Back to Checks
alibabacloud

RAM password policy requires at least one symbol

ram_password_policy_symbol
Service: ramSeverity: medium
OfficialBuilt-inVerified
Categories:secrets
Resource Type:ALIYUN::RAM::SecurityPreference

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require at least one special character (symbol) to increase the character diversity of passwords. Special characters significantly increase the keyspace that attackers must search, enhancing account resiliency against brute force logon attempts.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without requiring symbols in the password policy, users may create passwords composed only of alphanumeric characters. Such passwords have a reduced keyspace and are more susceptible to brute force attacks and automated password cracking tools, potentially compromising the confidentiality of user accounts and the cloud resources they protect.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ram_password_policy_symbol

Recommendation

Configure the RAM password policy to require at least one symbol to improve password complexity.

Remediation

CLI

aliyun ram SetPasswordPolicy --RequireSymbols true

Terraform

resource "alicloud_ram_password_policy" "example" {
  require_symbols = true
}

Other

1Log on to the **RAM Console**.
2Choose **Settings**.
3In the Password section, click **Modify**.
4In the Charset section, select **Symbol**.
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ram.ram_client import ram_client


class ram_password_policy_symbol(Check):
    """Check if RAM password policy requires at least one symbol."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        if ram_client.password_policy:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=ram_client.password_policy
            )
            report.region = ram_client.region
            report.resource_id = f"{ram_client.audited_account}-password-policy"
            report.resource_arn = (
                f"acs:ram::{ram_client.audited_account}:password-policy"
            )

            if ram_client.password_policy.require_symbols:
                report.status = "PASS"
                report.status_extended = (
                    "RAM password policy requires at least one symbol."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    "RAM password policy does not require at least one symbol."
                )

            findings.append(report)

        return findings

References