Tencent Cloud

Security and operational configuration guidance for Tencent Cloud resources managed with Terraform.

Documentation

Article	Path
CDB backup policy is not explicitly managed	`terraform/tencentcloud/cdb_instance_without_backup_policy`
Review the default Tencent Cloud CDB intranet port	`terraform/tencentcloud/cdb_instance_using_default_intranet_port`
Tencent Cloud CLB access logging is not configured	`terraform/tencentcloud/clb_instance_log_setting_disabled`
Tencent Cloud CVM monitoring agent installation is disabled	`terraform/tencentcloud/cvm_instance_disable_monitor_service`
API secrets in Tencent Cloud CVM user data	`terraform/tencentcloud/cvm_instance_using_user_data`
Review default VPC use by Tencent Cloud CVM	`terraform/tencentcloud/cvm_instance_using_default_vpc`
Review default security group use by Tencent Cloud CVM	`terraform/tencentcloud/cvm_instance_using_default_security_group`
Review public IP assignment to Tencent Cloud TKE nodes	`terraform/tencentcloud/tke_cluster_has_public_access`
Tencent Cloud TKE log agent is disabled	`terraform/tencentcloud/tke_cluster_log_disabled`
Tencent Cloud VPC flow logging is disabled	`terraform/tencentcloud/vpc_flow_log_disabled`
Tencent Cloud CBS disk encryption is disabled	`terraform/tencentcloud/disk_encryption_disabled`
Review public IP use on a Tencent Cloud CVM instance	`terraform/tencentcloud/cvm_instance_has_public_ip`
Tencent Cloud security-group rule allows all traffic from every address	`terraform/tencentcloud/security_group_rule_set_accepts_all_traffic`
Review transport encryption on a Tencent Cloud CLB listener	`terraform/tencentcloud/clb_listener_using_insecure_protocols`
Review Secret encryption at rest in Tencent Cloud TKE	`terraform/tencentcloud/tke_cluster_encryption_protection_disabled`
Internet service enabled on a Tencent Cloud CDB instance	`terraform/tencentcloud/cdb_instance_internet_service_enabled`

Related pages16

CDB backup policy is not explicitly managed

Manage database backup schedules to meet recovery needs.

Review the default Tencent Cloud CDB intranet port

Manage the database port together with its access policy.

Tencent Cloud CLB access logging is not configured

Collect access logs for supported CLB listeners.

Tencent Cloud CVM monitoring agent installation is disabled

Collect the monitoring metrics needed for operations.

API secrets in Tencent Cloud CVM user data

Keep long-lived API keys out of instance user data.

Review default VPC use by Tencent Cloud CVM

Align network boundaries with workload security requirements.

Review default security group use by Tencent Cloud CVM

Use security groups that permit only the traffic a workload needs.

Review public IP assignment to Tencent Cloud TKE nodes

Keep nodes on private networks when direct internet access is unnecessary.

Tencent Cloud TKE log agent is disabled

Configure the agent to collect workload logs.

Tencent Cloud VPC flow logging is disabled

Collect the network flow records needed for investigation.

Tencent Cloud CBS disk encryption is disabled

Encrypt disks that hold sensitive data.

Review public IP use on a Tencent Cloud CVM instance

Check whether the instance needs a public IP and restrict external access paths.

Tencent Cloud security-group rule allows all traffic from every address

Restrict inbound rules to required sources, protocols and ports.

Review transport encryption on a Tencent Cloud CLB listener

Check that sensitive data is encrypted from the client through to the backend.

Review Secret encryption at rest in Tencent Cloud TKE

Check Secret encryption at rest and access to the KMS key in TKE.

Internet service enabled on a Tencent Cloud CDB instance

Restrict database internet access to clients that need it.