Back to Checks
alibabacloud

RAM policies are attached only to groups or roles

ram_policy_attached_only_to_group_or_roles
Service: ramSeverity: low
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:ALIYUN::RAM::ManagedPolicy

Alibaba Cloud RAM users, groups, and roles have no access by default. RAM policies grant privileges to these principals. It is recommended to apply policies to groups and roles rather than individual users, simplifying access management and reducing unintended permissions as the number of users grows.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Assigning privileges directly to users instead of groups or roles increases access management complexity. As users grow, this can lead to principals receiving excessive privileges, threatening confidentiality and integrity of cloud resources. It also makes auditing and compliance reviews significantly harder.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ram_policy_attached_only_to_group_or_roles

Recommendation

Detach policies from individual RAM users and attach them to groups or roles instead to simplify access management.

Remediation

CLI

aliyun ram DetachPolicyFromUser --PolicyName <policy_name> --PolicyType <System|Custom> --UserName <ram_user>

Other

1Create **RAM user groups** and assign policies to those groups.
2Add users to the appropriate groups.
3Detach any policies directly attached to users using the RAM Console or CLI.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ram.ram_client import ram_client


class ram_policy_attached_only_to_group_or_roles(Check):
    """Check if RAM policies are attached only to groups or roles, not directly to users."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for user in ram_client.users:
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=user)
            report.region = ram_client.region
            report.resource_id = user.name
            report.resource_arn = (
                f"acs:ram::{ram_client.audited_account}:user/{user.name}"
            )

            if user.attached_policies:
                report.status = "FAIL"
                policy_names = [policy.policy_name for policy in user.attached_policies]
                report.status_extended = (
                    f"RAM user {user.name} has {len(user.attached_policies)} "
                    f"policies directly attached: {', '.join(policy_names)}. "
                    f"Policies should be attached to groups or roles instead."
                )
                findings.append(report)
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"RAM user {user.name} has no policies directly attached."
                )
                findings.append(report)

        return findings

References