Back to Checks
alibabacloud

RAM password policy requires at least one number

ram_password_policy_number
Service: ramSeverity: medium
OfficialBuilt-inVerified
Categories:secrets
Resource Type:ALIYUN::RAM::SecurityPreference

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require at least one numeric character to increase the character diversity of passwords. This enhances account resiliency against brute force logon attempts and dictionary attacks by expanding the keyspace.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without requiring numeric characters in the password policy, users may create passwords composed only of alphabetic characters. Such passwords are more susceptible to dictionary attacks and automated cracking tools, potentially compromising the confidentiality of user accounts and the cloud resources they protect.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ram_password_policy_number

Recommendation

Configure the RAM password policy to require at least one numeric character to improve password complexity.

Remediation

CLI

aliyun ram SetPasswordPolicy --RequireNumbers true

Terraform

resource "alicloud_ram_password_policy" "example" {
  require_numbers = true
}

Other

1Log on to the **RAM Console**.
2Choose **Settings**.
3In the Password section, click **Modify**.
4In the Charset section, select **Number**.
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ram.ram_client import ram_client


class ram_password_policy_number(Check):
    """Check if RAM password policy requires at least one number."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        if ram_client.password_policy:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=ram_client.password_policy
            )
            report.region = ram_client.region
            report.resource_id = f"{ram_client.audited_account}-password-policy"
            report.resource_arn = (
                f"acs:ram::{ram_client.audited_account}:password-policy"
            )

            if ram_client.password_policy.require_numbers:
                report.status = "PASS"
                report.status_extended = (
                    "RAM password policy requires at least one number."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    "RAM password policy does not require at least one number."
                )

            findings.append(report)

        return findings

References