Back to Checks
alibabacloud

RAM password policy requires a minimum length of 14 or greater

ram_password_policy_minimum_length
Service: ramSeverity: medium
OfficialBuilt-inVerified
Categories:secrets
Resource Type:ALIYUN::RAM::SecurityPreference

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require a minimum of 14 or greater characters for any password. Longer passwords provide exponentially more security against automated password cracking, as the keyspace increases dramatically with each additional character.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Short passwords significantly reduce the effort required for brute force attacks. Passwords shorter than 14 characters can be cracked much faster, potentially compromising confidentiality of user accounts. This can lead to unauthorized access to cloud resources and sensitive data, affecting the integrity and availability of the environment.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ram_password_policy_minimum_length

Recommendation

Configure the RAM password policy to require a minimum password length of 14 characters or greater.

Remediation

CLI

aliyun ram SetPasswordPolicy --MinimumPasswordLength 14

Terraform

resource "alicloud_ram_password_policy" "example" {
  minimum_password_length = 14
}

Other

1Log on to the **RAM Console**.
2Choose **Settings**.
3In the Password section, click **Modify**.
4In the Length section, enter `14` or a greater number.
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ram.ram_client import ram_client


class ram_password_policy_minimum_length(Check):
    """Check if RAM password policy requires minimum length of 14 or greater."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        if ram_client.password_policy:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=ram_client.password_policy
            )
            report.region = ram_client.region
            report.resource_id = f"{ram_client.audited_account}-password-policy"
            report.resource_arn = (
                f"acs:ram::{ram_client.audited_account}:password-policy"
            )

            if ram_client.password_policy.minimum_password_length >= 14:
                report.status = "PASS"
                report.status_extended = f"RAM password policy requires minimum length of {ram_client.password_policy.minimum_password_length} characters."
            else:
                report.status = "FAIL"
                report.status_extended = f"RAM password policy requires minimum length of {ram_client.password_policy.minimum_password_length} characters, which is less than the recommended 14 characters."

            findings.append(report)

        return findings

References