Back to Checks
alibabacloud

No root account access key exists

ram_no_root_access_key
Service: ramSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:ALIYUN::RAM::User

Alibaba Cloud RAM access keys provide programmatic access to an account. The root account is the most privileged user and should not have access keys. All root access keys should be removed to limit compromise vectors and encourage role-based accounts following the principle of least privilege.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

The root account has unrestricted access to all resources and services. If its access keys are compromised, an attacker gains full administrative control, including ability to create, modify, or delete any resource. This poses critical risk to the confidentiality, integrity, and availability of all cloud resources and data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ram_no_root_access_key

Recommendation

Remove all access keys associated with the root account to reduce the attack surface and encourage the use of role-based accounts with least privilege.

Remediation

CLI

aliyun ram DeleteAccessKey --UserAccessKeyId <access_key_ID>

Other

1Log on to the **RAM Console** by using your Alibaba Cloud account (root account).
2Move the pointer over the account icon in the upper-right corner and click **AccessKey**.
3Click **Continue to manage AccessKey**.
4On the Security Management page, find the target access keys and click **Delete** to delete the target access keys permanently.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ram.ram_client import ram_client


class ram_no_root_access_key(Check):
    """Check if root account has no access keys."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        report = CheckReportAlibabaCloud(metadata=self.metadata(), resource={})
        report.region = ram_client.region
        report.resource_id = "<root_account>"
        report.resource_arn = f"acs:ram::{ram_client.audited_account}:root"

        # Check if we're authenticated as root account
        # Use the is_root flag from identity (set via STS GetCallerIdentity)
        is_root = ram_client.provider.identity.is_root

        if not is_root:
            # If authenticated as RAM user, we can't verify root account access keys
            report.status = "MANUAL"
            report.status_extended = "Cannot verify root account access keys: authenticated as RAM user. This check requires root account credentials."
        elif ram_client.root_access_keys:
            report.status = "FAIL"
            report.status_extended = "Root account has access keys."
        else:
            report.status = "PASS"
            report.status_extended = "Root account does not have access keys."

        findings.append(report)

        return findings

References