVEs) that have not yet been remediated.

• Security

  Unused RAM AccessKey

  Active RAM AccessKeys that are very old (180+ days). Without a last-used signal these are likely forgotten standing credentials.

• Security

  VPC without flow logs

  A VPC has no active flow log. Without flow logs there is no network traffic record for incident response or anomaly detection.

• Security

  WAF not enabled for public web assets

  The account exposes public web assets (CDN domains or internet-facing load balancers) but has no Web Application Firewall instance or protected domains configured.

• Security

  Weak RAM password policy

  The account password policy is below CIS minimums: length under 14, missing character-class complexity, or no maximum password age.

• Storage

  NAS with no mount targets

  NAS file systems with zero mount targets. Nothing can mount them, yet they keep billing for any stored data.

• Storage

  Non-prod NAS on Performance tier

  Non-production NAS file systems on the Performance storage tier. The Capacity tier costs a fraction per GB and suits dev/test workloads.

• Storage

  Non-prod SLS Logstore long retention

  A non-production Logstore retains logs for a very long time. Long retention on throwaway environments pays for storage no one needs.

• Storage

  OSS Standard bucket is a cold-tier candidate

  OSS buckets on the Standard storage class that were created long ago and have no lifecycle rules. Older Standard data is often cold and a candidate for Infrequent Access or Archive tiering to cut storage cost.

• Storage

  OSS bucket without lifecycle rules

  OSS buckets with no lifecycle rules, so stale objects and incomplete multipart uploads accumulate and bill indefinitely.

• Storage

  Old snapshots

  Snapshots older than 180 days. Long-lived snapshots accumulate storage cost; the oldest are rarely the restore point anyone needs.

• Storage

  Old unused custom images

  Self-owned custom images at least 180 days old that no instance is using. They bill image storage for an image nothing boots from.

• Storage

  Orphaned snapshots

  Snapshots whose source disk no longer exists and that are at least 30 days old. Their source is gone, so they bill storage for a disk that was deleted.

• Storage

  Oversized NAS provisioning

  NAS file systems whose billed (metered) size is a tiny fraction of the provisioned capacity. Provisioning likely overshot real demand.

• Storage

  Previous-generation cloud disks

  In-use cloud disks on a previous-generation category (cloud, cloud_efficiency, cloud_ssd). Migrating to ESSD lowers the per-GB rate with equal or better performance.

• Storage

  Unattached cloud disks

  Cloud disks in the Available state (no attached instance) for 7+ days. They bill full price whether or not anything uses them.

Checks marked opt-in use a paid or billing-data cloud API and never run unless you switch them on. A default scan uses only free APIs.