Back to Checks
alibabacloud

RAM password policy has uppercase letter requirement

ram_password_policy_uppercase
Service: ramSeverity: medium
OfficialBuilt-inVerified
Categories:secrets
Resource Type:ALIYUN::RAM::SecurityPreference

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require at least one uppercase letter to increase the character diversity of passwords. This enhances account resiliency against brute force logon attempts and dictionary attacks by requiring mixed-case passwords.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without requiring uppercase letters in the password policy, users may create passwords with limited case diversity. Weak passwords without case variety are more susceptible to dictionary attacks and automated password cracking tools, potentially compromising the confidentiality of user accounts and the resources they have access to.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ram_password_policy_uppercase

Recommendation

Configure the RAM password policy to require at least one uppercase letter to improve password complexity.

Remediation

CLI

aliyun ram SetPasswordPolicy --RequireUppercaseCharacters true

Terraform

resource "alicloud_ram_password_policy" "example" {
  require_uppercase_characters = true
}

Other

1Log on to the **RAM Console**.
2Choose **Settings**.
3In the Password section, click **Modify**.
4In the Charset section, select **Upper case**.
5Click **OK**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ram.ram_client import ram_client


class ram_password_policy_uppercase(Check):
    """Check if RAM password policy requires at least one uppercase letter."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        if ram_client.password_policy:
            report = CheckReportAlibabaCloud(
                metadata=self.metadata(), resource=ram_client.password_policy
            )
            report.region = ram_client.region
            report.resource_id = f"{ram_client.audited_account}-password-policy"
            report.resource_arn = (
                f"acs:ram::{ram_client.audited_account}:password-policy"
            )

            if ram_client.password_policy.require_uppercase_characters:
                report.status = "PASS"
                report.status_extended = (
                    "RAM password policy requires at least one uppercase letter."
                )
            else:
                report.status = "FAIL"
                report.status_extended = "RAM password policy does not require at least one uppercase letter."

            findings.append(report)

        return findings

References