Brute-Force Rules That Are Reachable, and Baseline Checks That Only Report
Security Center defence rules and baseline checks. A rule naming no servers defends nothing while Alibaba's default keeps running, so it is refused. The block-forever value is 52560000 minutes sitting at the end of a list of ordinary numbers, so the module takes words. SQL Server interception is off by default, which is where the interesting passwords are.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-15 · how we verify
Use it from the registry
terraform · opentofumodule "security_posture" {
source = "www.iac-bazaar.com/iac-bazaar/alicloud-security-posture/alicloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
alicloud-security-posture
Brute-force defence and scheduled baseline checks on Alibaba Cloud Security Center. Works with Terraform and OpenTofu
(>= 1.6), alicloud provider >= 1.0, < 2.0.
A rule with no servers defends nothing, and the default rule runs instead. Alibaba documents that a server with no rule of its own gets the default, so a carefully tuned rule attached to an empty list changes nothing while the console shows a rule. Refused unless the rule is the default.
The block-forever value is 52560000 minutes, a hundred years, sitting at the end of a list of ordinary numbers. This module takes words - 30m, 12h, 7d, permanent - because that number in a pull request is one nobody checks. rules_blocking_permanently lists the ones that never let go.
The three numbers only mean anything together. Eighty failures inside one minute is not a strict rule, it is an unreachable one, so the module checks the threshold against a plausible attempt rate and asks.
SQL Server interception is off while SSH and RDP are on, so a rule that reads as "block brute force" leaves the database port alone. rules_not_covering_sql_server names them.
A baseline strategy is a schedule, not a control. It reports and changes nothing, and baseline_checks_enforce_anything says so. cycle_start_time is a six-hour window rather than a time.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
alicloud-bastion
A Bastionhost instance, its exposure and the directory its operators come from. Public access with an empty allow list is refused: that is a login page for production. Without AD or LDAP every account is local and outlives the person who left. Destroying it needs Alibaba to white-list the account first, which is documented provider behaviour and reported as an output.
alicloud-ram-role
A RAM role assumable by the services or accounts you name and nothing else (a wildcard principal is refused), with a custom policy written from your statements, the system policies you name attached (AdministratorAccess and any *FullAccess policy by name), and a session ceiling of an hour.
alicloud-security-group
inner_access_policy defaults to Accept, so every instance in a group talks to every other on every port and one compromised web node is a route to the database beside it; SSH from 0.0.0.0/0 is the first rule offered; and the group is attached by the instance, which it cannot see. Members isolated unless told otherwise, SSH from anywhere refused unless accepted, egress open until rules narrow it.
alicloud-network-firewall
Address books and control policies with their evaluation order declared, since the list is read top down and a broad accept above a narrow drop silently disables it. The intrusion prevention engine ships in observation mode, where it inspects, logs and blocks nothing while every dashboard looks right; block is the default here. Rules whose action is log are counted and reported.
alicloud-waf
WAF 3.0 in front of a domain on the pay-as-you-go instance the account has (adopted, not purchased), listening on HTTPS only with your certificate (plain HTTP by name), TLS 1.2 and 1.3 with a modern cipher suite, HTTP/2 and IPv6, the client address trusted from the first X-Forwarded-For hop, and origins reached over HTTPS with SNI, keepalive and retries.
oci-cloud-guard
Oracle ships every responder rule in USERACTION mode: a Remediate button appears on each problem and nothing happens until a person clicks it, so a tenancy with hundreds of findings has by default fixed none of them. Sets AUTOACTION per rule and exports the IAM statements each auto-action needs, since one without its policy fails on every execution.