Back to Checks
alibabacloud

RAM password policy prevents password reuse

ram_password_policy_password_reuse_prevention
Service: ramSeverity: medium
OfficialBuilt-inVerified
Categories:secrets
Resource Type:ALIYUN::RAM::SecurityPreference

Alibaba Cloud RAM password policies can be configured to prevent the reuse of previously used passwords. It is recommended that the password policy prevent the reuse of passwords to ensure users cannot cycle back to previously compromised credentials. This increases account resiliency against brute force logon attempts and reduces the risk of credential reuse attacks.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without password reuse prevention, users may cycle back to previously compromised passwords. Attackers with knowledge of old credentials can regain access, threatening the confidentiality and integrity of cloud resources. This weakens the overall security posture of the Alibaba Cloud environment.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ram_password_policy_password_reuse_prevention

Recommendation

Configure the RAM password policy to prevent the reuse of at least the last 5 passwords.

Remediation

CLI

aliyun ram SetPasswordPolicy --PasswordReusePrevention 5

Terraform

resource "alicloud_ram_password_policy" "example" {
  password_reuse_prevention = 5
}

Other

1Log on to the **RAM Console**.
2Choose **Settings**.
3In the Password section, click **Modify**.
4In the `Do Not repeat History` section field, enter `5`.
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ram.ram_client import ram_client


class ram_password_policy_password_reuse_prevention(Check):
    """Check if RAM password policy prevents password reuse."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        if ram_client.password_policy:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=ram_client.password_policy
            )
            report.region = ram_client.region
            report.resource_id = f"{ram_client.audited_account}-password-policy"
            report.resource_arn = (
                f"acs:ram::{ram_client.audited_account}:password-policy"
            )

            if ram_client.password_policy.password_reuse_prevention >= 5:
                report.status = "PASS"
                report.status_extended = f"RAM password policy prevents password reuse (history: {ram_client.password_policy.password_reuse_prevention} passwords)."
            else:
                report.status = "FAIL"
                if ram_client.password_policy.password_reuse_prevention == 0:
                    report.status_extended = (
                        "RAM password policy does not prevent password reuse."
                    )
                else:
                    report.status_extended = f"RAM password policy prevents reuse of only {ram_client.password_policy.password_reuse_prevention} previous passwords, which is less than the recommended 5."

            findings.append(report)

        return findings

References