Back to Checks
alibabacloud

RAM password policy has lowercase letter requirement

ram_password_policy_lowercase
Service: ramSeverity: medium
OfficialBuilt-inVerified
Categories:secrets
Resource Type:ALIYUN::RAM::SecurityPreference

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require at least one lowercase letter to increase the character diversity of passwords. This enhances account resiliency against brute force logon attempts and dictionary attacks.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without requiring lowercase letters in the password policy, users may create passwords with limited character diversity. Weak passwords without sufficient character variety are more susceptible to dictionary attacks and automated password cracking tools, potentially compromising the confidentiality of user accounts and the resources they have access to.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ram_password_policy_lowercase

Recommendation

Configure the RAM password policy to require at least one lowercase letter to improve password complexity.

Remediation

CLI

aliyun ram SetPasswordPolicy --RequireLowercaseCharacters true

Terraform

resource "alicloud_ram_password_policy" "example" {
  require_lowercase_characters = true
}

Other

1Log on to the **RAM Console**.
2Choose **Settings**.
3In the Password section, click **Modify**.
4In the Charset section, select **Lower case**.
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ram.ram_client import ram_client


class ram_password_policy_lowercase(Check):
    """Check if RAM password policy requires at least one lowercase letter."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        if ram_client.password_policy:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=ram_client.password_policy
            )
            report.region = ram_client.region
            report.resource_id = f"{ram_client.audited_account}-password-policy"
            report.resource_arn = (
                f"acs:ram::{ram_client.audited_account}:password-policy"
            )

            if ram_client.password_policy.require_lowercase_characters:
                report.status = "PASS"
                report.status_extended = (
                    "RAM password policy requires at least one lowercase letter."
                )
            else:
                report.status = "FAIL"
                report.status_extended = "RAM password policy does not require at least one lowercase letter."

            findings.append(report)

        return findings

References