Back to Checks
alibabacloud

RAM password policy expires passwords within 365 days or less

ram_password_policy_max_password_age
Service: ramSeverity: medium
OfficialBuilt-inVerified
Categories:secrets
Resource Type:ALIYUN::RAM::SecurityPreference

Alibaba Cloud RAM password policies can require passwords to expire after a given number of days. It is recommended to expire passwords after 365 days or less for periodic credential rotation. The CIS benchmark recommends an annual reset as a balanced approach that avoids overly frequent changes while ensuring compromised credentials have a limited lifespan.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without a maximum password age, compromised passwords remain valid indefinitely, giving attackers persistent access. A reasonable maximum of 365 days ensures compromised credentials are eventually invalidated, reducing the window for unauthorized access and protecting confidentiality and integrity of account data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ram_password_policy_max_password_age

Recommendation

Configure the RAM password policy to expire passwords within 365 days or less.

Remediation

CLI

aliyun ram SetPasswordPolicy --MaxPasswordAge 365

Terraform

resource "alicloud_ram_password_policy" "example" {
  max_password_age = 365
}

Other

1Log on to the **RAM Console**.
2Choose **Settings**.
3In the Password section, click **Modify**.
4Check the box under `Max Age`, enter `365` or a smaller number.
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ram.ram_client import ram_client


class ram_password_policy_max_password_age(Check):
    """Check if RAM password policy expires passwords in 365 days or greater."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        if ram_client.password_policy:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=ram_client.password_policy
            )
            report.region = ram_client.region
            report.resource_id = f"{ram_client.audited_account}-password-policy"
            report.resource_arn = (
                f"acs:ram::{ram_client.audited_account}:password-policy"
            )

            # If max_password_age is 0, it means password expiration is disabled (which is acceptable)
            # If it's set, it should be 365 or greater
            if ram_client.password_policy.max_password_age == 0:
                report.status = "PASS"
                report.status_extended = "RAM password policy does not expire passwords (password expiration is disabled)."
            elif ram_client.password_policy.max_password_age >= 365:
                report.status = "PASS"
                report.status_extended = f"RAM password policy expires passwords after {ram_client.password_policy.max_password_age} days."
            else:
                report.status = "FAIL"
                report.status_extended = f"RAM password policy expires passwords after {ram_client.password_policy.max_password_age} days, which is less than the recommended 365 days."

            findings.append(report)

        return findings

References