Ensure access keys are rotated every 90 days or less

Remediation

Alibaba Cloud Console (Asset-Level)

1. Open the affected asset from the finding details.
2. Go to the related Alibaba Cloud service console (RAM, ActionTrail, VPC, OSS, RDS, ACK, KMS, or Security Center).
3. Apply the secure setting required by this control (for example: disable public access, tighten policy, enable logging, enforce encryption, or enable deletion protection).
4. Save changes and verify the resource is now compliant.

Alibaba Cloud CLI (Asset-Level)

1. Configure CLI credentials:

aliyun configure

1. Identify the affected resource and service using a Describe/List command, then apply the corresponding Modify/Update command for that service.

Common starting commands:

aliyun ecs DescribeInstances --RegionId <region-id>
aliyun rds DescribeDBInstances --RegionId <region-id>
aliyun ram ListUsers
aliyun vpc DescribeVpcs --RegionId <region-id>
aliyun oss ls oss://<bucket-name>

Validation

• Re-run the control and confirm findings are cleared.
• If an exception is required, document owner, reason, and expiration date.

Service-wide remediation

Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.

Alibaba Cloud

Use Resource Directory guardrails, account baselines, and IaC modules so the secure setting is applied consistently across environments.

Operational rollout

1. Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
2. Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
3. Re-scan and track approved exceptions with an owner and expiry date.