Back to Checks
alibabacloud

RAM password policy temporarily blocks logon after 5 incorrect attempts within an hour

ram_password_policy_max_login_attempts
Service: ramSeverity: medium
OfficialBuilt-inVerified
Categories:secrets
Resource Type:ALIYUN::RAM::SecurityPreference

Alibaba Cloud RAM password policies can temporarily block logon after several incorrect logon attempts within an hour. It is recommended that the password policy is set to temporarily block logon after 5 incorrect logon attempts within an hour to protect accounts against automated brute force logon attempts and credential stuffing attacks.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without an account lockout policy, attackers can make unlimited brute force logon attempts against RAM user accounts without any throttling. This significantly increases the risk of password compromise, potentially leading to unauthorized access to cloud resources and a breach of confidentiality and integrity of the account's data and services.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ram_password_policy_max_login_attempts

Recommendation

Configure the RAM password policy to temporarily block logon after 5 incorrect attempts within an hour.

Remediation

CLI

aliyun ram SetPasswordPolicy --MaxLoginAttemps 5

Terraform

resource "alicloud_ram_password_policy" "example" {
  max_login_attemps = 5
}

Other

1Log on to the **RAM Console**.
2Choose **Settings**.
3In the Password section, click **Modify**.
4In the `Max Attempts` field, check the box next to **Enable** and enter `5`.
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ram.ram_client import ram_client


class ram_password_policy_max_login_attempts(Check):
    """Check if RAM password policy temporarily blocks logon after 5 incorrect logon attempts within an hour."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        if ram_client.password_policy:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=ram_client.password_policy
            )
            report.region = ram_client.region
            report.resource_id = f"{ram_client.audited_account}-password-policy"
            report.resource_arn = (
                f"acs:ram::{ram_client.audited_account}:password-policy"
            )
            if ram_client.password_policy.max_login_attempts >= 5:
                report.status = "PASS"
                report.status_extended = "RAM password policy temporarily blocks logon after 5 incorrect logon attempts within an hour."
            elif ram_client.password_policy.max_login_attempts == 0:
                report.status = "FAIL"
                report.status_extended = "RAM password policy does not temporarily block logon after incorrect attempts (max login attempts is disabled)."
            else:
                report.status = "FAIL"
                report.status_extended = f"RAM password policy temporarily blocks logon after {ram_client.password_policy.max_login_attempts} incorrect logon attempts, which is not the recommended value of 5."

            findings.append(report)

        return findings

References